hxxps://robinde[.]tech

Resubmissions

19/08/2024, 20:34

240819-zcxwssvang 3

19/08/2024, 20:31

240819-za6qxsthne 5

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 20:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://robinde.tech

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
4880	msedge.exe
4880	msedge.exe
3404	identity_helper.exe
3404	identity_helper.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 3260	4880	msedge.exe	84
PID 4880 wrote to memory of 3260	4880	msedge.exe	84
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 1612	4880	msedge.exe	85
PID 4880 wrote to memory of 5100	4880	msedge.exe	86
PID 4880 wrote to memory of 5100	4880	msedge.exe	86
PID 4880 wrote to memory of 3528	4880	msedge.exe	87
PID 4880 wrote to memory of 3528	4880	msedge.exe	87
PID 4880 wrote to memory of 3528	4880	msedge.exe	87
PID 4880 wrote to memory of 3528	4880	msedge.exe	87
PID 4880 wrote to memory of 3528	4880	msedge.exe	87
PID 4880 wrote to memory of 3528	4880	msedge.exe	87
PID 4880 wrote to memory of 3528	4880	msedge.exe	87
PID 4880 wrote to memory of 3528	4880	msedge.exe	87
PID 4880 wrote to memory of 3528	4880	msedge.exe	87
PID 4880 wrote to memory of 3528	4880	msedge.exe	87
PID 4880 wrote to memory of 3528	4880	msedge.exe	87
PID 4880 wrote to memory of 3528	4880	msedge.exe	87
PID 4880 wrote to memory of 3528	4880	msedge.exe	87
PID 4880 wrote to memory of 3528	4880	msedge.exe	87
PID 4880 wrote to memory of 3528	4880	msedge.exe	87
PID 4880 wrote to memory of 3528	4880	msedge.exe	87
PID 4880 wrote to memory of 3528	4880	msedge.exe	87
PID 4880 wrote to memory of 3528	4880	msedge.exe	87
PID 4880 wrote to memory of 3528	4880	msedge.exe	87
PID 4880 wrote to memory of 3528	4880	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://robinde.tech
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd790346f8,0x7ffd79034708,0x7ffd79034718
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,6838875002085974770,16047000631849549917,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,6838875002085974770,16047000631849549917,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,6838875002085974770,16047000631849549917,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6838875002085974770,16047000631849549917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6838875002085974770,16047000631849549917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,6838875002085974770,16047000631849549917,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,6838875002085974770,16047000631849549917,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6838875002085974770,16047000631849549917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1716 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6838875002085974770,16047000631849549917,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2568 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6838875002085974770,16047000631849549917,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6838875002085974770,16047000631849549917,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,6838875002085974770,16047000631849549917,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4764 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3688

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
255B

MD5
adc768e4105776e0dfb7d298664cb6e5

SHA1
fedf7d6d1c09689ebd5a1e123c7b0a803bb218f5

SHA256
944f6a2c115241650b027f90c2a7b37ffbe7b3f794740af5e44c14f6ec1f23dc

SHA512
30c550675f973525319e11b47fbfbc874ef8e009778181041fe7d2abf3ff71125117a2dea6f57cdb5f0667158d50acff6c3cac9556d393b66a68e3860d1a89e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
da3c2bf542d2959f8ff7dce4e4ce3819

SHA1
99e44aa6b9406be0537b9a67700541b434c5e954

SHA256
2d48240f02dc46343c92b8b02bf5afc74870113180b17993dc2d2fe442ac24a5

SHA512
dec9b8492cd6c0ac06187fc6266374c7e2f138c7dc3cc1965048f0457558fce867f197a0b00700356b8aa75d003a755068ee783d5041ffc4d1e1d44c18b02619

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9f1fdfea9d6af8f6932208116a3fbfbc

SHA1
c4c43b4c040bdc8d60d8f8a220c7f054195d9753

SHA256
a2cac06070e35ffe5bb409eccb5c4a0ffd39a4138462406a4da0c68fd3474c8c

SHA512
ff9eaa48003fd4c82b7ca0a2ea9ebb0cebc7f306bed95005daf98fc73c49fc0aeb34717262f95b466c4592ce5efe7a8c0ed0e25435b6ee889b1992d5bc198366

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d11abed25887e54fd1fcb340ebebdffe

SHA1
712341d9671dca11cbab22b00c2d1cc1b4c9309f

SHA256
2e294ff14b442ac22fa4205a690149ea17553eeb2b19faf00e0497557a66c527

SHA512
e8d1886e6e246bb786599bfac1e816f550e659c933c2a641c69b19adbd08b801a60e15d059fce74f5e381e55aa84cc853fa34111c4462f7dd6fd4fca537fc5ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2da80cefe7f935ebab5a9622c017838c

SHA1
d633040519485770ce3cc90dc952cbf75fd6b42f

SHA256
e44d1ecf8e41d76416926b292e1ca2330be06791070cf0a0392f2caf7a61d1d7

SHA512
cdbb5bb3c7880ecd8fb712b5c40c576946415dff7105561ef8281650dd3cf8c5c0da41078bc97c2715eb5e1202df9bbac8434c241fae4f9eb0476f3f130cbb19

Download Submit