hxxps://www[.]destunl[.]com/css/cnZhenF1ZXpAZW5lcmdpYWNvc3RhYXp1bC5jb20ubXg=

Analysis

max time kernel
50s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 00:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.destunl.com/css/cnZhenF1ZXpAZW5lcmdpYWNvc3RhYXp1bC5jb20ubXg=

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2540	msedge.exe
2540	msedge.exe
2320	msedge.exe
2320	msedge.exe
5004	identity_helper.exe
5004	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2140	2320	msedge.exe	85
PID 2320 wrote to memory of 2140	2320	msedge.exe	85
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 1652	2320	msedge.exe	86
PID 2320 wrote to memory of 2540	2320	msedge.exe	87
PID 2320 wrote to memory of 2540	2320	msedge.exe	87
PID 2320 wrote to memory of 4808	2320	msedge.exe	88
PID 2320 wrote to memory of 4808	2320	msedge.exe	88
PID 2320 wrote to memory of 4808	2320	msedge.exe	88
PID 2320 wrote to memory of 4808	2320	msedge.exe	88
PID 2320 wrote to memory of 4808	2320	msedge.exe	88
PID 2320 wrote to memory of 4808	2320	msedge.exe	88
PID 2320 wrote to memory of 4808	2320	msedge.exe	88
PID 2320 wrote to memory of 4808	2320	msedge.exe	88
PID 2320 wrote to memory of 4808	2320	msedge.exe	88
PID 2320 wrote to memory of 4808	2320	msedge.exe	88
PID 2320 wrote to memory of 4808	2320	msedge.exe	88
PID 2320 wrote to memory of 4808	2320	msedge.exe	88
PID 2320 wrote to memory of 4808	2320	msedge.exe	88
PID 2320 wrote to memory of 4808	2320	msedge.exe	88
PID 2320 wrote to memory of 4808	2320	msedge.exe	88
PID 2320 wrote to memory of 4808	2320	msedge.exe	88
PID 2320 wrote to memory of 4808	2320	msedge.exe	88
PID 2320 wrote to memory of 4808	2320	msedge.exe	88
PID 2320 wrote to memory of 4808	2320	msedge.exe	88
PID 2320 wrote to memory of 4808	2320	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.destunl.com/css/cnZhenF1ZXpAZW5lcmdpYWNvc3RhYXp1bC5jb20ubXg=
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc641a46f8,0x7ffc641a4708,0x7ffc641a4718
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,4738957381041198827,15104617722375035384,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,4738957381041198827,15104617722375035384,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,4738957381041198827,15104617722375035384,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4738957381041198827,15104617722375035384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4738957381041198827,15104617722375035384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4738957381041198827,15104617722375035384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,4738957381041198827,15104617722375035384,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,4738957381041198827,15104617722375035384,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4738957381041198827,15104617722375035384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4738957381041198827,15104617722375035384,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4738957381041198827,15104617722375035384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4738957381041198827,15104617722375035384,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2060,4738957381041198827,15104617722375035384,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:1932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fbc957a83b42f65c351e04ce810c1c11

SHA1
78dcdf88beec5a9c112c145f239aefb1203d55ad

SHA256
7bb59b74f42792a15762a77ca69f52bf5cc4506261a67f78cd673a2d398e6128

SHA512
efad54eb0bd521c30bc4a96b9d4cb474c4ca42b4c108e08983a60c880817f61bc19d97538cc09a54b2db95ab9c8996f790672e19fb3851a5d93f174acdfac0ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5b6ff6669a863812dff3a9e76cb311e4

SHA1
355f7587ad1759634a95ae191b48b8dbaa2f1631

SHA256
c7fb7eea8bea4488bd4605df51aa560c0e1b11660e9228863eb4ad1be0a07906

SHA512
d153b1412fadda28c0582984e135b819ba330e01d3299bb4887062ffd6d3303da4f2c4b64a3de277773f4756da361e7bc5885c226ae2a5cfdd16ee60512e2e5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
ba6af8b4a4119ab125b2088d20e7116c

SHA1
5fbde96d7365220c62f8903e817563f968258605

SHA256
af78873292cd6363f0e27362a667601b6964c7ee6025d813ee44dc41c4eeacc4

SHA512
50fe6e32c5f1d79bbd3bb1fbdb81095942ca156e3e566167ab366d79f2227b2568ce8888075ed3745578d6fd767d7d74993e50e4961fe0766bef760ae8eb5021

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
75705f139364a16472b2ef99f946fd45

SHA1
e30a4b4d4f1a0f3e0b6445940cb2a82b554cafc1

SHA256
749a485914afb8d509a96a542cac4a7248aaf544664a2d3812ed19d189d4e92d

SHA512
40a1b37b9923beb86b38bc58248cb72c27b671b676f35da221fd1df06548dcd61a36c69643287482859067cbfe7c42a5454888d822d9bf5bed203251833e7343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2faad36a58006455fb03767e82dd4900

SHA1
ccc05ace051625bfb703605452f01c242c4c49e4

SHA256
4d96b72b1ba2649d60a1ad72a28fff400cae8946bcc5197268729aa667e9e96e

SHA512
27b1ab0fa29e0f4c8565275d2b37ff64f78ffc2e0ca42b2b9d1a63e89b532517bc2248b34d5b0afa21dbe15c0a1ab9da1440803debf81408f975ca2fac0f77ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
554c54c21100fac1e9c57e21294e7479

SHA1
1c12b859c23da51c5848728b7222f1aec7da8704

SHA256
17323138313e8a47a589c4fe56d8f54758253e78321d8f131c4f2dfdd13f6c78

SHA512
a731d2e9a17404b506cd31eab9ded84808adabdbd3e0f0af3f58f356956d479112229329c7600d2945fce91cc05385be2abc46920778ba4a7d96906d4ca3e047

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
de97a09b64961d84e1d2c180031dcdf3

SHA1
5c815709dd9108e78988d899145cdbb072ca35ef

SHA256
56c16a1120439ee86b5c17194b9aff7196e8792f1e253102c0058f3850908bd1

SHA512
725a71655275f171f21c42236386cd02758ceddad011d40126c57fd5f104419652f37f4e62f44d7ed7dc37bfad36c2afb81c725e02109c0d21e2982219e36c30

Download Submit