hxxps://t[.]co/CYFtjz0tsp

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://t.co/CYFtjz0tsp
Sample240716-e1p6msxfla

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2356	msedge.exe
2356	msedge.exe
3584	msedge.exe
3584	msedge.exe
3196	identity_helper.exe
3196	identity_helper.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 2680	3584	msedge.exe	83
PID 3584 wrote to memory of 2680	3584	msedge.exe	83
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 4456	3584	msedge.exe	84
PID 3584 wrote to memory of 2356	3584	msedge.exe	85
PID 3584 wrote to memory of 2356	3584	msedge.exe	85
PID 3584 wrote to memory of 216	3584	msedge.exe	86
PID 3584 wrote to memory of 216	3584	msedge.exe	86
PID 3584 wrote to memory of 216	3584	msedge.exe	86
PID 3584 wrote to memory of 216	3584	msedge.exe	86
PID 3584 wrote to memory of 216	3584	msedge.exe	86
PID 3584 wrote to memory of 216	3584	msedge.exe	86
PID 3584 wrote to memory of 216	3584	msedge.exe	86
PID 3584 wrote to memory of 216	3584	msedge.exe	86
PID 3584 wrote to memory of 216	3584	msedge.exe	86
PID 3584 wrote to memory of 216	3584	msedge.exe	86
PID 3584 wrote to memory of 216	3584	msedge.exe	86
PID 3584 wrote to memory of 216	3584	msedge.exe	86
PID 3584 wrote to memory of 216	3584	msedge.exe	86
PID 3584 wrote to memory of 216	3584	msedge.exe	86
PID 3584 wrote to memory of 216	3584	msedge.exe	86
PID 3584 wrote to memory of 216	3584	msedge.exe	86
PID 3584 wrote to memory of 216	3584	msedge.exe	86
PID 3584 wrote to memory of 216	3584	msedge.exe	86
PID 3584 wrote to memory of 216	3584	msedge.exe	86
PID 3584 wrote to memory of 216	3584	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.co/CYFtjz0tsp
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9849146f8,0x7ff984914708,0x7ff984914718
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,12899960036729143449,10038765990494198424,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,12899960036729143449,10038765990494198424,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,12899960036729143449,10038765990494198424,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12899960036729143449,10038765990494198424,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12899960036729143449,10038765990494198424,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12899960036729143449,10038765990494198424,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,12899960036729143449,10038765990494198424,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,12899960036729143449,10038765990494198424,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12899960036729143449,10038765990494198424,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12899960036729143449,10038765990494198424,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12899960036729143449,10038765990494198424,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12899960036729143449,10038765990494198424,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,12899960036729143449,10038765990494198424,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5000 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 dff0886331bb45ec7711af92ab10be76291fde729dff23ca3270c86fb6e606bb
MD5 6c86c838cf1dc704d2be375f04e1e6c6
SHA1 ad2911a13a3addc86cc46d4329b2b1621cbe7e35
SHA512 a120248263919c687f09615fed56c7cac825c8c93c104488632cebc1abfa338c39ebdc191e5f0c45ff30f054f08d4c02d12b013de6322490197606ce0c0b4f37
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 494425284ba12ee2fb07890e268be7890b258e1b1e5ecfa4a4dbc3411ab93b1a
MD5 27f3335bf37563e4537db3624ee378da
SHA1 57543abc3d97c2a2b251b446820894f4b0111aeb
SHA512 2bef861f9d2d916272f6014110fdee84afced515710c9d69b3c310f6bf41728d1b2d41fee3c86441ff96c08c7d474f9326e992b9164b9a3f13627f7d24d0c485
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 51d0fa6537b6400e23696eae105425367c6a8039e1cc1c0b9cfa8c597dd81925
MD5 9673a283dabd84b0f93d50b95e908c6f
SHA1 2dfd0e0c099557e08e68ace9ff787d748824b941
SHA512 87cb91284122468ecf4286d54c6b647c7f9cfb8859c9289090e833047f3b14b498d6fc99f4f045d6bf9783bf3f4af3ec4b55e39db36ba16e5e6b107af96fbbf8
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 521B
SHA256 a8aa4707f092ca348d678694abe9dd4bf1b4b7a70db8e210061e93e9d33fb291
MD5 b827a333a2ba7a8ba186d6e40b30745b
SHA1 8bef82dfdb2a2c587641294c3dca642da3958f62
SHA512 0b473d801d940fcbf26e1b1b5ad2666b9818337ce3c6bafa2aab7a46601b7272c7806cd259474a7c4b2e61482add339639ed31b327fa3043d8a66328b3f209cf
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 57801af0b5d5a1e0936b83eb12116cbae2f422ef215ca8e4298d1c2fe5ea946c
MD5 a5e7d2f102fa5a74841a0f0fd2698a4d
SHA1 b8b7b1b203b6890d31787a827bcb2c8437fe6117
SHA512 de4f8f18262126a8fdb0635431d7fd39afbdf69105bc009956577629dee80c10868e905730db3e80ff5ae21f82810223113bf87afce89b69c52222a347bba8ae
SSDEEP 96:n5k3xm/vQYmq/1pcJbwpvWMoiVmdeHhAeQUWQyV+VDCziEwb:n5kckoqbGWMX6fro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e9f098f5e50fa8a2af3feb70556f3300e6d2e4e7ea6d484d17f0ec292bbb76a3
MD5 f2fd171e2b3ba9ca9d7213ae5a2354f1
SHA1 c8d789c6c17c202cd93e77fd27a90c3f44e7d878
SHA512 90f22698cfa2a09298f9c348d675389d66c7667dc38af0d5cff122b0b00b6981b1cef9170fc0faf91694e556305f929c3954940608c67395fea51771d3eff944
SSDEEP 96:n5k3xm/vnmq/1pcJbwpvWMoivR5mde/uk1jhAqQUWQyV+VD7AiEwb:n5kcWoqbGWMvBukh67rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 e7a4c1a6c67cf0c995d6046ccb8327d7279bb20a4c386603a94637f2691667e7
MD5 f5e43b787e40a33bcb743a4a1cd18211
SHA1 8865a7fcbf2ac381e00c3acb764d835228e64e52
SHA512 a090352475a50a3e576bd935b6e68cd2f6c99fcbb14af659f5e931c7d4b63dfe4516f4bbe077f41c4cf48be5de75db2cea0eada2688e79c80bf86a8af2dea628
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup40wje9le2RUIyrXfTKGryf:A9iIxuERzA83h09RZxY40wjASrKze+Jz
MD5 SHA1 SHA512 SSDEEP

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download