hxxps://invoice-view-acrobat-viewer-dhl-order-cn32895843253[.]standard[.]us-east-1[.]oortech[.]com/8yu4hweds8yuhjb4ewdsz/8yuhj23ewuihj2ewsuijk/24dhli-davi[.]html#

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 04:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://invoice-view-acrobat-viewer-dhl-order-cn32895843253.standard.us-east-1.oortech.com/8yu4hweds8yuhjb4ewdsz/8yuhj23ewuihj2ewsuijk/24dhli-davi.html#

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
2864	msedge.exe
2864	msedge.exe
3540	identity_helper.exe
3540	identity_helper.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 4320	2864	msedge.exe	82
PID 2864 wrote to memory of 4320	2864	msedge.exe	82
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 3528	2864	msedge.exe	83
PID 2864 wrote to memory of 5032	2864	msedge.exe	84
PID 2864 wrote to memory of 5032	2864	msedge.exe	84
PID 2864 wrote to memory of 3048	2864	msedge.exe	85
PID 2864 wrote to memory of 3048	2864	msedge.exe	85
PID 2864 wrote to memory of 3048	2864	msedge.exe	85
PID 2864 wrote to memory of 3048	2864	msedge.exe	85
PID 2864 wrote to memory of 3048	2864	msedge.exe	85
PID 2864 wrote to memory of 3048	2864	msedge.exe	85
PID 2864 wrote to memory of 3048	2864	msedge.exe	85
PID 2864 wrote to memory of 3048	2864	msedge.exe	85
PID 2864 wrote to memory of 3048	2864	msedge.exe	85
PID 2864 wrote to memory of 3048	2864	msedge.exe	85
PID 2864 wrote to memory of 3048	2864	msedge.exe	85
PID 2864 wrote to memory of 3048	2864	msedge.exe	85
PID 2864 wrote to memory of 3048	2864	msedge.exe	85
PID 2864 wrote to memory of 3048	2864	msedge.exe	85
PID 2864 wrote to memory of 3048	2864	msedge.exe	85
PID 2864 wrote to memory of 3048	2864	msedge.exe	85
PID 2864 wrote to memory of 3048	2864	msedge.exe	85
PID 2864 wrote to memory of 3048	2864	msedge.exe	85
PID 2864 wrote to memory of 3048	2864	msedge.exe	85
PID 2864 wrote to memory of 3048	2864	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://invoice-view-acrobat-viewer-dhl-order-cn32895843253.standard.us-east-1.oortech.com/8yu4hweds8yuhjb4ewdsz/8yuhj23ewuihj2ewsuijk/24dhli-davi.html#
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9524146f8,0x7ff952414708,0x7ff952414718
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,11939114100508259556,7262694424924397044,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,11939114100508259556,7262694424924397044,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,11939114100508259556,7262694424924397044,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11939114100508259556,7262694424924397044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11939114100508259556,7262694424924397044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11939114100508259556,7262694424924397044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11939114100508259556,7262694424924397044,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,11939114100508259556,7262694424924397044,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,11939114100508259556,7262694424924397044,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11939114100508259556,7262694424924397044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11939114100508259556,7262694424924397044,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,11939114100508259556,7262694424924397044,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1264 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0d9e81bdd937f066a00d0199bfe4954b

SHA1
b50a52ccd719019700743abe3938a138f664d615

SHA256
4dfb9af62a9862397d550711d213e32f17994634ddcab0f1cd3d79544a59ef68

SHA512
e4350f37c92e5b63dc2d3be21b332c6d976c2ab0122922b5baa2c7738436d117bb01ed34564fd290ae046bc3a2e9d081b44f0411d5f4ae04b0b2c106705d49b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
250d7431b92068412fe786ebe40ec79c

SHA1
6031e9d9561cf93ea0de7f1fbe12ffecfffa18f4

SHA256
a2ac87e6365458a77a43ef421dac577bfa7e22e6096e39d31bcd553c8bf16834

SHA512
15eb9609a92be7cea46f3df6b805cb0512bfd68eeb5f1cf28bfa77dce5199827926ec5384efd24a4b3cf249ebb00a8e5c42076f0b802794c1ba2657636df8b90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
250B

MD5
aecec97b4799b3f58394cc4e66733365

SHA1
76acb28377219b94cab496cd533c447113d6b2d0

SHA256
278b25ae4de75d89138cead25c270b6e8f6e507fc195fdfb0b911fadf98d517d

SHA512
fffc19d5af7795c0e5d496c5b0b59977b85c58d9ffdffdcc3f07cde6f48161fccd0fd42bfbf8ddfffc074cb67029910b5bb389540c148b879fe2de88b8f63d6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2d7770240b459ce80e1acaba86d067f2

SHA1
aa5ba0ff51a83d00e6a2b660b1508a68e3762a8e

SHA256
cd76b325c1c8f7ec67c26da2caa3257ee8b6a0a166f4c278e7734f1de3e1cc79

SHA512
106e02e955000f4638cfadc662eb1effbeac8b4192ed70af521708ff59283f9b9a3cae4cc2e170d88c8e4c335653d3cf164352c6b0ed6ef932f1d957fc507fc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
463d97c7d23d8961086f9d48ec967daa

SHA1
b5111bda4c0cd4e894034d8015632bf1183bf5c8

SHA256
b61029adbe5f4fba1c5fc602e20971c5cd46f914cda23ee4bb026f32781f62db

SHA512
b2d81a194dd8b03ca48adeaa97b66c2947a9d38879a7bdbad01d0004ffd765b33279f090d22c15d83e4f34b774fdc44bda97d97e8232b6824e8ee6ee56299128

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
095cd3eb0f7eb33b8777af619e25cc92

SHA1
bc9fbbcfe504769501deb125ca73aa97c11d3817

SHA256
a30fa7c125828a637ef7e68dbe72eca59bcb91c4effc4337a4f11f82704eafef

SHA512
e115e8b84bc4a24cfa30d9582cf15554f252c20a87b8df95cf80a32da27becf799f8619b075c78d9501d2adbe165ae76eba2c8e12acb1302f66d741749c03107

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
feacde03de7d18738c486ad13e6307c4

SHA1
bd50bac19b9632fb0d68b750b917e9883837c8e7

SHA256
7206ab98732042b59f225508d924176ca4d940fdecfa0e750ad2f2ba631913e6

SHA512
a89adea4c04a56c33c338b42c0ddb5db4924f348f81761188cc169e5efb5fdabf0ab55d92a900fb6760e39b84cd8cb175a64dfa5560f69da5576efd3d5cf63f5

Download Submit