hxxps://wuw[.]youdaowdq[.]icu

Analysis

max time kernel
150s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
23/07/2024, 07:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://wuw.youdaowdq.icu

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
976	msedge.exe
976	msedge.exe
2768	msedge.exe
2768	msedge.exe
1876	msedge.exe
1876	msedge.exe
2384	identity_helper.exe
2384	identity_helper.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2964	2768	msedge.exe	81
PID 2768 wrote to memory of 2964	2768	msedge.exe	81
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 1104	2768	msedge.exe	82
PID 2768 wrote to memory of 976	2768	msedge.exe	83
PID 2768 wrote to memory of 976	2768	msedge.exe	83
PID 2768 wrote to memory of 3436	2768	msedge.exe	84
PID 2768 wrote to memory of 3436	2768	msedge.exe	84
PID 2768 wrote to memory of 3436	2768	msedge.exe	84
PID 2768 wrote to memory of 3436	2768	msedge.exe	84
PID 2768 wrote to memory of 3436	2768	msedge.exe	84
PID 2768 wrote to memory of 3436	2768	msedge.exe	84
PID 2768 wrote to memory of 3436	2768	msedge.exe	84
PID 2768 wrote to memory of 3436	2768	msedge.exe	84
PID 2768 wrote to memory of 3436	2768	msedge.exe	84
PID 2768 wrote to memory of 3436	2768	msedge.exe	84
PID 2768 wrote to memory of 3436	2768	msedge.exe	84
PID 2768 wrote to memory of 3436	2768	msedge.exe	84
PID 2768 wrote to memory of 3436	2768	msedge.exe	84
PID 2768 wrote to memory of 3436	2768	msedge.exe	84
PID 2768 wrote to memory of 3436	2768	msedge.exe	84
PID 2768 wrote to memory of 3436	2768	msedge.exe	84
PID 2768 wrote to memory of 3436	2768	msedge.exe	84
PID 2768 wrote to memory of 3436	2768	msedge.exe	84
PID 2768 wrote to memory of 3436	2768	msedge.exe	84
PID 2768 wrote to memory of 3436	2768	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://wuw.youdaowdq.icu
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff25fd3cb8,0x7fff25fd3cc8,0x7fff25fd3cd8
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,1600254492420728975,4605684144614711645,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,1600254492420728975,4605684144614711645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,1600254492420728975,4605684144614711645,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1600254492420728975,4605684144614711645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1600254492420728975,4605684144614711645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2052,1600254492420728975,4605684144614711645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1600254492420728975,4605684144614711645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1600254492420728975,4605684144614711645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1600254492420728975,4605684144614711645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1600254492420728975,4605684144614711645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,1600254492420728975,4605684144614711645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1600254492420728975,4605684144614711645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7900 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,1600254492420728975,4605684144614711645,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7984 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c0f062e1807aca2379b4e5a1e7ffbda8

SHA1
076c2f58dfb70eefb6800df6398b7bf34771c82d

SHA256
f80debea5c7924a92b923901cd2f2355086fe0ce4be21e575d3d130cd05957ca

SHA512
24ae4ec0c734ef1e1227a25b8d8c4262b583de1101f2c9b336ac67d0ce9b3de08f2b5d44b0b2da5396860034ff02d401ad739261200ae032daa4f5085c6d669e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6f3725d32588dca62fb31e116345b5eb

SHA1
0229732ae5923f45de70e234bae88023521a9611

SHA256
b81d7e414b2b2d039d3901709a7b8d2f2f27133833ecf80488ba16991ce81140

SHA512
31bacf4f376c5bad364889a16f8ac61e5881c8e45b610cc0c21aa88453644524525fd4ccf85a87f73c0565c072af857e33acffbbca952df92fedddd21f169325

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
cdd719d067d9c2b7623d6638ad826323

SHA1
5542f9b4b6eca6c0ccc0c7f2ea2b0c1e8fd42b38

SHA256
2177fe753557617d966584a88defe417d92040b640359719e330d7283e5da585

SHA512
76e77b200a9fb93834785c719cd1fbabb0c1166580374872bf34d6cd29b0ea29445aa943beec67ee9d1c6deed77651f6d8f0e08160e0adbc70bc8992e9d0d1df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
423B

MD5
b0566017faa82df4f8857fca124ceea4

SHA1
67923f59fd4b556a948cc2569691667c994968fc

SHA256
dd48f1c64a103a22bbd7cd986c670dbd877a520cdbe6c43e9f4647bdc1d15e5d

SHA512
924e9636990ba881e53254bc4deff1d77cf3a53bb171f87d3b5f10c24091dd6a59a2f9332278c431c027ad1e13a6de871115e6e95dd32e66604443af9d233d02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
22f816ffde747deba9c150565b2d01ac

SHA1
07af610262fd3c6947993c8be62243c7265e7eae

SHA256
58bc112596ce4e3877e7ac7a1ff0adafadc9e07632eb20edbb377c9967ffb924

SHA512
18fcf1bfccec5f3b84457f0d2fd6843d3bf43753b2f5c215978ee59e52d62ef1ccfce87483076486e0167e09b4def6f398b9d43df2373e5fde992e50895757dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c3f278b1-2082-40a4-ba67-f002f6674f20.tmp

Filesize
5KB

MD5
971282e935edb30805903401d761d34f

SHA1
e8b1631623ee4a7679fd2174652dd0221ed35562

SHA256
7aeb4133c2606fab89703fde69b154641131cb3d1579698891923d22f4ca6dc1

SHA512
c680e71433784e47b2daf8ffba14199770577f5a71f8fbccab8a953fa944684604990428fa488c913420d6c926d9e08bdae775588999b0333663cbfaa952c5b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4eada8e7821ea107d3ab8dea0b1f2d1a

SHA1
4efe1ac72d7faf88fed6a6423cfc3d819cb50bd3

SHA256
368eddfdcda20e27fe8ea8e665e6f6f718cdb6088d9e4fd6d5e86efc410d3791

SHA512
fee62a79b6c955bed8a99242233453f1aba7c565f87b6235d69e1eec16f1d2cdda4b78db7f09f82f27cbde9e9ba8baf77870e9eec68ff950ba17913d36e63ae3

Download Submit