hxxps://itorrents-igruha[.]org/2368-raft[.]html

Analysis

max time kernel
480s
max time network
592s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 17:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://itorrents-igruha.org/2368-raft.html

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
3572	msedge.exe
3572	msedge.exe
3388	identity_helper.exe
3388	identity_helper.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 1124	3572	msedge.exe	82
PID 3572 wrote to memory of 1124	3572	msedge.exe	82
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 2992	3572	msedge.exe	84
PID 3572 wrote to memory of 5012	3572	msedge.exe	85
PID 3572 wrote to memory of 5012	3572	msedge.exe	85
PID 3572 wrote to memory of 4572	3572	msedge.exe	86
PID 3572 wrote to memory of 4572	3572	msedge.exe	86
PID 3572 wrote to memory of 4572	3572	msedge.exe	86
PID 3572 wrote to memory of 4572	3572	msedge.exe	86
PID 3572 wrote to memory of 4572	3572	msedge.exe	86
PID 3572 wrote to memory of 4572	3572	msedge.exe	86
PID 3572 wrote to memory of 4572	3572	msedge.exe	86
PID 3572 wrote to memory of 4572	3572	msedge.exe	86
PID 3572 wrote to memory of 4572	3572	msedge.exe	86
PID 3572 wrote to memory of 4572	3572	msedge.exe	86
PID 3572 wrote to memory of 4572	3572	msedge.exe	86
PID 3572 wrote to memory of 4572	3572	msedge.exe	86
PID 3572 wrote to memory of 4572	3572	msedge.exe	86
PID 3572 wrote to memory of 4572	3572	msedge.exe	86
PID 3572 wrote to memory of 4572	3572	msedge.exe	86
PID 3572 wrote to memory of 4572	3572	msedge.exe	86
PID 3572 wrote to memory of 4572	3572	msedge.exe	86
PID 3572 wrote to memory of 4572	3572	msedge.exe	86
PID 3572 wrote to memory of 4572	3572	msedge.exe	86
PID 3572 wrote to memory of 4572	3572	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://itorrents-igruha.org/2368-raft.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8adb46f8,0x7ffd8adb4708,0x7ffd8adb4718
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,5879904166710332766,5494935978540079591,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,5879904166710332766,5494935978540079591,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,5879904166710332766,5494935978540079591,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,5879904166710332766,5494935978540079591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,5879904166710332766,5494935978540079591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,5879904166710332766,5494935978540079591,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,5879904166710332766,5494935978540079591,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,5879904166710332766,5494935978540079591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,5879904166710332766,5494935978540079591,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,5879904166710332766,5494935978540079591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,5879904166710332766,5494935978540079591,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,5879904166710332766,5494935978540079591,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1484 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
86535cf4fd86dae9aa6dd11ec606f99b

SHA1
6eeaf85173388c4d1f8c499ce57a38f14595396f

SHA256
8d4ce4798e8ecb4ee485260ca2accb4f70750156fa98724d68209dbe374b4834

SHA512
41b99285ef96f320864b4e0914d42a51a1265466350ea9c0e92234c69587e09f0a088d852cba307e8c7e4936814771d5c8eba653e75a50d0964f4d4acb8da62b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
716B

MD5
e74ee9d212efcbe48cc5443047b6a942

SHA1
2d6e528d3d74f329ec959a4db453b26b3a8dd03a

SHA256
61b36a82fc1f9e1c971c81707b60b356ca45a0229b9fd48be1d1a77a976725ec

SHA512
c00236cc7f382458a4369867973b70d880901a594810c8841e45537b75e661521ed702c0c34c76e89d114eef18df08ca332dacffad1c952c36b5406a745114de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
80e31653bc6dd9adef724586b05c6e4b

SHA1
f3609d3f9aa6639d42c0cb0f06b6be427827e516

SHA256
48efc9dc541512d919c41f7b72ad8d5d2615ed50efeae2cedf50dbc24b55ec4b

SHA512
99c41054276ddb107b94d5832c9d1d0c4f1b345754a88aac311c25d14f7c1d3be29f617a211c33ba07badb74ecd12528c12e81eb655e96d2e89d363e9d6e7579

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9692b0e1efda09f930d2fd9af30475df

SHA1
6a6fede9f89aa7956138685a38794ee986483ad9

SHA256
ec544eab2611dfe13be24b96c1ace142bf025c0dfcca2ea2f82b432595cdbdaa

SHA512
08d9d01eba0c02e3a2aa1aac51c547ff4a0d44724752890201d505c88821dbaefbda9f5c6eeab2c7a256068f8ab64f29b334625073964358f9d15ed9fbd91229

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
421d3d30afde2824d8090fe0f16787a4

SHA1
6a8c4b75432b9ba85902634f6409550cf7c9b195

SHA256
6f9854373f76302b224b82c41b54eb57af8cb7da0ca8dad4511d452333b6bc66

SHA512
48a366ece12bc2fc718817606c3ed1065927c73c402e00cacba2a49f4341a4c4990ea4049fa9022d1bfe7bf511ecc959b5692df6982da437aee1aa8f73121ed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5805e7.TMP

Filesize
539B

MD5
d542209f9aa49062e4c7faaa36b08726

SHA1
b09e76edddfa215da04bb64f5c760281b5a36691

SHA256
0856524ba72ded2e9d59c49d612cccaec21bdca189495a2fb4ac44cb696f588d

SHA512
e04166ad8bc04402917a004ad1b1fb2f1d02295bc4dc4e201b2cc927add45d37dbedb690a0f5fac85847d3b7e77be73f73faa9d7e4f60f708dbcd022462ea316

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
76d447e095e561f1b125baa2adce1734

SHA1
3d02372a2b8519bb068fe0315806bbec15980374

SHA256
0f1d6ab1435cd83bac81e025c851f1bd81527d5815b22a9e517f8b041b1d7456

SHA512
eda7dd01fe131c08fea673e4eba379017fbd355fc3bf7166188825f64c544dba05af6f9a9a7e54ffb06f189badb6ac4be5fc05d05e950ed73a4109d06dbf1db3

Download Submit