hxxps://ste50-card[.]com/50

Analysis

max time kernel
147s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
05/07/2024, 07:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ste50-card.com/50
Sample240705-jtnfpavdlr

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
2368	msedge.exe
2368	msedge.exe
3880	identity_helper.exe
3880	identity_helper.exe
72	msedge.exe
72	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 4908	2368	msedge.exe	79
PID 2368 wrote to memory of 4908	2368	msedge.exe	79
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4452	2368	msedge.exe	81
PID 2368 wrote to memory of 4560	2368	msedge.exe	82
PID 2368 wrote to memory of 4560	2368	msedge.exe	82
PID 2368 wrote to memory of 4616	2368	msedge.exe	83
PID 2368 wrote to memory of 4616	2368	msedge.exe	83
PID 2368 wrote to memory of 4616	2368	msedge.exe	83
PID 2368 wrote to memory of 4616	2368	msedge.exe	83
PID 2368 wrote to memory of 4616	2368	msedge.exe	83
PID 2368 wrote to memory of 4616	2368	msedge.exe	83
PID 2368 wrote to memory of 4616	2368	msedge.exe	83
PID 2368 wrote to memory of 4616	2368	msedge.exe	83
PID 2368 wrote to memory of 4616	2368	msedge.exe	83
PID 2368 wrote to memory of 4616	2368	msedge.exe	83
PID 2368 wrote to memory of 4616	2368	msedge.exe	83
PID 2368 wrote to memory of 4616	2368	msedge.exe	83
PID 2368 wrote to memory of 4616	2368	msedge.exe	83
PID 2368 wrote to memory of 4616	2368	msedge.exe	83
PID 2368 wrote to memory of 4616	2368	msedge.exe	83
PID 2368 wrote to memory of 4616	2368	msedge.exe	83
PID 2368 wrote to memory of 4616	2368	msedge.exe	83
PID 2368 wrote to memory of 4616	2368	msedge.exe	83
PID 2368 wrote to memory of 4616	2368	msedge.exe	83
PID 2368 wrote to memory of 4616	2368	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ste50-card.com/50
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffb0e43cb8,0x7fffb0e43cc8,0x7fffb0e43cd8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,15922701879937810932,1791339539799273265,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1976,15922701879937810932,1791339539799273265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1976,15922701879937810932,1791339539799273265,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2504 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,15922701879937810932,1791339539799273265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,15922701879937810932,1791339539799273265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1976,15922701879937810932,1791339539799273265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,15922701879937810932,1791339539799273265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,15922701879937810932,1791339539799273265,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,15922701879937810932,1791339539799273265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,15922701879937810932,1791339539799273265,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1976,15922701879937810932,1791339539799273265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3940 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:72
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,15922701879937810932,1791339539799273265,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 6b4b411180d903dcee076619b1b6af71d0e35569e68f0d330f8050a94e5c521e
MD5 c00182578404b4b6fcfde21669962dd4
SHA1 25e096b73941797b77cfb40dfc84e5d38102b1ee
SHA512 06a13324b95603357abbc051ec4fd083148bb28da731f8b83d4066bd47d73a7383a58d4dba52ecd63f28ff46070669dee07ce8e8f87fa07207af122264e95e9f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2b35918fecd0a80628088d9069436558b2dde8eb14de4162abf9c2e4538eaa13
MD5 b8739e9507ed3529c450eb5b6ac83e21
SHA1 0f933f32c39a0af112fbe0a58e5d7a9edc617965
SHA512 e852a75b3505554fc690faa3720b2889c884602b724210533c608649e1a1a58ebb33975ee0acfe9767ab09ddac120e934bc9662a9949750665a3a350ba9acb67
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 471B
SHA256 e9b8a121b1ed3d2d8b0a728b56da47c15605921e676ec37b7cdd47b42d0a01c6
MD5 60f0d12e6e02a17ac6afd959dc5f9525
SHA1 b89c8504330fa8672aff449dfdbc2ab5d0c8787d
SHA512 217f65311b2d7791a45faa46b78f5c5b970a207cc94a09fd7e27e79999e49e99400f336880f150a89bc005cc607931b5e9d12e8482eadeb807eec37ce75362e5
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 5d4b31674ad99b827cdd1885542a3685744252cdad297c952c0ae52e0dfe0085
MD5 aa83fef7d64a19d2d2255b2ef3be1717
SHA1 23cda1c6233dd797856695e067bcf23a1d13266c
SHA512 f46cbb017c984d4225a943cf99c5b8071e142d5e18f0984983539642428094b70ed1f36c92802b064828b9ebae8e7f6f65f18d56aa1110aa3f359e9cae192a0a
SSDEEP 96:n1k3axV0k5wSv0MoiVmdHIKJi0WQyV+VpziX3wI3:n1k38+k5v0MAIAiLx93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 039cbe936a3ab4af2deb13c124b3bf79dfd7a62f8dffd6dfb5d7de9cc98d4fa0
MD5 c423f09f4a54604d718462b4624d345c
SHA1 12d65a36577649b5974b8fc1507ec25340e740ca
SHA512 093a577d71361bf9b624044c41adf998617020c5d26ccf2243d56aab8aaff91e43d154655f192b41dd6cd02e8dc9f09d9e3990cbea9e0d71e20f049f29f11a6d
SSDEEP 96:n1k3bxV0k5wSv0MoiVmdc8ut1jITJi0WQyV+VpAiX3wI3:n1k31+k5v0Mb8uthI9iLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 706888f8212a8c705f445e2875fac1fd3102912ad77665d6838ec85cb3d831a2
MD5 46caa6571ca757c778aa2c0230e192a3
SHA1 9280722e872981f304c19abe629ad1f9236a1935
SHA512 3d1b2a2f331f0294aea9d087d5c361c609177e660af032cc861721fc693e1d15c12f561352d92c1f558c7a3df6187561c9f1b1d98472204510c391fe642278a0
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG5AWwe2RU5CRbyOdYXC1FxTTB:M9iIxuERzA83h09RZxASG5AroYyOdYXk
MD5 SHA1 SHA512 SSDEEP

Submit Download