hxxps://pub-8c4e3a450cea4e77be2d8de2e7d1a60a[.]r2[.]dev/EXMaliGRFHJFHJKFEVJNVJKHEJEJTGJGTN3785378RJNVEJNLTVEHJENJKTERKNLTGHJIT[.]html#mserrano@ienova[.]com[.]mx

Analysis

max time kernel
22s
max time network
18s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 17:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://pub-8c4e3a450cea4e77be2d8de2e7d1a60a.r2.dev/EXMaliGRFHJFHJKFEVJNVJKHEJEJTGJGTN3785378RJNVEJNLTVEHJENJKTERKNLTGHJIT.html#[email protected]
Sample240614-vk4bbsshkp

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe
4416	msedge.exe
4416	msedge.exe
2068	identity_helper.exe
2068	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 1832	4416	msedge.exe	82
PID 4416 wrote to memory of 1832	4416	msedge.exe	82
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 1656	4416	msedge.exe	83
PID 4416 wrote to memory of 4376	4416	msedge.exe	84
PID 4416 wrote to memory of 4376	4416	msedge.exe	84
PID 4416 wrote to memory of 2876	4416	msedge.exe	85
PID 4416 wrote to memory of 2876	4416	msedge.exe	85
PID 4416 wrote to memory of 2876	4416	msedge.exe	85
PID 4416 wrote to memory of 2876	4416	msedge.exe	85
PID 4416 wrote to memory of 2876	4416	msedge.exe	85
PID 4416 wrote to memory of 2876	4416	msedge.exe	85
PID 4416 wrote to memory of 2876	4416	msedge.exe	85
PID 4416 wrote to memory of 2876	4416	msedge.exe	85
PID 4416 wrote to memory of 2876	4416	msedge.exe	85
PID 4416 wrote to memory of 2876	4416	msedge.exe	85
PID 4416 wrote to memory of 2876	4416	msedge.exe	85
PID 4416 wrote to memory of 2876	4416	msedge.exe	85
PID 4416 wrote to memory of 2876	4416	msedge.exe	85
PID 4416 wrote to memory of 2876	4416	msedge.exe	85
PID 4416 wrote to memory of 2876	4416	msedge.exe	85
PID 4416 wrote to memory of 2876	4416	msedge.exe	85
PID 4416 wrote to memory of 2876	4416	msedge.exe	85
PID 4416 wrote to memory of 2876	4416	msedge.exe	85
PID 4416 wrote to memory of 2876	4416	msedge.exe	85
PID 4416 wrote to memory of 2876	4416	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pub-8c4e3a450cea4e77be2d8de2e7d1a60a.r2.dev/EXMaliGRFHJFHJKFEVJNVJKHEJEJTGJGTN3785378RJNVEJNLTVEHJENJKTERKNLTGHJIT.html#[email protected]
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9acdc46f8,0x7ff9acdc4708,0x7ff9acdc4718
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,14639834658469278202,12874636775821971339,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,14639834658469278202,12874636775821971339,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,14639834658469278202,12874636775821971339,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14639834658469278202,12874636775821971339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14639834658469278202,12874636775821971339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,14639834658469278202,12874636775821971339,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4008 /prefetch:8
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,14639834658469278202,12874636775821971339,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14639834658469278202,12874636775821971339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14639834658469278202,12874636775821971339,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14639834658469278202,12874636775821971339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14639834658469278202,12874636775821971339,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:8

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
MD5 477462b6ad8eaaf8d38f5e3a4daf17b0
SHA1 86174e670c44767c08a39cc2a53c09c318326201
SHA512 a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
MD5 b704c9ca0493bd4548ac9c69dc4a4f27
SHA1 a3e5e54e630dabe55ca18a798d9f5681e0620ba7
SHA512 69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 76c95de2412db7f2f18962bb4cf9cdb887a33319f0d83935aa917270ebb38cb0
MD5 6b2ad2fe85ac14914a4708300b5709c6
SHA1 073d5646b19a2a6faf3b3dd8c44a9fc42bf53c35
SHA512 cc85efdd73cdefc9e15eea4234223d0e58ae760814d138925b4170ef335866404cca42290a3fbb513601ee96668e0e417b320e173668cffd0c2221c62933df1f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 caff26546040ab7bf56a828e13415f044f7cda82ac48f1f11894459a1a6c17bb
MD5 01f9cdc95493571e00071a30f4946aae
SHA1 0995da47628799e984e68ca7ab164ccebec245b2
SHA512 9dd1ba9684af8c77fdf0977d3bb96cf976ef481ba75300f2763bb097786403dcefc274cad74b919cdcf34b0b6f160e4aa9eb91abc430b89c8565db227f6bfcb5
SSDEEP 96:n7lkfoxm/DnmqL713JaSwpvWMoiVmde05uK1j2W5KUWQyV+VD7AiEwb:npkhS0ZJaSGWMk5uKhwrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 67928ce0e6ffb29d7232d06d403ec05d52aab8baa3a413256ee420fe20389cff
MD5 b855d86a6ab2e6eb2ba1186027a75491
SHA1 2faf3bbd5173ef21b68036c75e331f82debb9a56
SHA512 307b2668e0b9dbf840d4316ce109e3793024eed0ff967ff357152db7b9451a21d29a7e93c3c6606eb2191d29433671d021ac972fcf89bd6923e45f06610e5f71
SSDEEP 96:n7lkfoxm/DQYmqL713JaQwpvWMoiVmdeH2WfKUWQyV+VDCziEwb:npkhI0ZJaQGWMX6ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 0732eaa45fe005f98c50424b8d31c9d6893ba8e407fbda1a0418ca0b22b06e82
MD5 ffe5a5d26b27f0e9b934c63822148165
SHA1 7f0d4622ba083faf420c4e232c06c5ddf95eec70
SHA512 b5ce5d95bdbf05661a2fa92486c5f9a05e6a84d5d24c0a5c6a4bd9189ae6177611e42b19dd3865775c0df8ca823dd433172e82ed54541e7fccf551685ce66509
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuplHfee2RUih/w3z2OMDCRH0:A9iIxuERzA83h09RZxYpIHwaOMWRHqlB
MD5 SHA1 SHA512 SSDEEP

Submit Download