hxxp://88[.]198[.]186[.]112

Analysis

max time kernel
41s
max time network
48s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
20/08/2024, 19:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://88.198.186.112

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4212	msedge.exe
4212	msedge.exe
2052	identity_helper.exe
2052	identity_helper.exe
1456	msedge.exe
1456	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 3984	4212	msedge.exe	81
PID 4212 wrote to memory of 3984	4212	msedge.exe	81
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 3612	4212	msedge.exe	82
PID 4212 wrote to memory of 4572	4212	msedge.exe	83
PID 4212 wrote to memory of 4572	4212	msedge.exe	83
PID 4212 wrote to memory of 2556	4212	msedge.exe	84
PID 4212 wrote to memory of 2556	4212	msedge.exe	84
PID 4212 wrote to memory of 2556	4212	msedge.exe	84
PID 4212 wrote to memory of 2556	4212	msedge.exe	84
PID 4212 wrote to memory of 2556	4212	msedge.exe	84
PID 4212 wrote to memory of 2556	4212	msedge.exe	84
PID 4212 wrote to memory of 2556	4212	msedge.exe	84
PID 4212 wrote to memory of 2556	4212	msedge.exe	84
PID 4212 wrote to memory of 2556	4212	msedge.exe	84
PID 4212 wrote to memory of 2556	4212	msedge.exe	84
PID 4212 wrote to memory of 2556	4212	msedge.exe	84
PID 4212 wrote to memory of 2556	4212	msedge.exe	84
PID 4212 wrote to memory of 2556	4212	msedge.exe	84
PID 4212 wrote to memory of 2556	4212	msedge.exe	84
PID 4212 wrote to memory of 2556	4212	msedge.exe	84
PID 4212 wrote to memory of 2556	4212	msedge.exe	84
PID 4212 wrote to memory of 2556	4212	msedge.exe	84
PID 4212 wrote to memory of 2556	4212	msedge.exe	84
PID 4212 wrote to memory of 2556	4212	msedge.exe	84
PID 4212 wrote to memory of 2556	4212	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://88.198.186.112
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb269d3cb8,0x7ffb269d3cc8,0x7ffb269d3cd8
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,13843638497668363193,1656882109492829031,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1848 /prefetch:2
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1864,13843638497668363193,1656882109492829031,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1864,13843638497668363193,1656882109492829031,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13843638497668363193,1656882109492829031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13843638497668363193,1656882109492829031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1864,13843638497668363193,1656882109492829031,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13843638497668363193,1656882109492829031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13843638497668363193,1656882109492829031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1864,13843638497668363193,1656882109492829031,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3268 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13843638497668363193,1656882109492829031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13843638497668363193,1656882109492829031,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13843638497668363193,1656882109492829031,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13843638497668363193,1656882109492829031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13843638497668363193,1656882109492829031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,13843638497668363193,1656882109492829031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1720 /prefetch:1
  2⤵
  PID:2028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\42e851bb-3c40-4804-8676-b6ae69885b14.tmp

Filesize
11KB

MD5
d16e41ed18b0c8d18d6e312fbe9c71da

SHA1
f3609e7f7991fa435454f9c2cd68de61d72ad043

SHA256
a14c6d8842fd4c35695917a2eda73e52be33dbe457c6a685a3dbcc961cba9368

SHA512
5d198ec07c617aec191516fd76af8669e17ed31415d1b30b422aee6f85f95148a3671cd1bd0a81035a47d4eb1c693c1fc88da399eb8b45981b2ebf6476dce208

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9af507866fb23dace6259791c377531f

SHA1
5a5914fc48341ac112bfcd71b946fc0b2619f933

SHA256
5fb3ec65ce1e6f47694e56a07c63e3b8af9876d80387a71f1917deae690d069f

SHA512
c58c963ecd2c53f0c427f91dc41d9b2a9b766f2e04d7dae5236cb3c769d1f048e4a342ea75e4a690f3a207baa1d3add672160c1f317abfe703fd1d2216b1baf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b0177afa818e013394b36a04cb111278

SHA1
dbc5c47e7a7df24259d67edf5fbbfa1b1fae3fe5

SHA256
ffc2c53bfd37576b435309c750a5b81580a076c83019d34172f6635ff20c2a9d

SHA512
d3b9e3a0a99f191edcf33f3658abd3c88afbb12d7b14d3b421b72b74d551b64d2a13d07db94c90b85606198ee6c9e52072e1017f8c8c6144c03acf509793a9db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
502fed423f284fc8668b2a9088d436c2

SHA1
988215072c6ea142d1966bb22a9221ec81bcb7af

SHA256
ac84a0897fcb520ac86d858a9dc4cef0631de738750d600b843e18c635360367

SHA512
dbaf76210b4cd11469cbdab1ca8db065a8399a564ef90cfcbe5712a61bc36eca655502d26571a69d6b509fc3302f9d16314bad118a982a97ca745c9c143cf3ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
332178f44d40763d6d1e31dfe36ac685

SHA1
df0967aea27834c2e3b1c3215a3b75b3fa328b59

SHA256
86471a4c0c1684d4782f6a3aaabf3e28b18c0e4a79d6428876f4eb2d52aaa168

SHA512
97673a11c70ff114ca53d8205c3e9d80d41dae8a974cc43b25d7e17c6f9b2eabb3e9fcb9de65562db8cd812caf540408a618004dade1ea87835c78da6a76ca84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4bbff9acfe5ecfc6c9f3b1daa1640486

SHA1
b5017ed65bc8ae6eadfa121bb77b732d27d7870b

SHA256
92f06447d5e7a171173f84930fab992f7422f51c503da9dadaa5b762c6dc4d64

SHA512
8e0555ba2a0ddb01a1df243d0451d1585c7e4239328160941cd1ef593ba410356decccd1afdfdf774fd462a4e66651d89a5fc473d343f527976510656be37ef2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b3f050541147a76404225b50f0b06b3d

SHA1
8d4fd3494851572cbe27aa28ce1eb70af8121c25

SHA256
d125312de9eade1f4d4625953fac7739b14c4a3970287d28f809e1b55a497d25

SHA512
ec17d9f55021be67cf56810a258b29c01b248352c6df3d6100e309e9396dae081e7874e471ce65493611f934b6562aa791c10628d3376dbf08476239afb608b0

Download Submit