hxxps://pub-8c4e3a450cea4e77be2d8de2e7d1a60a[.]r2[.]dev/EXMaliGRFHJFHJKFEVJNVJKHEJEJTGJGTN3785378RJNVEJNLTVEHJENJKTERKNLTGHJIT[.]html#mbarrera@ienova[.]com[.]mx

Analysis

max time kernel
600s
max time network
605s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2024 16:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://pub-8c4e3a450cea4e77be2d8de2e7d1a60a.r2.dev/EXMaliGRFHJFHJKFEVJNVJKHEJEJTGJGTN3785378RJNVEJNLTVEHJENJKTERKNLTGHJIT.html#[email protected]

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3636	msedge.exe
3636	msedge.exe
988	msedge.exe
988	msedge.exe
436	identity_helper.exe
436	identity_helper.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

988 msedge.exe
988 msedge.exe
988 msedge.exe
988 msedge.exe
988 msedge.exe
988 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 988 wrote to memory of 4316	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 4316	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1528	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 3636	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 3636	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1532	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1532	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1532	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1532	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1532	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1532	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1532	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1532	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1532	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1532	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1532	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1532	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1532	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1532	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1532	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1532	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1532	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1532	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1532	988	msedge.exe	msedge.exe
PID 988 wrote to memory of 1532	988	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pub-8c4e3a450cea4e77be2d8de2e7d1a60a.r2.dev/EXMaliGRFHJFHJKFEVJNVJKHEJEJTGJGTN3785378RJNVEJNLTVEHJENJKTERKNLTGHJIT.html#[email protected]
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9671846f8,0x7ff967184708,0x7ff967184718
2⤵
PID:4316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,6529751603408030548,14904076965022734937,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
2⤵
PID:1528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1860,6529751603408030548,14904076965022734937,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1860,6529751603408030548,14904076965022734937,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
2⤵
PID:1532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,6529751603408030548,14904076965022734937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
2⤵
PID:2272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,6529751603408030548,14904076965022734937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
2⤵
PID:1812

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1860,6529751603408030548,14904076965022734937,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
2⤵
PID:3944

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1860,6529751603408030548,14904076965022734937,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,6529751603408030548,14904076965022734937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
2⤵
PID:3084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,6529751603408030548,14904076965022734937,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
2⤵
PID:1648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,6529751603408030548,14904076965022734937,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
2⤵
PID:640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,6529751603408030548,14904076965022734937,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
2⤵
PID:4496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,6529751603408030548,14904076965022734937,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4832 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4496

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
96B

MD5
f11dfba948e28809156ecfda8f1310db

SHA1
3ceac19133dd4dd620b01c33ce9325c0931b0c86

SHA256
49ff9f0c1be19adb0b872cc089f0fe4564f59a1b3e4e480436bc7608757b5582

SHA512
46723198406efd91394155e7c03fdb52c1ea19ec284942f9ef9015d3d491d5a47638a27643fa8375dcf624766de381d1931e507318795987b32e0b681efa983f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
661B

MD5
8f505e0f35be77ffb083a6b57e6da30a

SHA1
5144e3254b409c3279c2447ebe2c89cb34b7c80d

SHA256
a024847e8dee45ffa17c9dd0fb2c0fbbc69e08d5614ce155614b7184d5b7c21a

SHA512
05422828f88bca7ccfcf61b6510dfd48815c443e08107bd21ee8c53d0a93757b99d12cf3e207cdd3f945ad01b6d42045f27ee85522b13406de2431401140271d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
e082b33b23f7d956580a92dfad5853f0

SHA1
0abebec59dac894501a44e458e45ac45d606a55d

SHA256
fd696a7f30925d03dddfca09a8df4b937ce3c13d5202137ec7b4ead931b352ed

SHA512
4e3b95163967605ef04e5742e18273d002cb0250d1901b51b3cfd67ea95431416086450fa86d37d6198a92fcab82b4437e7b429d00312fe82aa6ded83c10be2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
048842e98bda5d78068618733fac5623

SHA1
317a978a4cbce466ed1dfecdd598a381fa4df1ec

SHA256
1677e8d1bdcc8b21366b22cd7b48a0301925138521c3fbf9ff27a7d0413df5b3

SHA512
b92df7b45652c6333bd00b08a08d0fb1006ef85195164e5c23994c53e1029f418c227fa67ec30db4607dbdf0dfbc50250bd8cceee940ab38b9625a1d1e69dd23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
737489626e4e4caf039b06b3312c06d0

SHA1
5aec4a29f337a35f2fec24e7ac8a3f0860278288

SHA256
ae02e32b4bb8ab1a3fa9729b48931073f4792937fbf867d2d54ce0061d710d32

SHA512
dbd6577bf3f8e51755852b5fb6f41eb7ad8434027534f8be137a4290575768b6b2016fa0a8938404fc5307c8e5dd0c3d4852a46479b2ca6c90842c02a23a7970

Download Submit
\??\pipe\LOCAL\crashpad_988_CKTQVUUWTJOSBPTT
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit