hxxps://pub-8c4e3a450cea4e77be2d8de2e7d1a60a[.]r2[.]dev/EXMaliGRFHJFHJKFEVJNVJKHEJEJTGJGTN3785378RJNVEJNLTVEHJENJKTERKNLTGHJIT[.]html#mserrano@ienova[.]com[.]mx

General

Target

https://pub-8c4e3a450cea4e77be2d8de2e7d1a60a.r2.dev/EXMaliGRFHJFHJKFEVJNVJKHEJEJTGJGTN3785378RJNVEJNLTVEHJENJKTERKNLTGHJIT.html#[email protected]

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

4376 msedge.exe
4376 msedge.exe
4416 msedge.exe
4416 msedge.exe
2068 identity_helper.exe
2068 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

4416 msedge.exe
4416 msedge.exe
4416 msedge.exe
4416 msedge.exe
4416 msedge.exe
4416 msedge.exe

pid	process
4376	msedge.exe
4376	msedge.exe
4416	msedge.exe
4416	msedge.exe
2068	identity_helper.exe
2068	identity_helper.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4416 wrote to memory of 1832	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1832	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 1656	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 4376	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 4376	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 2876	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 2876	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 2876	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 2876	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 2876	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 2876	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 2876	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 2876	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 2876	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 2876	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 2876	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 2876	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 2876	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 2876	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 2876	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 2876	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 2876	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 2876	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 2876	4416	msedge.exe	msedge.exe
PID 4416 wrote to memory of 2876	4416	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pub-8c4e3a450cea4e77be2d8de2e7d1a60a.r2.dev/EXMaliGRFHJFHJKFEVJNVJKHEJEJTGJGTN3785378RJNVEJNLTVEHJENJKTERKNLTGHJIT.html#[email protected]
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9acdc46f8,0x7ff9acdc4708,0x7ff9acdc4718
2⤵
PID:1832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,14639834658469278202,12874636775821971339,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
2⤵
PID:1656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,14639834658469278202,12874636775821971339,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,14639834658469278202,12874636775821971339,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
2⤵
PID:2876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14639834658469278202,12874636775821971339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
2⤵
PID:2872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14639834658469278202,12874636775821971339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
2⤵
PID:4992

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,14639834658469278202,12874636775821971339,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4008 /prefetch:8
2⤵
PID:2712

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,14639834658469278202,12874636775821971339,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4008 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14639834658469278202,12874636775821971339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
2⤵
PID:4684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14639834658469278202,12874636775821971339,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
2⤵
PID:4568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14639834658469278202,12874636775821971339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
2⤵
PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14639834658469278202,12874636775821971339,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
2⤵
PID:8

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2888

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
477462b6ad8eaaf8d38f5e3a4daf17b0

SHA1
86174e670c44767c08a39cc2a53c09c318326201

SHA256
e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d

SHA512
a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b704c9ca0493bd4548ac9c69dc4a4f27

SHA1
a3e5e54e630dabe55ca18a798d9f5681e0620ba7

SHA256
2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411

SHA512
69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
96B

MD5
6b2ad2fe85ac14914a4708300b5709c6

SHA1
073d5646b19a2a6faf3b3dd8c44a9fc42bf53c35

SHA256
76c95de2412db7f2f18962bb4cf9cdb887a33319f0d83935aa917270ebb38cb0

SHA512
cc85efdd73cdefc9e15eea4234223d0e58ae760814d138925b4170ef335866404cca42290a3fbb513601ee96668e0e417b320e173668cffd0c2221c62933df1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
01f9cdc95493571e00071a30f4946aae

SHA1
0995da47628799e984e68ca7ab164ccebec245b2

SHA256
caff26546040ab7bf56a828e13415f044f7cda82ac48f1f11894459a1a6c17bb

SHA512
9dd1ba9684af8c77fdf0977d3bb96cf976ef481ba75300f2763bb097786403dcefc274cad74b919cdcf34b0b6f160e4aa9eb91abc430b89c8565db227f6bfcb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
b855d86a6ab2e6eb2ba1186027a75491

SHA1
2faf3bbd5173ef21b68036c75e331f82debb9a56

SHA256
67928ce0e6ffb29d7232d06d403ec05d52aab8baa3a413256ee420fe20389cff

SHA512
307b2668e0b9dbf840d4316ce109e3793024eed0ff967ff357152db7b9451a21d29a7e93c3c6606eb2191d29433671d021ac972fcf89bd6923e45f06610e5f71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
ffe5a5d26b27f0e9b934c63822148165

SHA1
7f0d4622ba083faf420c4e232c06c5ddf95eec70

SHA256
0732eaa45fe005f98c50424b8d31c9d6893ba8e407fbda1a0418ca0b22b06e82

SHA512
b5ce5d95bdbf05661a2fa92486c5f9a05e6a84d5d24c0a5c6a4bd9189ae6177611e42b19dd3865775c0df8ca823dd433172e82ed54541e7fccf551685ce66509

Download Submit
\??\pipe\LOCAL\crashpad_4416_NPIOAPDUZOUEPKQD
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads