hxxp://alberta[.]ca

Analysis

max time kernel
1s
max time network
23s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2024, 00:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://alberta.ca

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1952	msedge.exe
1952	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 1436	652	msedge.exe	82
PID 652 wrote to memory of 1436	652	msedge.exe	82
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 64	652	msedge.exe	85
PID 652 wrote to memory of 1952	652	msedge.exe	86
PID 652 wrote to memory of 1952	652	msedge.exe	86
PID 652 wrote to memory of 1928	652	msedge.exe	87
PID 652 wrote to memory of 1928	652	msedge.exe	87
PID 652 wrote to memory of 1928	652	msedge.exe	87
PID 652 wrote to memory of 1928	652	msedge.exe	87
PID 652 wrote to memory of 1928	652	msedge.exe	87
PID 652 wrote to memory of 1928	652	msedge.exe	87
PID 652 wrote to memory of 1928	652	msedge.exe	87
PID 652 wrote to memory of 1928	652	msedge.exe	87
PID 652 wrote to memory of 1928	652	msedge.exe	87
PID 652 wrote to memory of 1928	652	msedge.exe	87
PID 652 wrote to memory of 1928	652	msedge.exe	87
PID 652 wrote to memory of 1928	652	msedge.exe	87
PID 652 wrote to memory of 1928	652	msedge.exe	87
PID 652 wrote to memory of 1928	652	msedge.exe	87
PID 652 wrote to memory of 1928	652	msedge.exe	87
PID 652 wrote to memory of 1928	652	msedge.exe	87
PID 652 wrote to memory of 1928	652	msedge.exe	87
PID 652 wrote to memory of 1928	652	msedge.exe	87
PID 652 wrote to memory of 1928	652	msedge.exe	87
PID 652 wrote to memory of 1928	652	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://alberta.ca
1⤵
- Suspicious use of WriteProcessMemory
PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9640246f8,0x7ff964024708,0x7ff964024718
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,13930672075355758976,2104642273384964786,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,13930672075355758976,2104642273384964786,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,13930672075355758976,2104642273384964786,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13930672075355758976,2104642273384964786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13930672075355758976,2104642273384964786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13930672075355758976,2104642273384964786,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,13930672075355758976,2104642273384964786,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:4432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1fe3a26bd35b84102bb4203f31e74c7

SHA1
45fdfa8433789b575eb64e116718e62e0e0cf4a0

SHA256
26e0d51529de906dd285ba48288e25eaf5213c0f0bab9bc5f119ecbc5e1b93ee

SHA512
d528db2e9b917d4fbe24b1b5c6f4cb274f4f91c84f63e5119e041fa89ae0cd01a370e314f8b6aca9d6fa958e79feabc720f4b54b3d8aed69aab11fa84cad36bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2915233ace3b11bc8898c958f245aa9a

SHA1
68c6aa983da303b825d656ac3284081db682f702

SHA256
b2cb442f2ca27619c8df087f56fcbbb53186c53f8fd131af886ee3712220477e

SHA512
e3f1b70d39b615e212f84d587ee816598236ee6ce144d919593894fcce4a0900343a9e8b837a0d1bd10921fff1c976c84c4a570eda776fe84d374a69e7a54890

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d354fa655f66d24bb75bfb910b75e06a

SHA1
b7c03c783c52575d4461ffcdbe8669289c4719c8

SHA256
569588b73f12f2761910ea5ca688462db6690a09f8e5c2742240a3514a060c6d

SHA512
8f2f67ea1abf932d9e1fd598cf2eb039fea32d38d0a714c54d1b407eced71b9dbc583fd3b5ad78029c039342a1310bb70aa51b37b541763522cd3a11a3ffe221

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
850ce540e770c9307cd3f7ebfb2a2699

SHA1
35d25e3e248575c1c28586ccad3ba317d0ef2cd2

SHA256
3c721034c7f20de49804ac9ee2a5bc236f7bcac0625c6c3182406d27508c8460

SHA512
ece843a98727ef7219d41564cfa1c40dd2ee4f40509ace10b260adb6b43f134585bfd9ece73ff80528bf561dcaf9fe3c9d28a662a57c81e3303cf73218da6d82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fdac2027de4263133f1b8ad9e830b995

SHA1
d77831020e29c72449a502aad95f3deff5691d1b

SHA256
79003b34b6bcd0308074423970d96be88814a15c66ecab0ffb5a88fd00f3c296

SHA512
9769f34becea0249232353a83744103ba597b7effc7d3d16be7b94bbc295969e1a2056faa66e774f11bb618e2ce11cea465b656b277401c30c1832791e261209

Download Submit