hxxps://ibf[.]tw/7pynn

Analysis

max time kernel
145s
max time network
140s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
05/08/2024, 18:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ibf.tw/7pynn
Sample240805-wrlwastepp

Score

5^/10

steam discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand steam.
phishing steam
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe
3004	msedge.exe
3004	msedge.exe
556	identity_helper.exe
556	identity_helper.exe
1212	msedge.exe
1212	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 784	3004	msedge.exe	80
PID 3004 wrote to memory of 784	3004	msedge.exe	80
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4100	3004	msedge.exe	83
PID 3004 wrote to memory of 4136	3004	msedge.exe	84
PID 3004 wrote to memory of 4136	3004	msedge.exe	84
PID 3004 wrote to memory of 4944	3004	msedge.exe	85
PID 3004 wrote to memory of 4944	3004	msedge.exe	85
PID 3004 wrote to memory of 4944	3004	msedge.exe	85
PID 3004 wrote to memory of 4944	3004	msedge.exe	85
PID 3004 wrote to memory of 4944	3004	msedge.exe	85
PID 3004 wrote to memory of 4944	3004	msedge.exe	85
PID 3004 wrote to memory of 4944	3004	msedge.exe	85
PID 3004 wrote to memory of 4944	3004	msedge.exe	85
PID 3004 wrote to memory of 4944	3004	msedge.exe	85
PID 3004 wrote to memory of 4944	3004	msedge.exe	85
PID 3004 wrote to memory of 4944	3004	msedge.exe	85
PID 3004 wrote to memory of 4944	3004	msedge.exe	85
PID 3004 wrote to memory of 4944	3004	msedge.exe	85
PID 3004 wrote to memory of 4944	3004	msedge.exe	85
PID 3004 wrote to memory of 4944	3004	msedge.exe	85
PID 3004 wrote to memory of 4944	3004	msedge.exe	85
PID 3004 wrote to memory of 4944	3004	msedge.exe	85
PID 3004 wrote to memory of 4944	3004	msedge.exe	85
PID 3004 wrote to memory of 4944	3004	msedge.exe	85
PID 3004 wrote to memory of 4944	3004	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ibf.tw/7pynn
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xc0,0x10c,0x7ffbe96c3cb8,0x7ffbe96c3cc8,0x7ffbe96c3cd8
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,2093820431408711435,14790513524957609685,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,2093820431408711435,14790513524957609685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,2093820431408711435,14790513524957609685,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2093820431408711435,14790513524957609685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2093820431408711435,14790513524957609685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2093820431408711435,14790513524957609685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2093820431408711435,14790513524957609685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,2093820431408711435,14790513524957609685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2093820431408711435,14790513524957609685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4508 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2093820431408711435,14790513524957609685,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4504 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,2093820431408711435,14790513524957609685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2093820431408711435,14790513524957609685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,2093820431408711435,14790513524957609685,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,2093820431408711435,14790513524957609685,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1668 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 fee5f7377e5ca213c1d8d7827b788723d0dd2538e7ce3f35581fc613fde834c2
MD5 3e681bda746d695b173a54033103efa8
SHA1 ae07be487e65914bb068174b99660fb8deb11a1d
SHA512 0f4381c769d4ae18ff3ac93fd97e8d879043b8ec825611db27f08bd44c08babc1710672c3f93435a61e40db1ccbf5b74c6363aaaf5f4a7fc95a6a7786d1aced8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a7645e1b16115e9afec86efa139d35d5fecc6c5c7c59174c9901b4213b1fae0e
MD5 9f081a02d8bbd5d800828ed8c769f5d9
SHA1 978d807096b7e7a4962a001b7bba6b2e77ce419a
SHA512 7f3045f276f5bd8d3c65a23592419c3b98f1311c214c8e54a4dfe09122a08afb08ab7967b49bd413bc748ce6363658640bc87958d5e0a78974680a8f9beadf44
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 432B
SHA256 5869014b3867c89c68c0342c33a72a1731d49c56ae563043ec6d6298aa52d02d
MD5 0f7f8c8d97122d3e54b5e83090db1517
SHA1 0e229406d575f0fceb62cb81c46db104f5d94282
SHA512 3d55b1691a88ae28cbfcfc5b384a0db8539cc371198582b9fdc15c75dda74baef80c4219088db9b442e8e6e620a325b0d35097f5589dc7c78e584dca7f21db26
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 541B
SHA256 5ed7c2212d422f83ff8a739ca2ce2d3254ffaa8e8e3a87952134ffb22dcfaa65
MD5 1eced1e12a5e0f74b00372878348e59e
SHA1 4f6ba587a246a7e4d5b007ce8d27caa28bad5396
SHA512 df85da25cd7a5c93db6a6d55407fa62d76000718c8e8f6f4752e34d0873a258abf09211748dc518823a02253cf2026b91b5f6bdc1e48246f281ba7156b989fd5
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 a4ab78c7349cd0e706bda78a8f3a3683f27efdf62573774bf1c814850b64db0f
MD5 2c005acfc21e50686788315543041875
SHA1 bfc886672e21164b03e8c5a28047d8736dd72110
SHA512 d8479d5f1a82fed971abd6264d8bc1e3571ec3f69f68c0013d29035e38c23ef9df2ec37d822a34677ee04f8a3407b6d1b3f160d88c474ef5d471a7159e7e6c0d
SSDEEP 96:nek3tfyqL9+kZQmwSv0MoiVmdHIEJt0WQyV+VuziX3wI3:nek3t6wEkRv0MAICtLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d4dbb2f1e8d744d16b5a00d61249a407f1fc092f92563a8aee731e9112aa49e7
MD5 c41084215d955837da7bf8d68b25dfc0
SHA1 fcd72f273d63d4bc2eb2faa22e7272b3a8e57462
SHA512 a78e0320ff7f99acfbf26740266f7f6feeeb0e8363805d4140087206eac31d8a2e25fd52a63236b384d6a973be4ecdb55b68955e627992d375f5bda29d430ef2
SSDEEP 96:nek3tUyqL9+kZ+mwSv0Moi0DQR5mdcDTuT1jIxJt0WQyV+VpAiX3wI3:nek3tdwEkvv0M08tnuThITtLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ded8975fe0bf8daedb1e9edbf0e9c27221699c9e39eb931449408a7c2c9f0140
MD5 9705489d8e7789226f1c0139b9754717
SHA1 eda41d6498c3b40af658307043091f11cf6a8489
SHA512 e1441ece6c0ebf81724fdfb3b66fccdcd231a8737baa4ebf2feb8b1ec16d5885ec61599a4ec237c80510bd6acb0117ece4cb244e1f8f5d5be87f750f2e984674
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGjye2RUe0/RtXRMpWQQHO0h0j:M9iIxuERzA83h09RZxASGID0rXRMpWQr
MD5 SHA1 SHA512 SSDEEP

Submit Download