hxxp://scott[.]mason@biiapac[.]com

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 20:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://[email protected]

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4408	msedge.exe
4408	msedge.exe
1160	identity_helper.exe
1160	identity_helper.exe
5528	msedge.exe
5528	msedge.exe
5528	msedge.exe
5528	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 1216	4408	msedge.exe	84
PID 4408 wrote to memory of 1216	4408	msedge.exe	84
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 1812	4408	msedge.exe	85
PID 4408 wrote to memory of 4968	4408	msedge.exe	86
PID 4408 wrote to memory of 4968	4408	msedge.exe	86
PID 4408 wrote to memory of 2132	4408	msedge.exe	87
PID 4408 wrote to memory of 2132	4408	msedge.exe	87
PID 4408 wrote to memory of 2132	4408	msedge.exe	87
PID 4408 wrote to memory of 2132	4408	msedge.exe	87
PID 4408 wrote to memory of 2132	4408	msedge.exe	87
PID 4408 wrote to memory of 2132	4408	msedge.exe	87
PID 4408 wrote to memory of 2132	4408	msedge.exe	87
PID 4408 wrote to memory of 2132	4408	msedge.exe	87
PID 4408 wrote to memory of 2132	4408	msedge.exe	87
PID 4408 wrote to memory of 2132	4408	msedge.exe	87
PID 4408 wrote to memory of 2132	4408	msedge.exe	87
PID 4408 wrote to memory of 2132	4408	msedge.exe	87
PID 4408 wrote to memory of 2132	4408	msedge.exe	87
PID 4408 wrote to memory of 2132	4408	msedge.exe	87
PID 4408 wrote to memory of 2132	4408	msedge.exe	87
PID 4408 wrote to memory of 2132	4408	msedge.exe	87
PID 4408 wrote to memory of 2132	4408	msedge.exe	87
PID 4408 wrote to memory of 2132	4408	msedge.exe	87
PID 4408 wrote to memory of 2132	4408	msedge.exe	87
PID 4408 wrote to memory of 2132	4408	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://[email protected]
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9723d46f8,0x7ff9723d4708,0x7ff9723d4718
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,8664697462892984735,16308094964187721443,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,8664697462892984735,16308094964187721443,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,8664697462892984735,16308094964187721443,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8664697462892984735,16308094964187721443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8664697462892984735,16308094964187721443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8664697462892984735,16308094964187721443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8664697462892984735,16308094964187721443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,8664697462892984735,16308094964187721443,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,8664697462892984735,16308094964187721443,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8664697462892984735,16308094964187721443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8664697462892984735,16308094964187721443,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8664697462892984735,16308094964187721443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,8664697462892984735,16308094964187721443,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,8664697462892984735,16308094964187721443,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3056 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
cdf45aef593052ec1033cf8d661cb31a

SHA1
de53a96b32ce0c46820e4f4a33aae12422d8730c

SHA256
86e7b47aada066217bf6b4ffdb6d708ee39d40d9987de384ac3a4e2defe291ce

SHA512
1b3959a4f24e174cad6555b9111e69f5f29688d7f748c7c65b7c7c9669c2d781e07cebfda7e19dc2e464e33b92ba82f56fe94df7a8c876040c96bcf23b1effdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f71f0ce12bdf44e088cc1735438110c0

SHA1
38569dbf0c80f86269b091232a17e3a691379757

SHA256
c9db115f8e4e76e1881ec93b676b5be9e9827af2b792310f2f3907b049721a79

SHA512
4bc3fccedfd211c7d3ec06d98357dd7ef50eafe96063dc28ee7665e5670af42a080566e5c032be8ff7a4f2311991bcf78c5f01de3e2a6e0ebcb0fe6e665ad671

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8d9f3eea91acc482667937c9ec66f8e8

SHA1
4032404284bdcb59503c033a4d786faab06c8ba0

SHA256
611b100444af57d2caa4da522755bc31c979155b141a2d36c7c3cbcf968d94b2

SHA512
fe2eaa14e8ae68feca1e5eef68a2abda9585b3a10783b1216e27acde7bb220b750e48b51ac9e6ec60191eb0f7912efb579401192de68094d88cd00c0a60da3be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d8ca1654d23a48ccdfd4b94825ebc2b5

SHA1
e0ee633e4f355addfaa349c7eebd9c27c69c24a5

SHA256
e71fcd5bdd232f1424d8b60dd583f1a8f29d5520064e3d0df4cdba41c22dc6b7

SHA512
f71cd4ae3499963a63ef575a20b60440b568c02ea1f882324718a506d209fe93b757d1849ac368bde381e41abd345a6c241b92a11dcf568c920ac4937e2bbd50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
db7de0501d9f5a50d342365b22f0c772

SHA1
83d0c6fdcf1f2a6a50939b3da5ab8051b632768f

SHA256
059e08d00c23d5f90b6f847df7a2216e886d4703c5b1a9ee901c5833ad206bd5

SHA512
9bb64894fda3622312dd969b0a5a00c7a5c6a1fdf155eff2eb18f5e464ebdec70c511e49196c84418c5d8bbd640f1ea93c553b155764dad02ce8d17480814d22

Download Submit