hxxps://my[.]optikservers[.]com/join/dYa2otKBl1bQSgwn

Resubmissions

08/08/2024, 18:10

240808-wsd7va1alb 10

08/08/2024, 18:09

240808-wrsc3s1aka 3

08/08/2024, 18:08

240808-wrbqbsxakp 3

Analysis

max time kernel
33s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2024, 18:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://my.optikservers.com/join/dYa2otKBl1bQSgwn

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
1804	msedge.exe
1804	msedge.exe
4356	identity_helper.exe
4356	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 4056	1804	msedge.exe	84
PID 1804 wrote to memory of 4056	1804	msedge.exe	84
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4928	1804	msedge.exe	85
PID 1804 wrote to memory of 4788	1804	msedge.exe	86
PID 1804 wrote to memory of 4788	1804	msedge.exe	86
PID 1804 wrote to memory of 5040	1804	msedge.exe	87
PID 1804 wrote to memory of 5040	1804	msedge.exe	87
PID 1804 wrote to memory of 5040	1804	msedge.exe	87
PID 1804 wrote to memory of 5040	1804	msedge.exe	87
PID 1804 wrote to memory of 5040	1804	msedge.exe	87
PID 1804 wrote to memory of 5040	1804	msedge.exe	87
PID 1804 wrote to memory of 5040	1804	msedge.exe	87
PID 1804 wrote to memory of 5040	1804	msedge.exe	87
PID 1804 wrote to memory of 5040	1804	msedge.exe	87
PID 1804 wrote to memory of 5040	1804	msedge.exe	87
PID 1804 wrote to memory of 5040	1804	msedge.exe	87
PID 1804 wrote to memory of 5040	1804	msedge.exe	87
PID 1804 wrote to memory of 5040	1804	msedge.exe	87
PID 1804 wrote to memory of 5040	1804	msedge.exe	87
PID 1804 wrote to memory of 5040	1804	msedge.exe	87
PID 1804 wrote to memory of 5040	1804	msedge.exe	87
PID 1804 wrote to memory of 5040	1804	msedge.exe	87
PID 1804 wrote to memory of 5040	1804	msedge.exe	87
PID 1804 wrote to memory of 5040	1804	msedge.exe	87
PID 1804 wrote to memory of 5040	1804	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://my.optikservers.com/join/dYa2otKBl1bQSgwn
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8ef146f8,0x7ffd8ef14708,0x7ffd8ef14718
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,2301194320294492532,1561759561709023461,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,2301194320294492532,1561759561709023461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,2301194320294492532,1561759561709023461,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,2301194320294492532,1561759561709023461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,2301194320294492532,1561759561709023461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,2301194320294492532,1561759561709023461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,2301194320294492532,1561759561709023461,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,2301194320294492532,1561759561709023461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,2301194320294492532,1561759561709023461,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,2301194320294492532,1561759561709023461,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,2301194320294492532,1561759561709023461,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:1944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
e339c116b4c3b92c944d562fd6f07cd7

SHA1
f2b6873a038bd4a6ffcb2fba10787ad8abc6e6b0

SHA256
39e4c1f233a3f37419c05466457e398f6666b249762605db87fd27d28c8dd8c8

SHA512
2d030bbb3be5b84d97e0b3d6218b4250887e8c18e8c85d8e1820bfefde556c500c7ba4521dbdb0bfb78223c87babe4dd7f8e588b4ac168431b05b86a894be0ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c13ab7335ccdc1d9f5ceede4374982e9

SHA1
fa9efa40ae205fb704c2874eeb871902933053e7

SHA256
8d712d9536b08a921b7fada05042ed942d3ac0024b2be514c86da61584c7e278

SHA512
d9ebab5231f431cd04e28a8a4b45fdaa9a05dc3ac2fd0e71ed3845c4e75bc713055abc1db565e515758d27a39ae03f5bc008570885697e8112dea5c192879c4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8a8bd2265bd92492691e3f30eb80f34c

SHA1
45c2ae21fee1ab474ce26f8a98837d6d97c0b586

SHA256
88a1f712587b0b42343415a3ccc70e6caae67ce72b906703c40e7353dfd47ecf

SHA512
93e7131205d63f904eddfafc2abebab110f7e477ae7ba3d8fb0d98bf5ca84f65d1ea3d8943563f1b773d99e25127fc07bd3856721efbe5aa66407a8d7a822097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c0b39a01bbf0996a0a45dfe9f548079b

SHA1
3dfda0a17b19a9443eacc4e8e099db5f419b5b53

SHA256
397a381d4ecc73b4a0e646c3c4879d5542a9a1e69557dd8598c398c3df95a4fa

SHA512
a01af8e7a0ec1f84e4119308fcbe0be4c33860bf452ce389585c0673c0e9b6b59fc1f7a5f232b66403376867ebcb3706e1cff768c38bb2c534cd5fae5b938372

Download Submit