Overview

overview

1

Static

static

1

URLScan

urlscan

1

http://start.duckduc...

windows11-21h2-x64

1

Analysis

  • max time kernel
    1002s
  • max time network
    1012s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    12-06-2024 21:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    http://start.duckduckgo.com

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 32 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://start.duckduckgo.com
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1848
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9dadf3cb8,0x7ff9dadf3cc8,0x7ff9dadf3cd8
      2⤵
        PID:3560
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,11613142352138067354,11814929014239848758,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
        2⤵
          PID:3824
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,11613142352138067354,11814929014239848758,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:916
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,11613142352138067354,11814929014239848758,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
          2⤵
            PID:4992
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11613142352138067354,11814929014239848758,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
            2⤵
              PID:4644
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,11613142352138067354,11814929014239848758,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
              2⤵
                PID:2328
            • C:\Windows\System32\CompPkgSrv.exe
              C:\Windows\System32\CompPkgSrv.exe -Embedding
              1⤵
                PID:3840
              • C:\Windows\System32\CompPkgSrv.exe
                C:\Windows\System32\CompPkgSrv.exe -Embedding
                1⤵
                  PID:3476
                • C:\Windows\SysWOW64\DllHost.exe
                  C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                  1⤵
                    PID:2256
                  • C:\Windows\system32\rundll32.exe
                    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\System32\srchadmin.dll ,
                    1⤵
                      PID:4752
                    • C:\Windows\SysWOW64\DllHost.exe
                      C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                      1⤵
                        PID:3340
                      • C:\Windows\system32\rundll32.exe
                        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\System32\srchadmin.dll ,
                        1⤵
                          PID:3236
                        • C:\Windows\system32\control.exe
                          "C:\Windows\system32\control.exe" /name Microsoft.AdministrativeTools
                          1⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4516
                        • C:\Windows\SysWOW64\DllHost.exe
                          C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                          1⤵
                            PID:1248
                          • C:\Windows\explorer.exe
                            C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious behavior: AddClipboardFormatListener
                            • Suspicious behavior: GetForegroundWindowSpam
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SetWindowsHookEx
                            PID:4996
                          • C:\Windows\SysWOW64\DllHost.exe
                            C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                            1⤵
                              PID:2412
                            • C:\Windows\SysWOW64\DllHost.exe
                              C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                              1⤵
                                PID:5104
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                                1⤵
                                  PID:2532
                                • C:\Windows\system32\wwahost.exe
                                  "C:\Windows\system32\wwahost.exe" -ServerName:App.wwa
                                  1⤵
                                  • Modifies Internet Explorer settings
                                  • Modifies data under HKEY_USERS
                                  • Modifies registry class
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of SetWindowsHookEx
                                  PID:356

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                  Filesize

                                  152B

                                  MD5

                                  6876cbd342d4d6b236f44f52c50f780f

                                  SHA1

                                  a215cf6a499bfb67a3266d211844ec4c82128d83

                                  SHA256

                                  ca5a6320d94ee74db11e55893a42a52c56c8f067cba35594d507b593d993451e

                                  SHA512

                                  dff3675753b6b733ffa2da73d28a250a52ab29620935960673d77fe2f90d37a273c8c6afdf87db959bdb49f31b69b41f7aa4febac5bbdd43a9706a4dd9705039

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                  Filesize

                                  152B

                                  MD5

                                  c1c7e2f451eb3836d23007799bc21d5f

                                  SHA1

                                  11a25f6055210aa7f99d77346b0d4f1dc123ce79

                                  SHA256

                                  429a870d582c77c8a661c8cc3f4afa424ed5faf64ce722f51a6a74f66b21c800

                                  SHA512

                                  2ca40bbbe76488dff4b10cca78a81ecf2e97d75cd65f301da4414d93e08e33f231171d455b0dbf012b2d4735428e835bf3631f678f0ab203383e315da2d23a34

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                  Filesize

                                  5KB

                                  MD5

                                  e5ffd95026814a822c4ec00b0e25bc60

                                  SHA1

                                  e1c0b75bdc44e2fcca1a5cb2076faf8c1a231e03

                                  SHA256

                                  4202f5761a869f5c75aff8da7e6134cc59bcf6a79d82c0cde99a1dac2927de62

                                  SHA512

                                  e0ee285042cc20d3e86f008184d87e2a6bec887c8c756ce4ba96293c51c8ebb01e443477e181645b1629fdf0b421f1d4579523194f9c19d045354560729d182e

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                  Filesize

                                  8KB

                                  MD5

                                  b533d575c358dafe5a456a2f9ef24913

                                  SHA1

                                  80a1e9ea803b4c624f1894e3b7328ead32c5083b

                                  SHA256

                                  e2ebd981861d7349fb6422d4d81480180e0bff88d2067190779eeda9f8e8c54f

                                  SHA512

                                  983c87a58bdd759de4eb19bd3af26a9e6f94d2f9e197351af8efefc43128cd1efa8a61a3a62fafd0b9dffb58c9aa7134d0b9af694892a68985d92c94ec351479

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
                                  Filesize

                                  264KB

                                  MD5

                                  f50f89a0a91564d0b8a211f8921aa7de

                                  SHA1

                                  112403a17dd69d5b9018b8cede023cb3b54eab7d

                                  SHA256

                                  b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                  SHA512

                                  bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                  Filesize

                                  14KB

                                  MD5

                                  eb9ff0ad3e2e2a689d83663d5bebfa6a

                                  SHA1

                                  893e69800c20ac0f997a952a6722377c378b2fd2

                                  SHA256

                                  933acd3d85cd9036952419a618971981aaa2c1f42337467f8b4f24e8fc66c369

                                  SHA512

                                  5f24f6117ab4f7f27d470332af8cb792eb590b1badcf1b350ce8fae4f7d3590de3052e1f4bda83d4f72684189e6ad23f55f63ccb520888698aba4dd87c76f8f8

                                  Download Submit

                                • memory/356-295-0x00000200384F0000-0x0000020038510000-memory.dmp

                                  Filesize

                                  128KB

                                  Download