hxxps://warwickwmg[.]eu[.]qualtrics[.]com/jfe/form/SV_3Rj0wcG0rHp2Ls2?Q_DL=2f6p1pOm3U5IXVU_3Rj0wcG0rHp2Ls2_CGC_ho7k4ARa2bPY5iu&Q_CHL=email

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://warwickwmg.eu.qualtrics.com/jfe/form/SV_3Rj0wcG0rHp2Ls2?Q_DL=2f6p1pOm3U5IXVU_3Rj0wcG0rHp2Ls2_CGC_ho7k4ARa2bPY5iu&Q_CHL=email

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe
3208	msedge.exe
3208	msedge.exe
552	identity_helper.exe
552	identity_helper.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 4972	3208	msedge.exe	84
PID 3208 wrote to memory of 4972	3208	msedge.exe	84
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 208	3208	msedge.exe	85
PID 3208 wrote to memory of 4924	3208	msedge.exe	86
PID 3208 wrote to memory of 4924	3208	msedge.exe	86
PID 3208 wrote to memory of 3524	3208	msedge.exe	87
PID 3208 wrote to memory of 3524	3208	msedge.exe	87
PID 3208 wrote to memory of 3524	3208	msedge.exe	87
PID 3208 wrote to memory of 3524	3208	msedge.exe	87
PID 3208 wrote to memory of 3524	3208	msedge.exe	87
PID 3208 wrote to memory of 3524	3208	msedge.exe	87
PID 3208 wrote to memory of 3524	3208	msedge.exe	87
PID 3208 wrote to memory of 3524	3208	msedge.exe	87
PID 3208 wrote to memory of 3524	3208	msedge.exe	87
PID 3208 wrote to memory of 3524	3208	msedge.exe	87
PID 3208 wrote to memory of 3524	3208	msedge.exe	87
PID 3208 wrote to memory of 3524	3208	msedge.exe	87
PID 3208 wrote to memory of 3524	3208	msedge.exe	87
PID 3208 wrote to memory of 3524	3208	msedge.exe	87
PID 3208 wrote to memory of 3524	3208	msedge.exe	87
PID 3208 wrote to memory of 3524	3208	msedge.exe	87
PID 3208 wrote to memory of 3524	3208	msedge.exe	87
PID 3208 wrote to memory of 3524	3208	msedge.exe	87
PID 3208 wrote to memory of 3524	3208	msedge.exe	87
PID 3208 wrote to memory of 3524	3208	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://warwickwmg.eu.qualtrics.com/jfe/form/SV_3Rj0wcG0rHp2Ls2?Q_DL=2f6p1pOm3U5IXVU_3Rj0wcG0rHp2Ls2_CGC_ho7k4ARa2bPY5iu&Q_CHL=email
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9d53d46f8,0x7ff9d53d4708,0x7ff9d53d4718
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,2488490463250837089,14211174887252879771,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,2488490463250837089,14211174887252879771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,2488490463250837089,14211174887252879771,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2488490463250837089,14211174887252879771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2488490463250837089,14211174887252879771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,2488490463250837089,14211174887252879771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,2488490463250837089,14211174887252879771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2488490463250837089,14211174887252879771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2488490463250837089,14211174887252879771,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2488490463250837089,14211174887252879771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2488490463250837089,14211174887252879771,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,2488490463250837089,14211174887252879771,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5384 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
75c9f57baeefeecd6c184627de951c1e

SHA1
52e0468e13cbfc9f15fc62cc27ce14367a996cff

SHA256
648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f

SHA512
c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
10fa19df148444a77ceec60cabd2ce21

SHA1
685b599c497668166ede4945d8885d204fd8d70f

SHA256
c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b

SHA512
3518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
3de0e08f428798130f17b1a19145edcb

SHA1
3cb9c9b49bdbe2cd5976273e14d72a52317874ea

SHA256
bea7cd35ded351e09cacb9d7e4bf7bdf3e5707158c5020f02a1aa617078a47b1

SHA512
ddf30ac5e64560b7168fdd47e70ba87ec8d94f947e9cbf68db9119557c28fe4bf3364845d8029a736f9b77ac1b2a252cc9356fec354d6515d73a6952c59cb5ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
195B

MD5
6b8d8cd5b6214ebb315cc7bc0d21bfec

SHA1
3494c4ce54e96fa2d72e2b9ad01a4bbe1e825e53

SHA256
dd8b2ed2af165fd33b3b9ea82be97804d10a628c5639e08cd38b5ef0c03da580

SHA512
3241e94ef8ff12a04f146083079d67f2eb1a9555324bde2e8352e3ec695bd2e5ed229b0b5404e3df5450272e62ad6a3cdcc079e1d6009f1e7176d7ddbb5dd994

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8fa538fa0c66b2550b5872a09d2b80fa

SHA1
2eead7fd12d5dbc9e48eacfa915b6e20cd83b4dd

SHA256
c953cfc0113908fbb07d0178f5f6475ca1a6c23b47c123026f39200909e8c2e0

SHA512
6a037f2cfe6960e44ef3cdd98e27af0717b6cdf7c9a24f8a9fd4ee08292f2411c066a11d97d76d8ab44828df7166b5c7f67226b446390c477d4b80d0b7412256

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dc2f350bc05b9c551262956a7c8cc824

SHA1
1562bdc1389a8dd5443b73fc02c40a019537ecfa

SHA256
0c9c362f9184f978404035ff2efff1fb0928013239b25806eb8495b6030fc2c3

SHA512
9beb92a1e50280fe6899ca0ac2d508e9a11b77dc1a3e6632fe56289a7ad8bc7decaccf8365e76794e5faaad681bae9d349824c997d36e05385aece1348cd77e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
3a0346a76899f2c3c68301ecde0e41c7

SHA1
3be315981caa8f70a8fb788f30f34a997249b370

SHA256
aded4c2b146079ecf1c03b393639d053755121ab5b8ab222551c7cd65829a7fb

SHA512
b980018494c01fc370a989fd194f71f6e96941637fb02c6a28e4da14672f8ac067841c25a9a727dc205608b23c3b8fce26b9f9115eb3d60162686db7a38fed5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ed4e.TMP

Filesize
203B

MD5
d1cd9607568f66bdae3698159d8e5ce4

SHA1
7a65d161332404d1a8fee7f30c67de28e15fa66a

SHA256
90cf120ba5505c6056ea907b4e2f83a7cc6cd62eb17105908c9c5f742f351f45

SHA512
45edc61bf5955fc7c85bc67b09fde5f9528f71f17c464253d1723c091092fd8a93dfcd404b3bbdf6ca3453a0904a60020805405102138d54c8ef71adae928983

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5639a166b8917e3343d04a9443d9728f

SHA1
2b9de84f6ee09aff969485ba34c73817509a85a3

SHA256
b016454af7a3e014011924fcc9edeaaceb77e04e84048b67672d44042c4fbec1

SHA512
29b31467a3f0935e79776e8b1884af7ec85e410793ec041ba8b2b94a33a19884c426ea23e0debbcb2b866e067a905a9f0c2d6437135f30b600baf70d7bb0c9c8

Download Submit