hxxp://tns-counter[.]ru

Resubmissions

05/07/2024, 18:17

240705-ww7nkasfnq 1

05/07/2024, 18:14

240705-wvdzvsvfqc 1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 18:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://tns-counter.ru

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3920	msedge.exe
3920	msedge.exe
1032	msedge.exe
1032	msedge.exe
2768	identity_helper.exe
2768	identity_helper.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe
1032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 1548	1032	msedge.exe	81
PID 1032 wrote to memory of 1548	1032	msedge.exe	81
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3664	1032	msedge.exe	82
PID 1032 wrote to memory of 3920	1032	msedge.exe	83
PID 1032 wrote to memory of 3920	1032	msedge.exe	83
PID 1032 wrote to memory of 1356	1032	msedge.exe	84
PID 1032 wrote to memory of 1356	1032	msedge.exe	84
PID 1032 wrote to memory of 1356	1032	msedge.exe	84
PID 1032 wrote to memory of 1356	1032	msedge.exe	84
PID 1032 wrote to memory of 1356	1032	msedge.exe	84
PID 1032 wrote to memory of 1356	1032	msedge.exe	84
PID 1032 wrote to memory of 1356	1032	msedge.exe	84
PID 1032 wrote to memory of 1356	1032	msedge.exe	84
PID 1032 wrote to memory of 1356	1032	msedge.exe	84
PID 1032 wrote to memory of 1356	1032	msedge.exe	84
PID 1032 wrote to memory of 1356	1032	msedge.exe	84
PID 1032 wrote to memory of 1356	1032	msedge.exe	84
PID 1032 wrote to memory of 1356	1032	msedge.exe	84
PID 1032 wrote to memory of 1356	1032	msedge.exe	84
PID 1032 wrote to memory of 1356	1032	msedge.exe	84
PID 1032 wrote to memory of 1356	1032	msedge.exe	84
PID 1032 wrote to memory of 1356	1032	msedge.exe	84
PID 1032 wrote to memory of 1356	1032	msedge.exe	84
PID 1032 wrote to memory of 1356	1032	msedge.exe	84
PID 1032 wrote to memory of 1356	1032	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://tns-counter.ru
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe2ac946f8,0x7ffe2ac94708,0x7ffe2ac94718
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,1049628653017435931,17145248705829896733,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,1049628653017435931,17145248705829896733,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,1049628653017435931,17145248705829896733,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:8
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1049628653017435931,17145248705829896733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1049628653017435931,17145248705829896733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,1049628653017435931,17145248705829896733,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,1049628653017435931,17145248705829896733,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1049628653017435931,17145248705829896733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1049628653017435931,17145248705829896733,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1049628653017435931,17145248705829896733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1049628653017435931,17145248705829896733,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,1049628653017435931,17145248705829896733,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2076,1049628653017435931,17145248705829896733,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:3848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
de1d175f3af722d1feb1c205f4e92d1e

SHA1
019cf8527a9b94bd0b35418bf7be8348be5a1c39

SHA256
1b99cae942ebf99c31795fa279d51b1a2379ca0af7b27bd3c58ea6c78a033924

SHA512
f0dcd08afd3c6a761cc1afa2846ec23fb5438d6127ebd535a754498debabd0b1ebd04858d1b98be92faf14b512f982b1f3dcbb702860e96877eb835f763f9734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
06b496d28461d5c01fc81bc2be6a9978

SHA1
36e7a9d9c7a924d5bb448d68038c7fe5e6cbf5aa

SHA256
e4a2d1395627095b0fa55e977e527ccb5b71dff3cd2d138df498f50f9f5ab507

SHA512
6488a807c978d38d65010583c1e5582548ab8102ebd68ee827e603c9bdfcdbb9f98a488d31414a829409f6edca8bd2eb4aadd4ff31b144de41249fa63a26bc91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4005bf72-22d8-4d12-b14c-6b57df1fef79.tmp

Filesize
186B

MD5
1ba807dff113f64ceb3a4b8eb06b430b

SHA1
d3b5191e37fb2662eca40cd87f4e9caeb3893993

SHA256
5c758fedd51f8e100571438f0d21511c95488aa8bc5ac4b751ed5f349f86e047

SHA512
dcdaa5e579874521d82820fe236fd25c8916738534335f7fba02a426199a756e1b2b9e5274af7809ce48adc3f86793544bf9ef8e175270274c884823404d1f23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
71d270654181cbbe4d313c2a7457ce09

SHA1
b0ef23e2281d6e016ade846db87c3a71733159a4

SHA256
29308c2326ab8e107d080d2d26b415b52ed1ed728ddb36764b39e0b8d471c640

SHA512
5e928f2a914ecdf4dbe1f5320c46bcc0a277ec1661e9e6b2656316cfd414a9f84790ec590cef4e4a59965da7f0dfbb96ca042ece8e492313d62fc1c4a1d09b07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8ebc74a01e07d296ab6abb87ca72a6e9

SHA1
dafe7d105f77e1d97e3bd00bf7fac4bd4cd53989

SHA256
3678c45f4d0724d4f3a77e0d10a094859e7b55575b026d9888c50e1a8b389eb2

SHA512
c961e1d8b29a4523b0a7659bce59094656252f1e20e19c9c160acc6e95d4bf66ade173bbcf8ebf966a35430c03e19775a87223c7100f62d494f24570de985793

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ffa20e79cf13eaa40bb048aea983e9d4

SHA1
4a56091e6ad05314cc1ebe0affd87254d65cf85f

SHA256
f2bc11d8b5a731aea35d5b15f3bd7d1f0ce7a9a55f81ac1ef6a9451fdffd0e09

SHA512
ea05e2e6cf7f4f329acb9eef45486ac7a03002300c3fb9a6e13f2eaf724d624f9237053916ed3ec94c599675d9b7a24287279ae786e7a85aea41e109c9a1112a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
96e9a88f2aea53867fd31f678525846a

SHA1
a3fca2eebf6bc70caf7f62d613377745d2e57ac7

SHA256
53a7a34a000644496db2207c4c2d1f1e380c62bcebc05bbd3cbc1ee71627e9c7

SHA512
310c72730bb1b5fd854c21f1f437983f363a1906f63e77f6f2d8eac59de5d6408413ee531312d0b1bd324d9d6090e811efbb3344ac1c9c16c682d8885b50c83b

Download Submit