hxxp://whatismyipaddress[.]com

Analysis

max time kernel
70s
max time network
78s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
15/07/2024, 06:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://whatismyipaddress.com

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	whatismyipaddress.com
8	whatismyipaddress.com
1	whatismyipaddress.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3692	msedge.exe
3692	msedge.exe
2880	msedge.exe
2880	msedge.exe
4932	identity_helper.exe
4932	identity_helper.exe
4644	msedge.exe
4644	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 5740	2880	msedge.exe	81
PID 2880 wrote to memory of 5740	2880	msedge.exe	81
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 5884	2880	msedge.exe	82
PID 2880 wrote to memory of 3692	2880	msedge.exe	83
PID 2880 wrote to memory of 3692	2880	msedge.exe	83
PID 2880 wrote to memory of 2672	2880	msedge.exe	84
PID 2880 wrote to memory of 2672	2880	msedge.exe	84
PID 2880 wrote to memory of 2672	2880	msedge.exe	84
PID 2880 wrote to memory of 2672	2880	msedge.exe	84
PID 2880 wrote to memory of 2672	2880	msedge.exe	84
PID 2880 wrote to memory of 2672	2880	msedge.exe	84
PID 2880 wrote to memory of 2672	2880	msedge.exe	84
PID 2880 wrote to memory of 2672	2880	msedge.exe	84
PID 2880 wrote to memory of 2672	2880	msedge.exe	84
PID 2880 wrote to memory of 2672	2880	msedge.exe	84
PID 2880 wrote to memory of 2672	2880	msedge.exe	84
PID 2880 wrote to memory of 2672	2880	msedge.exe	84
PID 2880 wrote to memory of 2672	2880	msedge.exe	84
PID 2880 wrote to memory of 2672	2880	msedge.exe	84
PID 2880 wrote to memory of 2672	2880	msedge.exe	84
PID 2880 wrote to memory of 2672	2880	msedge.exe	84
PID 2880 wrote to memory of 2672	2880	msedge.exe	84
PID 2880 wrote to memory of 2672	2880	msedge.exe	84
PID 2880 wrote to memory of 2672	2880	msedge.exe	84
PID 2880 wrote to memory of 2672	2880	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://whatismyipaddress.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff81ad3cb8,0x7fff81ad3cc8,0x7fff81ad3cd8
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1796,17037793319796098806,653243940186606183,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1796,17037793319796098806,653243940186606183,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1796,17037793319796098806,653243940186606183,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,17037793319796098806,653243940186606183,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3044 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,17037793319796098806,653243940186606183,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3056 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,17037793319796098806,653243940186606183,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1796,17037793319796098806,653243940186606183,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1796,17037793319796098806,653243940186606183,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,17037793319796098806,653243940186606183,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,17037793319796098806,653243940186606183,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,17037793319796098806,653243940186606183,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1796,17037793319796098806,653243940186606183,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:4600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
caaeb604a99d78c4a41140a3082ca660

SHA1
6d9cd8a52c0f2cd9b48b00f612ec33cd7ca0aa97

SHA256
75e15f595387aec18f164aa0d6573c1564aaa49074547a2d48a9908d22a3b5d6

SHA512
1091aa1e8bf74ed74ad8eb8fa25c4e24b6cfd0496482e526ef915c5a7d431f05360b87d07c11b93eb9296fe386d71e99d214afce163c2d01505349c52f2d5d66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1fe10b6cb6b345a095320391bda78b22

SHA1
46c36ab1994b86094f34a0fbae3a3921d6690862

SHA256
85a627e9b109e179c49cf52420ad533db38e75bc131714a25c1ae92dd1d05239

SHA512
9f9d689662da014dfae3565806903de291c93b74d11b47a94e7e3846537e029e1b61ad2fad538b10344641003da4d7409c3dd834fed3a014c56328ae76983a2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
552B

MD5
d0abf92ab7f5fa3a47e7ee99a73c0263

SHA1
3f81929950a12e07444668487fe5fab96aac0479

SHA256
e732f87b3c09c65030d60c8122040b47ab118a786b9b9e09c865ae9f9332f24a

SHA512
117f2327dcd8d16c8e46e62d85b12b07f38e6d874b034deb02719942ed6e82d1f5d4e1415ec8185dcbccfd0f6b7866a1c36f49c24ad0d40cabaa4d5ecc780e2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
d74204744b05a1a4acac8a2c5a41e0a4

SHA1
b4bb08946da4cd401e1f2bf327fd1ab0ed3c3b50

SHA256
d2278d14021150eef2778822b16841d1bbafdb17f186b3023d01d26682b94b54

SHA512
2d40c27ba63b22d9e8f2c57ed30097d888731af5ff7461f04aaac889c9e3073c16e86e12777ba76bb86bf516d4a31b365460c3fb73501198427d2b0b90373974

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2c745b4fcc113cc66e9e789d919de1f7

SHA1
a039ac0e785ba1d032d62fbee8ef5f54f2b187bb

SHA256
064593fc5f5a45df5de95e2c2556384986afed10faa82be657b1712c008a750d

SHA512
4a6d2ed2cd48a7ba773ab24664ab38edb3b0e421733bb3d703495e14c57e5f5bfed74bbace148a52471c656e302bb9024e820afd94e02bd4d9c11b9caa3569dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5edcd35e0259e0235ebc9dcd31a202d4

SHA1
3d65a7534e010a6950f947de358c8b34ed0a136d

SHA256
44ee70d33ac73eb035f9b182d4533cba7e157053aaf04a05232942402ff8ca39

SHA512
2671405329a421167849f737bdab020b3144687932ec71eb17343d1500b08269917dc4c570b4c8987b4206037fe93b8aed5d60fcd9bc3326691bb420f58712c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f02cdbcc0293ab8849089a57d75fd7e5

SHA1
5fe6578d9ea8c5108e4db062280df7b107544eac

SHA256
bad84c1cd344bb0be04310380621411ad5ae2fd95a6acc8f222ef702316b7111

SHA512
7dc1060bd9743315db6ebf32769e2fc876281a5e4662b541e5114be9bd33a5d2beeccf8477fbca628657aabc8e2af4d19ef69b339a496770194728434269e772

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581e41.TMP

Filesize
1KB

MD5
e8b87829778b45c7951da9911552b64b

SHA1
ed5c46900632de8b93e605463a57ebdd9fe377a1

SHA256
bc10c9a22950f598b89105b40f0391e22895c40545c40f3a9ed6c03f6e0ff8f3

SHA512
77940e502a4c316a40f96a760e8adb9a4981725f1d7a9924b5cdc0bcc2e7f6b193bbf757e442171ae3e07af80101a77e304493ea3da363e5687dc3f08f59ade8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
47f9a90eda4bb95313cf7c87c235ab5c

SHA1
649c399770434084454fa1f59733dfaf88b4ed34

SHA256
6a5a9ed68b4dc3fb6aedaf3ce67a9e7318b0cb78e127d61812896a57d90b84f3

SHA512
b10968230f100175b2533d0544e3dae4c2227f9e78e9d1ea72757f9dd0e6427a1c7b730f74bfe612c258c428f5b14653a51df1671890209f7d826dc5f70dcc1b

Download Submit