hxxps://knsinternet[.]com/

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 19:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://knsinternet.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
3212	msedge.exe
3212	msedge.exe
3660	identity_helper.exe
3660	identity_helper.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 380	3212	msedge.exe	85
PID 3212 wrote to memory of 380	3212	msedge.exe	85
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 3720	3212	msedge.exe	86
PID 3212 wrote to memory of 1072	3212	msedge.exe	87
PID 3212 wrote to memory of 1072	3212	msedge.exe	87
PID 3212 wrote to memory of 5112	3212	msedge.exe	88
PID 3212 wrote to memory of 5112	3212	msedge.exe	88
PID 3212 wrote to memory of 5112	3212	msedge.exe	88
PID 3212 wrote to memory of 5112	3212	msedge.exe	88
PID 3212 wrote to memory of 5112	3212	msedge.exe	88
PID 3212 wrote to memory of 5112	3212	msedge.exe	88
PID 3212 wrote to memory of 5112	3212	msedge.exe	88
PID 3212 wrote to memory of 5112	3212	msedge.exe	88
PID 3212 wrote to memory of 5112	3212	msedge.exe	88
PID 3212 wrote to memory of 5112	3212	msedge.exe	88
PID 3212 wrote to memory of 5112	3212	msedge.exe	88
PID 3212 wrote to memory of 5112	3212	msedge.exe	88
PID 3212 wrote to memory of 5112	3212	msedge.exe	88
PID 3212 wrote to memory of 5112	3212	msedge.exe	88
PID 3212 wrote to memory of 5112	3212	msedge.exe	88
PID 3212 wrote to memory of 5112	3212	msedge.exe	88
PID 3212 wrote to memory of 5112	3212	msedge.exe	88
PID 3212 wrote to memory of 5112	3212	msedge.exe	88
PID 3212 wrote to memory of 5112	3212	msedge.exe	88
PID 3212 wrote to memory of 5112	3212	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://knsinternet.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdfe9146f8,0x7ffdfe914708,0x7ffdfe914718
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,9558605964554546866,550489127397437029,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,9558605964554546866,550489127397437029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,9558605964554546866,550489127397437029,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9558605964554546866,550489127397437029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9558605964554546866,550489127397437029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,9558605964554546866,550489127397437029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,9558605964554546866,550489127397437029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9558605964554546866,550489127397437029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9558605964554546866,550489127397437029,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9558605964554546866,550489127397437029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9558605964554546866,550489127397437029,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,9558605964554546866,550489127397437029,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5b5d5895-c351-4c69-b1a6-d6904c1d91fd.tmp

Filesize
11KB

MD5
fd7909fba1b4315ab53835dfdb8ff276

SHA1
b5ed310e5a59b964cd8d9634a63d34aca57acf62

SHA256
4cdcda6d908477bb4b76f1aeb1c7885e66f1b86eae8da29134fff55c5c925dd1

SHA512
7854a6af94152e2ddc323ead35986f3526748b69587ef4b60bf42a478f265ab013162e35c2ac5cb7f961b587f9bac4b7aadeb626de8af9d1968457cc053de91b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
584971c8ba88c824fd51a05dddb45a98

SHA1
b7c9489b4427652a9cdd754d1c1b6ac4034be421

SHA256
e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307

SHA512
5dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b28ef7d9f6d74f055cc49876767c886c

SHA1
d6b3267f36c340979f8fc3e012fdd02c468740bf

SHA256
fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37

SHA512
491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
404KB

MD5
6cfeeccd9e51458d146da1b5aec9c00a

SHA1
868341791a04e4f57790f457d441430fed661b46

SHA256
5f93efb6efa1a918ab64814bf32eec5f86844acc0acf60d5bdf95cdd924d0857

SHA512
4d5be1f9ed4ec62bc85238a35492737ef70b20d1bd7a614d4e0e00379cefe69a00ba32b77378de564cb00bdd3cdf562413616a7cc7ad3d72c703d1904222d148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
778KB

MD5
bf0e0d32069fec297a47449ab3d828ae

SHA1
e6a766e01d950938a065222f5c876bcb4943e379

SHA256
c3bd07f2a4715ec7e897e9359f0e6659d842dea7472431d6cdd84ec576e98160

SHA512
be021a4c27af93856e2ff74b8170f451381285ff63f4b47375476afa52720280db3522f05e8d6726f3679c30f2bf4431d4bf146ca59eb4c44a7a80c3c6d81c71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
2edad57759392c166d3aa9cc5f33479a

SHA1
23753857d9637fd737bf0d504b960b59e0e2641a

SHA256
71325a5a3b6567db455ff077cd475fb8e2890794470cdf8a8512a7f3c9b6655e

SHA512
bb0d420ab1b01c817d75dadd593d4423e9391155e5ff61a40537fd9a124e9728b0ed5058107197e5ca56d9f642d5ee66968531b535b26dc4278c2f234b28b110

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f9fc867d6795902aa5af9ee3858f759b

SHA1
d524d704a2eba97beb2879d61bca75a63991c94e

SHA256
f7e0f823b5864ba77833cd7d558f2e3a65e4b316f7b1b3e0787776713906dcbe

SHA512
f9aca8667203521dc7403365515ca3b3c61dcc8e06846357e8abc4bdc7a623e8210f47b6f21fe519884b8e07b0fc3891ac00a4ec0dcfbe302624071a1eba60a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9ccf20d08b099b86a216e879ca296829

SHA1
55673c1d4b66a585545bfcdde75819f96b53c0c7

SHA256
b6aa8e828af9adf1af347961178482fdd292634c5fa6d15b85bf60711fd3188a

SHA512
1b0c24bdc94a4da7b41297201ba5be35a4f283190db68804931bde907a6a6a5cb3792741b764a160ae9b7e3a27c6d32daaf1b4a08c1ce72360902d55ebaddbe8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d37282c9ed932d386cd89cc5f75e1986

SHA1
98b72bfaea98cea49ccbe9185c8ac3087cada9be

SHA256
b132d4f077f969d7070e5a30574b60fc61bc8522f1fd657632d24cfb29d14122

SHA512
de95f1505816b3d6a44934eab7ae275b15a7054a58de9fe3c9851c8eab2b68e93069b43687cc632fb0ae7f671b2c8edd8f17764f1a7d1d8d0c1c87266b3a062e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit