hxxps://lifespprtmfbdgeofc[.]site/

Analysis

max time kernel
79s
max time network
85s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/06/2024, 09:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://lifespprtmfbdgeofc.site/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
2276	identity_helper.exe
2276	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4060	msedge.exe
4060	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 2396	4060	msedge.exe	81
PID 4060 wrote to memory of 2396	4060	msedge.exe	81
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 3560	4060	msedge.exe	82
PID 4060 wrote to memory of 640	4060	msedge.exe	83
PID 4060 wrote to memory of 640	4060	msedge.exe	83
PID 4060 wrote to memory of 2000	4060	msedge.exe	84
PID 4060 wrote to memory of 2000	4060	msedge.exe	84
PID 4060 wrote to memory of 2000	4060	msedge.exe	84
PID 4060 wrote to memory of 2000	4060	msedge.exe	84
PID 4060 wrote to memory of 2000	4060	msedge.exe	84
PID 4060 wrote to memory of 2000	4060	msedge.exe	84
PID 4060 wrote to memory of 2000	4060	msedge.exe	84
PID 4060 wrote to memory of 2000	4060	msedge.exe	84
PID 4060 wrote to memory of 2000	4060	msedge.exe	84
PID 4060 wrote to memory of 2000	4060	msedge.exe	84
PID 4060 wrote to memory of 2000	4060	msedge.exe	84
PID 4060 wrote to memory of 2000	4060	msedge.exe	84
PID 4060 wrote to memory of 2000	4060	msedge.exe	84
PID 4060 wrote to memory of 2000	4060	msedge.exe	84
PID 4060 wrote to memory of 2000	4060	msedge.exe	84
PID 4060 wrote to memory of 2000	4060	msedge.exe	84
PID 4060 wrote to memory of 2000	4060	msedge.exe	84
PID 4060 wrote to memory of 2000	4060	msedge.exe	84
PID 4060 wrote to memory of 2000	4060	msedge.exe	84
PID 4060 wrote to memory of 2000	4060	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://lifespprtmfbdgeofc.site/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf58f46f8,0x7ffdf58f4708,0x7ffdf58f4718
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,8268600443791648429,9240051204499986437,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,8268600443791648429,9240051204499986437,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,8268600443791648429,9240051204499986437,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8268600443791648429,9240051204499986437,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8268600443791648429,9240051204499986437,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,8268600443791648429,9240051204499986437,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,8268600443791648429,9240051204499986437,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
6b3bfcdd1bbe948a3605267e586031b4

SHA1
40b781d097f1d5d9c30b70d4717e71fb3812d76e

SHA256
fc90a935d3ee9d65ca934572a6e6a7cd9b3438342e689066d089a4d26ccf2d90

SHA512
05837a08adbe0a3dec066310d484ee5cbf3a3471b291477609c24a9c14f64ede91b1e1556b6b2c08a3eb374fec6af69a449389b3bcae1912cd0a244269554d99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
537B

MD5
1203eb85ecf39f9c915ab45a45ff055f

SHA1
4c5a50a9dec1146acd709180f6d28df0843c09cb

SHA256
a1c88a6ed375d4562301335ba6177d831840a5fd55174962c1f7f941ed74644a

SHA512
2e2f41e5d661ed36389c590c159fefdc9d0afde6f226e7781f48d1fefe867989725aa1eb421d62b3657467fdf903e1cb699b1a312fb32775b147ef1f29f03214

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9b22d0b26ed734fc2176912995bcf53d

SHA1
f178879238e4a070e4b91a3cb361480ecf43fcf8

SHA256
c5ce517234a0660f319ce53c1b05eeadc3f2c2ce7832beaed69d81f20a5a8250

SHA512
2306325a7b531774f715fd40a2a242489ff52f4c39ec2cad5430e3e23617c75667fbe046859209cd333015f913cc529b47ab9b4a347cc4effc5943a8d16a1d89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6107e25afa170f5427a2c6a651016c72

SHA1
b8cfbdb1c5a551b7535ed45bbf47c666db0fc6e3

SHA256
d0236d84aa77750975ff85f7e3e1c4f660fa9d36476f99d7e62e42a431b926be

SHA512
723511bfa312380a8549f3b385b53c0ca3c108e0b3c48c5a298e929bbf8fa04e3d8cc40d73e92a80774e4d3da91a009c8f9261c63b820382ec66d50fae28ca73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a7a14500348d8e4e1b81df2611946756

SHA1
501481b016975130cc5751720ea895be4d406bb3

SHA256
3c9273f6059c90fed3cabb61f21f807905498b036bf483c2ad71f361ee28f4bc

SHA512
9aa53fb0efa59e9e91c243bcc0d6d460d45aa9fc0517e2d0cb92a497834760b882eff5c378626f766a647f45217c81ca036fd26cecfc5415997f877445df643f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dcce4769b0ba9a4c3c15fa3bd7555e40

SHA1
c72c1c190e12271c72b7e8914c2cb4828f1cf6a3

SHA256
41925c15ae6b53f1b5c7cf81157c9601731c4e3676a08ef8cb2da49c4d436f55

SHA512
bf55fed9b09ddef7b702d1712c10b702f831cbf7d5f0f1e8fec581a407484904e3e0fcb58713e36150b44ab88fa881d947026fce2d06a18a0d9e830d3dcb1c64

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit