hxxps://liejiolles[.]online/t/t_kma_v4/img/prod[.]png

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://liejiolles.online/t/t_kma_v4/img/prod.png

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5108	msedge.exe
5108	msedge.exe
4860	msedge.exe
4860	msedge.exe
4616	identity_helper.exe
4616	identity_helper.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 1552	4860	msedge.exe	82
PID 4860 wrote to memory of 1552	4860	msedge.exe	82
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 4660	4860	msedge.exe	83
PID 4860 wrote to memory of 5108	4860	msedge.exe	84
PID 4860 wrote to memory of 5108	4860	msedge.exe	84
PID 4860 wrote to memory of 2884	4860	msedge.exe	85
PID 4860 wrote to memory of 2884	4860	msedge.exe	85
PID 4860 wrote to memory of 2884	4860	msedge.exe	85
PID 4860 wrote to memory of 2884	4860	msedge.exe	85
PID 4860 wrote to memory of 2884	4860	msedge.exe	85
PID 4860 wrote to memory of 2884	4860	msedge.exe	85
PID 4860 wrote to memory of 2884	4860	msedge.exe	85
PID 4860 wrote to memory of 2884	4860	msedge.exe	85
PID 4860 wrote to memory of 2884	4860	msedge.exe	85
PID 4860 wrote to memory of 2884	4860	msedge.exe	85
PID 4860 wrote to memory of 2884	4860	msedge.exe	85
PID 4860 wrote to memory of 2884	4860	msedge.exe	85
PID 4860 wrote to memory of 2884	4860	msedge.exe	85
PID 4860 wrote to memory of 2884	4860	msedge.exe	85
PID 4860 wrote to memory of 2884	4860	msedge.exe	85
PID 4860 wrote to memory of 2884	4860	msedge.exe	85
PID 4860 wrote to memory of 2884	4860	msedge.exe	85
PID 4860 wrote to memory of 2884	4860	msedge.exe	85
PID 4860 wrote to memory of 2884	4860	msedge.exe	85
PID 4860 wrote to memory of 2884	4860	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://liejiolles.online/t/t_kma_v4/img/prod.png
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd510a46f8,0x7ffd510a4708,0x7ffd510a4718
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,10703455236782092107,18146734015595110635,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,10703455236782092107,18146734015595110635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,10703455236782092107,18146734015595110635,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10703455236782092107,18146734015595110635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10703455236782092107,18146734015595110635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10703455236782092107,18146734015595110635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10703455236782092107,18146734015595110635,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,10703455236782092107,18146734015595110635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,10703455236782092107,18146734015595110635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10703455236782092107,18146734015595110635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10703455236782092107,18146734015595110635,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10703455236782092107,18146734015595110635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2052 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,10703455236782092107,18146734015595110635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2020,10703455236782092107,18146734015595110635,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,10703455236782092107,18146734015595110635,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4904 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db9081c34e133c32d02f593df88f047a

SHA1
a0da007c14fd0591091924edc44bee90456700c6

SHA256
c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e

SHA512
12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3a09f853479af373691d131247040276

SHA1
1b6f098e04da87e9cf2d3284943ec2144f36ac04

SHA256
a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f

SHA512
341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
545B

MD5
35fc46b61fca0ed46fc58df25309d0fd

SHA1
e6a07ca442a052462916305f4b1eda9920432be6

SHA256
0e31516ba5c5eef6addfd3ba89141646c80d124e9016bbed534b112ab0315d2f

SHA512
acdaf20c97ce2ea7e23df806b1960c9d5416ccd8ce9d3009dcf994f70e0ea1d67e0fea3f74adade5ff36834f82250fee78967e4a68e8ceb115f38346c42114f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
faf57cf1f411c2c5cc7a940f049d6eff

SHA1
21b0b2c6b32fa58ace647754d0aed11addddf398

SHA256
0cd293ae06890d3ae4365e972b785b3ed94a3a52e136ab5a335dd5de75ecbcfc

SHA512
c9dbb40f88ec50505282ca7acab8c35048175ee36081c0c0a9f6812603a62b6c4a82d0d8f2fcfb35d0b6c189438ef5c52382d6eda4b9a4004a8f555518478659

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
91c1e5ab6835885f820b2bff4f4435c3

SHA1
4e5e39aa036490ff7085aff778dba1b90a1288d6

SHA256
f741669550dc5b4c235259d436a66c4b6e7a65bedc4851c0ad490a19ffc7b6cc

SHA512
bfd6d4f024ab85551327ebcebf4cea9e6781db14d51ce5a60ac4d731e7dcfdc69601419075a1096a6521d4d70f5c17bdbd2a7ed94596f50e0ec8fca3fedb8c98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
55b4e4c87a2385fab1a4cc2ec1e08c2d

SHA1
ea4e9ea8e61d6d669f04fed25d3e415217e834f0

SHA256
c2e21284760576d3e766fc73177a6be5426412ac892a1d9a631180999c366f57

SHA512
bc5f7226dea3a4aa234818adbe8c3160539c30532fb4e07263343c98c15dfc46d1bbbdb0394b8696c0ea4a876fa8a882be78181cb0ea880e060663aeeb13a7c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
db98c386e92a3c4f4500ed5bb1a251d2

SHA1
94cde714caaea6b44be474a16a80587e1cbe7460

SHA256
069bcb7613c1902c81106e6ec7071bd21d4f5bb67ea3c41a3464e9610245bdc3

SHA512
3f3b939abc26ce9dbeac01055684779e12256372c95549fd7fd3ad35af697661f79031c61395d21843cbc656bb6bdd33ec57f9ddd77727f7f6ff254ab3e4aca1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
811582e7a4096dd7d40c2b32b620c4d4

SHA1
d7d9a9e4f6d6a23f6dac6b6816b9046973a20554

SHA256
2c41b12649d3ea6c22adeacfa47cae31c6fa5f9c0923ee7c4160e3019bc7ce8b

SHA512
9de4da943eeeab06208d5576c1fad9bc839e0937c92d280d360d319864c467dacfbfc7a1c15312ea0f8547b53417aa1c9169dd5c0d7332aff37fe0492768668c

Download Submit