hxxp://rubriek[.]com

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 20:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://rubriek.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
5384	msedge.exe
5384	msedge.exe
2936	identity_helper.exe
2936	identity_helper.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe
5384	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5384 wrote to memory of 6132	5384	msedge.exe	85
PID 5384 wrote to memory of 6132	5384	msedge.exe	85
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4360	5384	msedge.exe	86
PID 5384 wrote to memory of 4836	5384	msedge.exe	87
PID 5384 wrote to memory of 4836	5384	msedge.exe	87
PID 5384 wrote to memory of 2312	5384	msedge.exe	88
PID 5384 wrote to memory of 2312	5384	msedge.exe	88
PID 5384 wrote to memory of 2312	5384	msedge.exe	88
PID 5384 wrote to memory of 2312	5384	msedge.exe	88
PID 5384 wrote to memory of 2312	5384	msedge.exe	88
PID 5384 wrote to memory of 2312	5384	msedge.exe	88
PID 5384 wrote to memory of 2312	5384	msedge.exe	88
PID 5384 wrote to memory of 2312	5384	msedge.exe	88
PID 5384 wrote to memory of 2312	5384	msedge.exe	88
PID 5384 wrote to memory of 2312	5384	msedge.exe	88
PID 5384 wrote to memory of 2312	5384	msedge.exe	88
PID 5384 wrote to memory of 2312	5384	msedge.exe	88
PID 5384 wrote to memory of 2312	5384	msedge.exe	88
PID 5384 wrote to memory of 2312	5384	msedge.exe	88
PID 5384 wrote to memory of 2312	5384	msedge.exe	88
PID 5384 wrote to memory of 2312	5384	msedge.exe	88
PID 5384 wrote to memory of 2312	5384	msedge.exe	88
PID 5384 wrote to memory of 2312	5384	msedge.exe	88
PID 5384 wrote to memory of 2312	5384	msedge.exe	88
PID 5384 wrote to memory of 2312	5384	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://rubriek.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbbe1d46f8,0x7ffbbe1d4708,0x7ffbbe1d4718
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,821845746274937891,12610606314085686038,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,821845746274937891,12610606314085686038,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,821845746274937891,12610606314085686038,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,821845746274937891,12610606314085686038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,821845746274937891,12610606314085686038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,821845746274937891,12610606314085686038,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,821845746274937891,12610606314085686038,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,821845746274937891,12610606314085686038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,821845746274937891,12610606314085686038,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,821845746274937891,12610606314085686038,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,821845746274937891,12610606314085686038,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,821845746274937891,12610606314085686038,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3184 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8dc45b70cbe29a357e2c376a0c2b751b

SHA1
25d623cea817f86b8427db53b82340410c1489b2

SHA256
511cfb6bedbad2530b5cc5538b6ec2184fc4f85947ba4c8166d0bb9f5fe2703a

SHA512
3ce0f52675feb16d6e62aae1c50767da178b93bdae28bacf6df3a2f72b8cc75b09c5092d9065e0872e5d09fd9ffe0c6931d6ae1943ddb1927b85d60659ef866e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1790c766c15938258a4f9b984cf68312

SHA1
15c9827d278d28b23a8ea0389d42fa87e404359f

SHA256
2e3978bb58c701f3c6b05de9349b7334a194591bec7bcf73f53527dc0991dc63

SHA512
2682d9c60c9d67608cf140b6ca4958d890bcbc3c8a8e95fcc639d2a11bb0ec348ca55ae99a5840e1f50e5c5bcf3e27c97fc877582d869d98cc4ea3448315aafb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d9469423d607124f13ad8c4afc7a5aca

SHA1
223febded3ff271c2509ed3e1877c832269af55a

SHA256
7ecf1ae33b966d21ce86538e4c2d14a57f8973c1bb9412b17e4a1ae21b612ec4

SHA512
1d8310845a6084a1dd61fa33cb9d780bcfbc05001dc86b178afad6a20a4e0184aa68b4cafcba28583de4698924c45c8ff20d0241a4621d711204e856c8df4ac4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3ca0558704fb16d97e6b14ce77bc99fe

SHA1
0df779851c221ac3091dab48af904e7ecfb4ed31

SHA256
d8784feb4fb6051681923762f1fb89e332201bf9a7902a7519be3dc78dca4b34

SHA512
cf0e17b045e9148664c16fedbc27151edb2cf6aecddf6353f4542759d0257f5886deadff158f99b5bbc56d4bc5d78314e33eba34ac4899a509b2af29700c00d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
301be8597302e297b4b64025dc6f7982

SHA1
f38bb9e8ab65e3eb35729974c4b7058a6e29121e

SHA256
c9781d1f43f8f54654d4cce116a8974cacaa118368d1d347436b6a0b909f0df6

SHA512
871cec7ee7095c2b6cda4295fe1a14d7baa8792605b4f52fa546d66eff7cc0b692fafe5514108ce66c1a2ff5249623c3ec410b4d96bb81540a5b18d310117c96

Download Submit