hxxps://singletemp-my[.]sharepoint[.]com/personal/j_karasewicz_single-temp_pl/Documents/Forms/All[.]aspx

Analysis

max time kernel
141s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 06:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://singletemp-my.sharepoint.com/personal/j_karasewicz_single-temp_pl/Documents/Forms/All.aspx

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1764	msedge.exe
1764	msedge.exe
2252	msedge.exe
2252	msedge.exe
1860	identity_helper.exe
1860	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 1644	2252	msedge.exe	84
PID 2252 wrote to memory of 1644	2252	msedge.exe	84
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1752	2252	msedge.exe	85
PID 2252 wrote to memory of 1764	2252	msedge.exe	86
PID 2252 wrote to memory of 1764	2252	msedge.exe	86
PID 2252 wrote to memory of 3644	2252	msedge.exe	87
PID 2252 wrote to memory of 3644	2252	msedge.exe	87
PID 2252 wrote to memory of 3644	2252	msedge.exe	87
PID 2252 wrote to memory of 3644	2252	msedge.exe	87
PID 2252 wrote to memory of 3644	2252	msedge.exe	87
PID 2252 wrote to memory of 3644	2252	msedge.exe	87
PID 2252 wrote to memory of 3644	2252	msedge.exe	87
PID 2252 wrote to memory of 3644	2252	msedge.exe	87
PID 2252 wrote to memory of 3644	2252	msedge.exe	87
PID 2252 wrote to memory of 3644	2252	msedge.exe	87
PID 2252 wrote to memory of 3644	2252	msedge.exe	87
PID 2252 wrote to memory of 3644	2252	msedge.exe	87
PID 2252 wrote to memory of 3644	2252	msedge.exe	87
PID 2252 wrote to memory of 3644	2252	msedge.exe	87
PID 2252 wrote to memory of 3644	2252	msedge.exe	87
PID 2252 wrote to memory of 3644	2252	msedge.exe	87
PID 2252 wrote to memory of 3644	2252	msedge.exe	87
PID 2252 wrote to memory of 3644	2252	msedge.exe	87
PID 2252 wrote to memory of 3644	2252	msedge.exe	87
PID 2252 wrote to memory of 3644	2252	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://singletemp-my.sharepoint.com/personal/j_karasewicz_single-temp_pl/Documents/Forms/All.aspx
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8461446f8,0x7ff846144708,0x7ff846144718
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,17353047449817579135,7254677446915221755,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,17353047449817579135,7254677446915221755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,17353047449817579135,7254677446915221755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,17353047449817579135,7254677446915221755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,17353047449817579135,7254677446915221755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,17353047449817579135,7254677446915221755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,17353047449817579135,7254677446915221755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,17353047449817579135,7254677446915221755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,17353047449817579135,7254677446915221755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,17353047449817579135,7254677446915221755,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,17353047449817579135,7254677446915221755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,17353047449817579135,7254677446915221755,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:2512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6c86c838cf1dc704d2be375f04e1e6c6

SHA1
ad2911a13a3addc86cc46d4329b2b1621cbe7e35

SHA256
dff0886331bb45ec7711af92ab10be76291fde729dff23ca3270c86fb6e606bb

SHA512
a120248263919c687f09615fed56c7cac825c8c93c104488632cebc1abfa338c39ebdc191e5f0c45ff30f054f08d4c02d12b013de6322490197606ce0c0b4f37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27f3335bf37563e4537db3624ee378da

SHA1
57543abc3d97c2a2b251b446820894f4b0111aeb

SHA256
494425284ba12ee2fb07890e268be7890b258e1b1e5ecfa4a4dbc3411ab93b1a

SHA512
2bef861f9d2d916272f6014110fdee84afced515710c9d69b3c310f6bf41728d1b2d41fee3c86441ff96c08c7d474f9326e992b9164b9a3f13627f7d24d0c485

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
202877a1c262aceea73dfcc4e449f1bf

SHA1
3efba59337e70dbc06c7306cb5d28ceb4eb52db2

SHA256
d95c82613facba8eaa043dd80e9d49076086dcdb776ba9369eadb0965fe7a70a

SHA512
0e303f13f67a1e0f4bb27cc45c320de304f5e2391e33ad8815a3ff0e68f91415a31490341b67fb6d24700351d55577ffb69fb07af4752e16d44ffc7e013153b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
356B

MD5
7dd2efd66ba0965f283b5820e8c80152

SHA1
7ceef91b9506e853dd5017b9ac8e31f060b41bb6

SHA256
922514c4c4e29e1e422f5a94dac6d7fb3816491e9a519b2c4a7ed767c18097ae

SHA512
422707c0697dcf5349a0d25d1b74ac511c76c9528960e2f745dcf26327d2217b59db93982b2388151f6733826850e810db46f7b92dca1ae55709261c1eb01095

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b75fb7fd453abcc1e98c16129aae7018

SHA1
8d2f64f0234518c00ad676a3dad16b1dcb323bf8

SHA256
b05d406ae6fa0c87300d10a80001102931cdb490bb78948a827bbd84353d71f8

SHA512
2b68e9ab9cd642f1edd09b91e561ad51013aba3d522758cb2f0e2a7da71eadccce560753df6fd3730b4003bfb6577425e50f1d8c12f793d48266e43e3bdb7b0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d085e380de9bf407b2baec9b5f6564ef

SHA1
7234e8187865390714948659663caa82b9ca07a8

SHA256
b9505e75b7b312ff071378090b2f9b58984b2674bc0bb210bcbe4299d259d685

SHA512
08ffc05ddf941201f6c37ee275e071ec336cee1f7d59793fd246cd4984aac5e1b866b29d32a14cefbba68a2fc9dbc2cac2c6910466b1df0e4c70b1809339ced1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2d463d02825574785e9e0559c772bab5

SHA1
add48aa773fc5ac29241a0a07be0d6dbd3db207d

SHA256
730f09fa6edba0d62eab7cab3426983193bfb3119faa5b279bf76218d1890c41

SHA512
581791a0c9b6b28aa0c87a0adc4d09916d6b8174648e81d86bb92d2260dc1291db039d3455b952043e2230c29d9127ae6763f37efdb99755cbb186970b613f2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f08f56add4f02bbd6078f9f329a5a910

SHA1
c6e78c2561c299d729127be94562d429f65c53b2

SHA256
b4af285d4bf52b2ebf0b94924c762c4549c6c9ab9a55109de43568005deca537

SHA512
f39a8b63fc1a5719664e31888f34226d41939c46b84f18f2f5c05642ff1a413491612b01b55e7db7cd95a48475ad1a214e6293ec9436157cced982a2b5fd8801

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3c3d3bc5a4537d0c62b79751757d925c

SHA1
339e9bb4c209cb1da70b5529f75cb010c092d2e5

SHA256
6148c41312cf8a65a417021f201b4d5ee097d1c1fe4b0d05140c4599d8d274a8

SHA512
669e59703868cb4055a321c566e95e5796ed2fe5ca4aba2cbaf9b2b513e6e495464a73841d732cc2740747a5100a5bf5ba20433181fda3249087208afdbeb560

Download Submit