hxxp://wordpress-881936-3058251[.]cloudwaysapps[.]com

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 19:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://wordpress-881936-3058251.cloudwaysapps.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4000	msedge.exe
4000	msedge.exe
2760	identity_helper.exe
2760	identity_helper.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 4608	4000	msedge.exe	78
PID 4000 wrote to memory of 4608	4000	msedge.exe	78
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 3764	4000	msedge.exe	79
PID 4000 wrote to memory of 4212	4000	msedge.exe	80
PID 4000 wrote to memory of 4212	4000	msedge.exe	80
PID 4000 wrote to memory of 1260	4000	msedge.exe	81
PID 4000 wrote to memory of 1260	4000	msedge.exe	81
PID 4000 wrote to memory of 1260	4000	msedge.exe	81
PID 4000 wrote to memory of 1260	4000	msedge.exe	81
PID 4000 wrote to memory of 1260	4000	msedge.exe	81
PID 4000 wrote to memory of 1260	4000	msedge.exe	81
PID 4000 wrote to memory of 1260	4000	msedge.exe	81
PID 4000 wrote to memory of 1260	4000	msedge.exe	81
PID 4000 wrote to memory of 1260	4000	msedge.exe	81
PID 4000 wrote to memory of 1260	4000	msedge.exe	81
PID 4000 wrote to memory of 1260	4000	msedge.exe	81
PID 4000 wrote to memory of 1260	4000	msedge.exe	81
PID 4000 wrote to memory of 1260	4000	msedge.exe	81
PID 4000 wrote to memory of 1260	4000	msedge.exe	81
PID 4000 wrote to memory of 1260	4000	msedge.exe	81
PID 4000 wrote to memory of 1260	4000	msedge.exe	81
PID 4000 wrote to memory of 1260	4000	msedge.exe	81
PID 4000 wrote to memory of 1260	4000	msedge.exe	81
PID 4000 wrote to memory of 1260	4000	msedge.exe	81
PID 4000 wrote to memory of 1260	4000	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://wordpress-881936-3058251.cloudwaysapps.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc280046f8,0x7ffc28004708,0x7ffc28004718
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,7652913103732927396,2610979941030393922,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,7652913103732927396,2610979941030393922,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,7652913103732927396,2610979941030393922,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7652913103732927396,2610979941030393922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7652913103732927396,2610979941030393922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,7652913103732927396,2610979941030393922,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,7652913103732927396,2610979941030393922,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7652913103732927396,2610979941030393922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7652913103732927396,2610979941030393922,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7652913103732927396,2610979941030393922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,7652913103732927396,2610979941030393922,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,7652913103732927396,2610979941030393922,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5276 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:60

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
210676dde5c0bd984dc057e2333e1075

SHA1
2d2f8c14ee48a2580f852db7ac605f81b5b1399a

SHA256
2a89d71b4ddd34734b16d91ebd8ea68b760f321baccdd4963f91b8d3507a3fb5

SHA512
aeb81804cac5b17a5d1e55327f62df7645e9bbbfa8cad1401e7382628341a939b7aedc749b2412c06174a9e3fcdd5248d6df9b5d3f56c53232d17e59277ab017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f4e6521c03f1bc16d91d99c059cc5424

SHA1
043665051c486192a6eefe6d0632cf34ae8e89ad

SHA256
7759c346539367b2f80e78abca170f09731caa169e3462f11eda84c3f1ca63d1

SHA512
0bb4f628da6d715910161439685052409be54435e192cb4105191472bb14a33724592df24686d1655e9ba9572bd3dff8f46e211c0310e16bfe2ac949c49fbc5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
8e7eb1fc2bda58e481627729d25e5dd9

SHA1
7025cfbf4d2a52f36aa8d772f4c7e0a7b4b1dfd2

SHA256
9ef4438ef97f465a7b7a4b652ee4a9c9cc6718603e8bfc136829e2472fb97387

SHA512
3c8e0fcbc28acceab2c7c1dec9f33a4c54e66bbed366540c21754c11b892107d710733331ba74a10f56120afcdd37fa3c776fc94d162def52d7ed7e63e7c91a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
257B

MD5
2aa415beb913ca281e3cec37cb64cf02

SHA1
b16d47c08623d1a80ddf1603c9bad028cd2e5898

SHA256
a8a27e6d9489531490f24e412567c0e33b41c7fd3a5a480679b88aefd71cd54e

SHA512
c26b5495f7dd64b94a558d4a982150ffc06b4e3d110cbe391fbc5ff2c62177728f3e71016ef4730591403f67252d877bffe5181a845aa30e49490d40e44bf03a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
26dd61876132a0f7e62615de2656a001

SHA1
5b912ef877713726bbd890b50995db982d42f327

SHA256
98ecf26d7d3f4ea7b7d0255cf95d703965864e36a924e17bda357a1b6d88bfa4

SHA512
04faee219ea45b70c64d7a75d60e31d31a10a51ed397cb988af3cf47bdebc5048dc72276c3657973ebfda5c1d4552508f7db61c8c050e6838da640eaace84e52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ac0375073aae181972d86aef01549d88

SHA1
053cf6facc8ddb5db3a75500cee3e38a82af2811

SHA256
6a2891bce8e3b0b22c5b30ec5a6019f2d8746f3e62d23eaa3e1ddcb972f81ff4

SHA512
f905bdf2581c01134611fbe6ebf4b3c3967130971a8a7788ca4aa1cdb541e3be4ce10400598f4959e2e34f4e30afc2b953b3f835b21ce13505deab1ae1a322c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d976798980d8069b5fbe123c204eaa9f

SHA1
eecff1cd3ec7d266fa5e1602a4bf26a1f2965bdd

SHA256
1d059d3f54c8a86632ad5c45d274a0bceecbc4294a57d8936b333600e114e383

SHA512
eaf9b051c7488844bfec0a55e7586ff0da0675c3ff6e49b096eff94bb1078d1e3c807c8ca9e6d4a680f4abf8127f819706b89f746a4525680f921c161190ddb3

Download Submit