hxxp://taplink[.]cc/contactteam02

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
10/06/2024, 22:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://taplink.cc/contactteam02

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1864	msedge.exe
1864	msedge.exe
3308	msedge.exe
3308	msedge.exe
2136	identity_helper.exe
2136	identity_helper.exe
2116	msedge.exe
2116	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 2336	3308	msedge.exe	77
PID 3308 wrote to memory of 2336	3308	msedge.exe	77
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 5032	3308	msedge.exe	78
PID 3308 wrote to memory of 1864	3308	msedge.exe	79
PID 3308 wrote to memory of 1864	3308	msedge.exe	79
PID 3308 wrote to memory of 1588	3308	msedge.exe	80
PID 3308 wrote to memory of 1588	3308	msedge.exe	80
PID 3308 wrote to memory of 1588	3308	msedge.exe	80
PID 3308 wrote to memory of 1588	3308	msedge.exe	80
PID 3308 wrote to memory of 1588	3308	msedge.exe	80
PID 3308 wrote to memory of 1588	3308	msedge.exe	80
PID 3308 wrote to memory of 1588	3308	msedge.exe	80
PID 3308 wrote to memory of 1588	3308	msedge.exe	80
PID 3308 wrote to memory of 1588	3308	msedge.exe	80
PID 3308 wrote to memory of 1588	3308	msedge.exe	80
PID 3308 wrote to memory of 1588	3308	msedge.exe	80
PID 3308 wrote to memory of 1588	3308	msedge.exe	80
PID 3308 wrote to memory of 1588	3308	msedge.exe	80
PID 3308 wrote to memory of 1588	3308	msedge.exe	80
PID 3308 wrote to memory of 1588	3308	msedge.exe	80
PID 3308 wrote to memory of 1588	3308	msedge.exe	80
PID 3308 wrote to memory of 1588	3308	msedge.exe	80
PID 3308 wrote to memory of 1588	3308	msedge.exe	80
PID 3308 wrote to memory of 1588	3308	msedge.exe	80
PID 3308 wrote to memory of 1588	3308	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://taplink.cc/contactteam02
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe30463cb8,0x7ffe30463cc8,0x7ffe30463cd8
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,7336237658177563698,8802965124914213452,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,7336237658177563698,8802965124914213452,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1940,7336237658177563698,8802965124914213452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,7336237658177563698,8802965124914213452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,7336237658177563698,8802965124914213452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,7336237658177563698,8802965124914213452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,7336237658177563698,8802965124914213452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,7336237658177563698,8802965124914213452,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,7336237658177563698,8802965124914213452,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4804 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,7336237658177563698,8802965124914213452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,7336237658177563698,8802965124914213452,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1940,7336237658177563698,8802965124914213452,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,7336237658177563698,8802965124914213452,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5376 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
046d49efac191159051a8b2dea884f79

SHA1
d0cf8dc3bc6a23bf2395940cefcaad1565234a3a

SHA256
00dfb1705076450a45319666801a3a7032fc672675343434cb3d68baccb8e1f7

SHA512
46961e0f0e4d7f82b4417e4aac4434e86f2130e92b492b53a194255bd3bba0855069524cd645f910754d4d2dbf3f1dc467bcc997f01dc6b1d8d6028e2d957236

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d22039bc7833a3a27231b8eb834f70

SHA1
79c4290a2894b0e973d3c4b297fad74ef45607bb

SHA256
402defe561006133623c2a4791b2baf90b92d5708151c2bcac6d02d2771cd3d6

SHA512
c69ee22d8c52a61e59969aa757d58ab4f32492854fc7116975efc7c6174f5d998cc236bbf15bce330d81e39a026b18e29683b6d69c93d21fea6d14e21460a0a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
c484acc66dc4321a0bc81db952791bd7

SHA1
757bc5a3e199900b2383806c9212d4d7cad94548

SHA256
b2754bd1c49de2f980514bff5ea82bfd53573ab03423f1e3878261c969abddcb

SHA512
6e9b76fffaaef8c41eea63cd2e1b329d239c014f370d10cf3fb7be69b4baf82a53c57560da6aa48cfda6fe9cc4e49c3adc0f3379c26b50171214ca9ea44f8133

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
316B

MD5
913ebe15d5ad53106ca277745b9829fa

SHA1
4a32e392abc1c940ad752c2cafb5ba1b6e181b85

SHA256
1932feef71c40893f0bf39edcd9c2fc2f615c9daf5f4298857e53c1197852c23

SHA512
065a672ff990c1cff4e9017d4a394c2966df8ffb64cb309a6b2d4b11229cffbceb02fc30b24c4d990ef2dbdef94e33ff192f487ec10c37c0cf65c01167cc0983

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
37939dd3655d3180196c199f9b5ec44c

SHA1
56e42670c5338b8b764ad67ba247c29389f26224

SHA256
dae1641ac85ab8896ea270b766d4c6b2bd5e9e7b053a8d9eebd8dda204f5824e

SHA512
e31c2c6b79a37ba7dec5cf26694418fbf5f3ef93eb62bb99d39e33620c72f4bb2e0728996707ddad6fe352aeb736586504162686fd129c48b2d852103be91694

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
53d6342bc7892dfcec308501eddf9024

SHA1
0c8fb3739c6133b96c5499e3cc4e61afb3401117

SHA256
1828093fd3d4c713d8d60d815541730879fcce6121783d722f04cc3c7f1018c8

SHA512
0f355fc09841522a34a2696dc2f79ae04cf341699f41d0d6b82ef706e454a4a6dcbd301dae14b6e13584b01ed0b03f56c5a3e0af487a9a269226cf8f186c7c33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
552defa1c9702ab7a5b5c77993257d4f

SHA1
619667d66c40cac43a93510107663e5ca78b42c5

SHA256
b5f8e84cc0ee857deaf4a49c1f10f04dc26f9a3e4875bbd0c29695afc59b6803

SHA512
859b9173bd793ee178eea5d5415a1ff99a3a996877e5f78e30b8248b3b4e6f5009ad93ed8143229953497c7680800fab047b2e3235e2b0f850598dbe90ffe835

Download Submit