Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
12-08-2024 07:34
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://kepler.copernicusgroup.es/ExpensesProposals/Edit/108491
Resource
win11-20240802-en
General
-
Target
https://kepler.copernicusgroup.es/ExpensesProposals/Edit/108491
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3084 msedge.exe 3084 msedge.exe 5808 msedge.exe 5808 msedge.exe 2604 identity_helper.exe 2604 identity_helper.exe 1276 msedge.exe 1276 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe 5808 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5808 wrote to memory of 5940 5808 msedge.exe 80 PID 5808 wrote to memory of 5940 5808 msedge.exe 80 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3924 5808 msedge.exe 82 PID 5808 wrote to memory of 3084 5808 msedge.exe 83 PID 5808 wrote to memory of 3084 5808 msedge.exe 83 PID 5808 wrote to memory of 5452 5808 msedge.exe 84 PID 5808 wrote to memory of 5452 5808 msedge.exe 84 PID 5808 wrote to memory of 5452 5808 msedge.exe 84 PID 5808 wrote to memory of 5452 5808 msedge.exe 84 PID 5808 wrote to memory of 5452 5808 msedge.exe 84 PID 5808 wrote to memory of 5452 5808 msedge.exe 84 PID 5808 wrote to memory of 5452 5808 msedge.exe 84 PID 5808 wrote to memory of 5452 5808 msedge.exe 84 PID 5808 wrote to memory of 5452 5808 msedge.exe 84 PID 5808 wrote to memory of 5452 5808 msedge.exe 84 PID 5808 wrote to memory of 5452 5808 msedge.exe 84 PID 5808 wrote to memory of 5452 5808 msedge.exe 84 PID 5808 wrote to memory of 5452 5808 msedge.exe 84 PID 5808 wrote to memory of 5452 5808 msedge.exe 84 PID 5808 wrote to memory of 5452 5808 msedge.exe 84 PID 5808 wrote to memory of 5452 5808 msedge.exe 84 PID 5808 wrote to memory of 5452 5808 msedge.exe 84 PID 5808 wrote to memory of 5452 5808 msedge.exe 84 PID 5808 wrote to memory of 5452 5808 msedge.exe 84 PID 5808 wrote to memory of 5452 5808 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://kepler.copernicusgroup.es/ExpensesProposals/Edit/1084911⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5808 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xdc,0x110,0x7fffdc493cb8,0x7fffdc493cc8,0x7fffdc493cd82⤵PID:5940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,7556199675003415338,1441623524694697024,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:22⤵PID:3924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,7556199675003415338,1441623524694697024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,7556199675003415338,1441623524694697024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:82⤵PID:5452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,7556199675003415338,1441623524694697024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:4384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,7556199675003415338,1441623524694697024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:2940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,7556199675003415338,1441623524694697024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:12⤵PID:4580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,7556199675003415338,1441623524694697024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,7556199675003415338,1441623524694697024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3556 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,7556199675003415338,1441623524694697024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:12⤵PID:3140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,7556199675003415338,1441623524694697024,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:12⤵PID:2404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,7556199675003415338,1441623524694697024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:12⤵PID:2832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,7556199675003415338,1441623524694697024,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:12⤵PID:3340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,7556199675003415338,1441623524694697024,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4948 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3364
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1492
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1332
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD53e681bda746d695b173a54033103efa8
SHA1ae07be487e65914bb068174b99660fb8deb11a1d
SHA256fee5f7377e5ca213c1d8d7827b788723d0dd2538e7ce3f35581fc613fde834c2
SHA5120f4381c769d4ae18ff3ac93fd97e8d879043b8ec825611db27f08bd44c08babc1710672c3f93435a61e40db1ccbf5b74c6363aaaf5f4a7fc95a6a7786d1aced8
-
Filesize
152B
MD59f081a02d8bbd5d800828ed8c769f5d9
SHA1978d807096b7e7a4962a001b7bba6b2e77ce419a
SHA256a7645e1b16115e9afec86efa139d35d5fecc6c5c7c59174c9901b4213b1fae0e
SHA5127f3045f276f5bd8d3c65a23592419c3b98f1311c214c8e54a4dfe09122a08afb08ab7967b49bd413bc748ce6363658640bc87958d5e0a78974680a8f9beadf44
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize168B
MD5be967d472b6f86fa1aa148c1658e2473
SHA14e9db6542653d2008faa4bae0eee6e79ac6f6bd0
SHA256756554c4a19c915a6a97af69145bedca436235ac00dbd464a81d9be4df94f5b3
SHA512c1f5de8742d357094a7b2c719c02f853ba10a47806d8a17d279c7d027804888fae02b0fbcd84d97c9f146dd59963a622f32cc21a92ae94901b2793fd0a4cd152
-
Filesize
440B
MD55c84a37cb7e82ae36f002e7e05be40ec
SHA1c9a66ec188c6d1328e75fb8392b543ba618370df
SHA256d3aca4246d087a07bf101364ee0f18d266ab3d7da7d8384564a7b5aeee5189a7
SHA51216b8abd2e73754bdbfeb000b5fa52abd727e76ff4eeaf89e0f6e2564f357f5032db1274b083c822add6a06fed187e11ee9bc660885ce3c794ed9247322e7e305
-
Filesize
5KB
MD5c95c249e07725678d2acd4dff6cb9f68
SHA120ccfe77703277ec13afd1b0c27859637cf1f492
SHA25623cfe6c2172bbf127cf56a01dbab84dc7f8b897408bf8c3779b80955a6dfe212
SHA512b5d7eefe05a238519c2d43e45589b7614c7ac59d8dbc5be00f009b363bc4ffab342cb5614805d0d441cdb55782641639de55ed412adfd2318e490da339538e4e
-
Filesize
6KB
MD5f2f6e9c71d13b89cf3b6b7b297f5becb
SHA114ee14ed159e0b4bb9d01d9de2f5ff38f7d84fec
SHA256a4657171cdcee41dd1aa583545496580d6149c38c50f2411a49cdbf657253ef3
SHA5128b46f13eb62d462c54a3379407823253ad5042e811be4712989139d6e4c2a3a9e6e29d8692d19f1268b39dc3d9d26b707b92a542f3e0f18b20afcbd120fbf82b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000002.dbtmp
Filesize16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD5a3677c5babb7badc6abeb87ad34ce35f
SHA1226155da8174678da4d1d5107c017cd7a9d6c6bf
SHA256f7ad3ca2968b4a2c964ab7c7ae3d8782cb40f1db355046cb2668d6dbbf468382
SHA51215615ee6be0c2e755620f1fe35c8d087ed43dc4afad978c7f6573c127879c6b05046df32671f73946987d422ddac89434f007678ca73a1a61a4801dbba51d4ea