hxxps://academy[.]collab365[.]com/?utm_source=email&utm_medium=signature&utm_campaign=joinacademy

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 18:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://academy.collab365.com/?utm_source=email&utm_medium=signature&utm_campaign=joinacademy

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4412	msedge.exe
4412	msedge.exe
3944	identity_helper.exe
3944	identity_helper.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 4704	4412	msedge.exe	83
PID 4412 wrote to memory of 4704	4412	msedge.exe	83
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4996	4412	msedge.exe	84
PID 4412 wrote to memory of 4544	4412	msedge.exe	85
PID 4412 wrote to memory of 4544	4412	msedge.exe	85
PID 4412 wrote to memory of 2700	4412	msedge.exe	86
PID 4412 wrote to memory of 2700	4412	msedge.exe	86
PID 4412 wrote to memory of 2700	4412	msedge.exe	86
PID 4412 wrote to memory of 2700	4412	msedge.exe	86
PID 4412 wrote to memory of 2700	4412	msedge.exe	86
PID 4412 wrote to memory of 2700	4412	msedge.exe	86
PID 4412 wrote to memory of 2700	4412	msedge.exe	86
PID 4412 wrote to memory of 2700	4412	msedge.exe	86
PID 4412 wrote to memory of 2700	4412	msedge.exe	86
PID 4412 wrote to memory of 2700	4412	msedge.exe	86
PID 4412 wrote to memory of 2700	4412	msedge.exe	86
PID 4412 wrote to memory of 2700	4412	msedge.exe	86
PID 4412 wrote to memory of 2700	4412	msedge.exe	86
PID 4412 wrote to memory of 2700	4412	msedge.exe	86
PID 4412 wrote to memory of 2700	4412	msedge.exe	86
PID 4412 wrote to memory of 2700	4412	msedge.exe	86
PID 4412 wrote to memory of 2700	4412	msedge.exe	86
PID 4412 wrote to memory of 2700	4412	msedge.exe	86
PID 4412 wrote to memory of 2700	4412	msedge.exe	86
PID 4412 wrote to memory of 2700	4412	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://academy.collab365.com/?utm_source=email&utm_medium=signature&utm_campaign=joinacademy
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa06e046f8,0x7ffa06e04708,0x7ffa06e04718
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,617918548274617068,4758752008311541174,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,617918548274617068,4758752008311541174,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,617918548274617068,4758752008311541174,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,617918548274617068,4758752008311541174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,617918548274617068,4758752008311541174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,617918548274617068,4758752008311541174,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,617918548274617068,4758752008311541174,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,617918548274617068,4758752008311541174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,617918548274617068,4758752008311541174,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,617918548274617068,4758752008311541174,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,617918548274617068,4758752008311541174,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,617918548274617068,4758752008311541174,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c5abc082d9d9307e797b7e89a2f755f4

SHA1
54c442690a8727f1d3453b6452198d3ec4ec13df

SHA256
a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716

SHA512
ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4a74bc775caf3de7fc9cde3c30ce482

SHA1
c6ed3161390e5493f71182a6cb98d51c9063775d

SHA256
dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280

SHA512
55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
792B

MD5
3ee1135e5f78faea0f71a6f1cfe1b4bc

SHA1
156f43570b70daee362bfa5102f12dfd8afb47c3

SHA256
1e24b9c1ffec426dfe5162e0943b6b643ac798f7fa68f857c0c9109adcad6be6

SHA512
b45c5cfbc3f6cd9384165048edcbd19c68a52d1f236ab98bfb0334184470bfa6333c93744e3399b71546aa7e89ec8a787ae32b8af0ba25bda235fc9461aa87b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0773c18972c46ef739b13f6bcac02fe2

SHA1
307b949d9e62e5857f1297da8625f1dbaebc6df8

SHA256
5bc34a356a4ddac0bd7b2c3177426efedbf21f7c94e8027e8c40702ae7f5e3d3

SHA512
f4d634edfe42d3dc540246280c2e80a9949a31c4288c9da9c43148ba51baa583e73807fd404982300c2d878d6297b732034e113572214166000dff653e6cb3ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
afedd651f3d22c993980cf5e7c6c3dc8

SHA1
8416c026f8112d3de0ba771deced15e2e41e5a27

SHA256
74ab5f1b664a1dc25aa25b8bbde4fe564efd4b83f6754eccbd7208615aeab652

SHA512
ba898b3c4e03f8282e41a5ae2d23c13d2f36deb024c2f31c36bb526282235a7cae51d2f1fa8b6a922b318bc9babd1cfd64f3b28d8c6c75f96abcb4bd3e6d27b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ce1a0ed79ef1ac769dff0a0199710f17

SHA1
12f57af7867a22082fdae92a25c947fef5d9c9ec

SHA256
5c71c0b6b047fb7c986d3057ea1ca3132dcd1c12bc381699457d4cc17f1ebb6c

SHA512
60b6feb04ee3b6cbbd4400357eea4361870637177173e8d658d8e31854612da3e46b629a7b1183ad14e97d071a7120fd3a925deb8bf954d868c5b61d0c510f48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fa3e1ec5114bb704d3a614fdc54625d0

SHA1
3656d2e6a79cc7422f6c536847123c0c8980bb07

SHA256
faf24e49cabde58f5c86a3ee29bbab311aae1f756d6b463d7b4074e648238ecf

SHA512
447d15f3a00ec9b7af81af6df9bd22999f6c5485937774f4a394b6d9ab51329f0a0c5cc7620447774791b8092504df23851aab589862bbfa722f1ff37a62b0f3

Download Submit