hxxps://getscreen[.]me/

Analysis

max time kernel
298s
max time network
280s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
23-07-2024 16:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://getscreen.me/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
948	msedge.exe
948	msedge.exe
1084	msedge.exe
1084	msedge.exe
2168	msedge.exe
2168	msedge.exe
1564	identity_helper.exe
1564	identity_helper.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 1908	1084	msedge.exe	81
PID 1084 wrote to memory of 1908	1084	msedge.exe	81
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 2948	1084	msedge.exe	82
PID 1084 wrote to memory of 948	1084	msedge.exe	83
PID 1084 wrote to memory of 948	1084	msedge.exe	83
PID 1084 wrote to memory of 2812	1084	msedge.exe	84
PID 1084 wrote to memory of 2812	1084	msedge.exe	84
PID 1084 wrote to memory of 2812	1084	msedge.exe	84
PID 1084 wrote to memory of 2812	1084	msedge.exe	84
PID 1084 wrote to memory of 2812	1084	msedge.exe	84
PID 1084 wrote to memory of 2812	1084	msedge.exe	84
PID 1084 wrote to memory of 2812	1084	msedge.exe	84
PID 1084 wrote to memory of 2812	1084	msedge.exe	84
PID 1084 wrote to memory of 2812	1084	msedge.exe	84
PID 1084 wrote to memory of 2812	1084	msedge.exe	84
PID 1084 wrote to memory of 2812	1084	msedge.exe	84
PID 1084 wrote to memory of 2812	1084	msedge.exe	84
PID 1084 wrote to memory of 2812	1084	msedge.exe	84
PID 1084 wrote to memory of 2812	1084	msedge.exe	84
PID 1084 wrote to memory of 2812	1084	msedge.exe	84
PID 1084 wrote to memory of 2812	1084	msedge.exe	84
PID 1084 wrote to memory of 2812	1084	msedge.exe	84
PID 1084 wrote to memory of 2812	1084	msedge.exe	84
PID 1084 wrote to memory of 2812	1084	msedge.exe	84
PID 1084 wrote to memory of 2812	1084	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://getscreen.me/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ffd21813cb8,0x7ffd21813cc8,0x7ffd21813cd8
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,10414762293835160582,699804775313220344,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1944,10414762293835160582,699804775313220344,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1944,10414762293835160582,699804775313220344,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,10414762293835160582,699804775313220344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,10414762293835160582,699804775313220344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1944,10414762293835160582,699804775313220344,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,10414762293835160582,699804775313220344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,10414762293835160582,699804775313220344,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,10414762293835160582,699804775313220344,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,10414762293835160582,699804775313220344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,10414762293835160582,699804775313220344,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,10414762293835160582,699804775313220344,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4680 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c0f062e1807aca2379b4e5a1e7ffbda8

SHA1
076c2f58dfb70eefb6800df6398b7bf34771c82d

SHA256
f80debea5c7924a92b923901cd2f2355086fe0ce4be21e575d3d130cd05957ca

SHA512
24ae4ec0c734ef1e1227a25b8d8c4262b583de1101f2c9b336ac67d0ce9b3de08f2b5d44b0b2da5396860034ff02d401ad739261200ae032daa4f5085c6d669e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6f3725d32588dca62fb31e116345b5eb

SHA1
0229732ae5923f45de70e234bae88023521a9611

SHA256
b81d7e414b2b2d039d3901709a7b8d2f2f27133833ecf80488ba16991ce81140

SHA512
31bacf4f376c5bad364889a16f8ac61e5881c8e45b610cc0c21aa88453644524525fd4ccf85a87f73c0565c072af857e33acffbbca952df92fedddd21f169325

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
fa26a301a2991748539e29685699f172

SHA1
15d2d4ceefec9bda37f7b8a0230d25be6c79e414

SHA256
d0ed88451fa2bc0c8d1e763fd362d5ea4ec6847ce0ea85600cfad56c06d56549

SHA512
35fb115f976856489a1301cd61550398c8b68905378ce095ab4a9fadf49f18435fe5dbc9f17b666d26bca82fee9e0aa58245760c6c02074e16fe46a75d8c82b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
737B

MD5
e4df579f4b582e3b1e68674180b56664

SHA1
a26c4ce7bff1b19fad7708df8545b32157edd2f0

SHA256
6f9a58f3cd12334d8ceca9f38770b2764ba035dc9ada24e66c78197de36d29c0

SHA512
2906c88f79e36efb9f4675045ca023894a49124957da98053da6e531c63d07ed9d3e6f699fa5e7f6c7aa2bdf2ebaa7a4ae1baedf2da0b91257bec370ed9d6d95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
26035b1804034dc6853ee5f0e1f91b95

SHA1
e98fa8effb9941f72629d86c06439871c0bedfa2

SHA256
dc92b4b5fdb78ac26bc760265ccc44de348711c3405899f0957c44a25e11a425

SHA512
1825aefe5969a46790bffa1490cb234fa8f5f3dd56884116a6f9a8d3d73e9dd40156bbeacdc4b1271ea20a5cf8b7fe0524e23757b8abdd644ad3629171a42219

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
92480d11de08306d27aad22b5bb7ac32

SHA1
8811733b91ef4b94c16cef439693f504f5926eac

SHA256
6006346d176a1c986e629ae226b63ee6cd507d887d3d5b6f68dd4c249dce8dde

SHA512
941b3d989917d23dd2276d962eaca79d936750d6495dcae2efc95341a9fd70ad05fc48dc7e42bc2419049b67a8e83fa14d37bce8e95630a40fa3b380c53abddb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
32ded9d9196d8e3e622ae921208e6789

SHA1
1adbe21fbfdd2089f133ac7b37b8dfbc42a87c23

SHA256
4137e9c13c0ab2c258966010633391c5a0f884557e7f71cb23368f412858e1c4

SHA512
6de1b9416aad44ffba734720752af4a3a3618b9b3492da4ac8134c87b124ea40000c61a36f9ccbc7b134ce78497615dc490091f86a00e99e4d5ec077f081af0e

Download Submit