hxxps://newreceipt[.]standard[.]us-east-1[.]oortech[.]com/KON21305[.]html

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2024 08:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://newreceipt.standard.us-east-1.oortech.com/KON21305.html

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
220	msedge.exe
220	msedge.exe
2932	msedge.exe
2932	msedge.exe
2472	identity_helper.exe
2472	identity_helper.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

2932 msedge.exe
2932 msedge.exe
2932 msedge.exe
2932 msedge.exe
2932 msedge.exe
2932 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2932 wrote to memory of 624	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 624	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 2408	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 220	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 220	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 1480	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 1480	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 1480	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 1480	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 1480	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 1480	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 1480	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 1480	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 1480	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 1480	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 1480	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 1480	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 1480	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 1480	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 1480	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 1480	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 1480	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 1480	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 1480	2932	msedge.exe	msedge.exe
PID 2932 wrote to memory of 1480	2932	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://newreceipt.standard.us-east-1.oortech.com/KON21305.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff959b246f8,0x7ff959b24708,0x7ff959b24718
2⤵
PID:624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,7297752163005113457,11725262740993372823,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
2⤵
PID:2408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,7297752163005113457,11725262740993372823,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,7297752163005113457,11725262740993372823,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
2⤵
PID:1480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7297752163005113457,11725262740993372823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
2⤵
PID:2160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7297752163005113457,11725262740993372823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
2⤵
PID:4564

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,7297752163005113457,11725262740993372823,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
2⤵
PID:2976

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,7297752163005113457,11725262740993372823,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7297752163005113457,11725262740993372823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
2⤵
PID:1572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7297752163005113457,11725262740993372823,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
2⤵
PID:3868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7297752163005113457,11725262740993372823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
2⤵
PID:4044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7297752163005113457,11725262740993372823,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
2⤵
PID:3900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,7297752163005113457,11725262740993372823,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3372 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3004

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
168B

MD5
2e42e3e995a31641337e19f5ce4f8606

SHA1
544a12ab591b102f494d489b626a3d3a6f1c26fb

SHA256
7ad9d0f8e97f31ef00bb9125105b70d1f42f3cbf8f59f72f60b816a677bd3c6c

SHA512
c3bb0637757e525a1fd1394df3aa0d3acd02ca0cb3f62547e453059e72cbe3dc454343f48da87653afcf5118d1f56747d27c0b80465e94a41c2756c6edc1bc18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
723B

MD5
623c7d0d061d7924a2f83c2386d61535

SHA1
38e39700dd024caac759df0d996aff82f7adb861

SHA256
082cfc2d14ad6a394e48a7ece1d70020154c82956754677e4b6b932140c975f5

SHA512
b518e9ee27992fc9b98c8e170180a48b1a158bbae6b4970a551790e28e5036fecc2d5c3ea21396d73a0eb6a4fe36f5101f5f5c2c79d76946ec6178644b43bb89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
b6423a5b7e5330563e8a543e57a48a6b

SHA1
d37971fd7d151f269c2bcbf5801714c644164b66

SHA256
cc36c73f06c95908b08bd0a193d33dc9b8d1837596c7a6ad2330c457751c8756

SHA512
acdd82db47a97be4f54c5874932865c03ffa699e9831d0923775d75cd4511308971f744c8ca399b2611195bb4cce7d4c6e510147142990469897984d123cffcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
0ef14b4911ef731fbe59b7fcbff174c3

SHA1
0760e4048f798a9998e0900342a4f0018146afb9

SHA256
a8063e988f9b74d09a61a3e76540dc39e2acb97d60fe2097bc8e25d089eab042

SHA512
5b268c5e9a1a5bcdc2f33b524a0efea1b866a3424af533b0d82f3e8d7cef24dfa061421dfee2b19438628c848dcae8e4ace66c6076699575e5f5ca1ba91c26d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
98cedf2ad883599e2d89a4148c6629ad

SHA1
c1e8d0d60eca01dad4a470888df3dadbc407affe

SHA256
61a44a2974a95c8a22edd5effee90eb91a3072719aa28dd05b7c78472f79e8d1

SHA512
9105dd9039e989a557e9014ff78108669bdf1f1eaa5ca36f5596e3b038a962cae76828c173da423270d0f4cc89089cd4dfc8972d40509f879a7f1ec9a11da366

Download Submit
\??\pipe\LOCAL\crashpad_2932_XZNDOBNCMPACKCWF
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit