hxxps://12[.]0[.]0[.]1

Analysis

max time kernel
146s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
23-06-2024 23:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://12.0.0.1

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
688	msedge.exe
688	msedge.exe
3136	msedge.exe
3136	msedge.exe
1536	msedge.exe
1536	msedge.exe
1904	identity_helper.exe
1904	identity_helper.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

3136 msedge.exe
3136 msedge.exe
3136 msedge.exe
3136 msedge.exe
3136 msedge.exe
3136 msedge.exe
3136 msedge.exe
3136 msedge.exe
3136 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe
3136	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3136 wrote to memory of 3732	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3732	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 3152	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 688	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 688	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 4124	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 4124	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 4124	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 4124	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 4124	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 4124	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 4124	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 4124	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 4124	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 4124	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 4124	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 4124	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 4124	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 4124	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 4124	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 4124	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 4124	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 4124	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 4124	3136	msedge.exe	msedge.exe
PID 3136 wrote to memory of 4124	3136	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://12.0.0.1
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff80d903cb8,0x7ff80d903cc8,0x7ff80d903cd8
2⤵
PID:3732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,10220397056358598740,5776225194146385555,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
2⤵
PID:3152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,10220397056358598740,5776225194146385555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,10220397056358598740,5776225194146385555,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:8
2⤵
PID:4124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10220397056358598740,5776225194146385555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
2⤵
PID:2020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10220397056358598740,5776225194146385555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
2⤵
PID:4556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10220397056358598740,5776225194146385555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
2⤵
PID:448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10220397056358598740,5776225194146385555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
2⤵
PID:4256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10220397056358598740,5776225194146385555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
2⤵
PID:3408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10220397056358598740,5776225194146385555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1964 /prefetch:1
2⤵
PID:4588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10220397056358598740,5776225194146385555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
2⤵
PID:4872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,10220397056358598740,5776225194146385555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3512 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1536

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,10220397056358598740,5776225194146385555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10220397056358598740,5776225194146385555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
2⤵
PID:4656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,10220397056358598740,5776225194146385555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
2⤵
PID:1868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,10220397056358598740,5776225194146385555,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1020 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ade01a8cdbbf61f66497f88012a684d1

SHA1
9ff2e8985d9a101a77c85b37c4ac9d4df2525a1f

SHA256
f49e20af78caf0d737f6dbcfc5cc32701a35eb092b3f0ab24cf339604cb049b5

SHA512
fa024bd58e63402b06503679a396b8b4b1bc67dc041d473785957f56f7d972317ec8560827c8008989d2754b90e23fc984a85ed7496f05cb4edc2d8000ae622b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
d0f84c55517d34a91f12cccf1d3af583

SHA1
52bd01e6ab1037d31106f8bf6e2552617c201cea

SHA256
9a24c67c3ec89f5cf8810eba1fdefc7775044c71ed78a8eb51c8d2225ad1bc4c

SHA512
94764fe7f6d8c182beec398fa8c3a1948d706ab63121b8c9f933eef50172c506a1fd015172b7b6bac898ecbfd33e00a4a0758b1c8f2f4534794c39f076cd6171

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
7df73b97eade0c1c05835b2832f7a814

SHA1
4884190d0fd7f8d1558ab2c67ac61fda607e3e48

SHA256
4590b20c438e304e1d43c0da09c4d2e31ddd6b32c106b34edd272e335b764ab5

SHA512
a94f6ff1fe0571bc6eb0e1f7d171ccb1343ce15e9dfafb744f53862c6e3ecea6965d2068571fa700b6b341a8bc2cf30be095bc41ecdc6ea584544c3b533b70a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
218f4c0d5809f1c0ebe658833ccdb18c

SHA1
a78c73c53f1daed5ca118f367ea75b31b4a43555

SHA256
bad2f50f2e3c45e0a381e9e4739eb94872b2c2a052f2838c704d1334534485df

SHA512
1b223c01a16e440410c082136e1f30dac1ebd6d7ca57e7e8545d4aaf23dac1483699e47e5411758ab0b0c88b2339b575f3f8fb7b44dcf4ae1fd7d0c0bf0231b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
8KB

MD5
79eab06dc7beaa986dc1a9edb461691e

SHA1
86da0df54e31794f094d2d594f2a351c7e1073f9

SHA256
88ab9333ffd7a0c5fb108ed71554f0c8c623ca921433c7946143e4370cac75e6

SHA512
4d52ad6ebca8ecf5863edd781400382685061f26ba9b75b7d0f2596949f20ba989b672546907182ac8ce0d21c8c0fbb4272375fa902f2dfa4b73c5dda554b20c

Download Submit