hxxps://monogogo[.]info/JQJMLAWN#em=patito@patito[.]com

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-es
resource tags

arch:x64arch:x86image:win10v2004-20240802-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
23/08/2024, 18:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://monogogo.info/JQJMLAWN#[email protected]

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1344	msedge.exe
1344	msedge.exe
3256	msedge.exe
3256	msedge.exe
3440	identity_helper.exe
3440	identity_helper.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe
908	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 5244	3256	msedge.exe	84
PID 3256 wrote to memory of 5244	3256	msedge.exe	84
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 2256	3256	msedge.exe	85
PID 3256 wrote to memory of 1344	3256	msedge.exe	86
PID 3256 wrote to memory of 1344	3256	msedge.exe	86
PID 3256 wrote to memory of 2208	3256	msedge.exe	87
PID 3256 wrote to memory of 2208	3256	msedge.exe	87
PID 3256 wrote to memory of 2208	3256	msedge.exe	87
PID 3256 wrote to memory of 2208	3256	msedge.exe	87
PID 3256 wrote to memory of 2208	3256	msedge.exe	87
PID 3256 wrote to memory of 2208	3256	msedge.exe	87
PID 3256 wrote to memory of 2208	3256	msedge.exe	87
PID 3256 wrote to memory of 2208	3256	msedge.exe	87
PID 3256 wrote to memory of 2208	3256	msedge.exe	87
PID 3256 wrote to memory of 2208	3256	msedge.exe	87
PID 3256 wrote to memory of 2208	3256	msedge.exe	87
PID 3256 wrote to memory of 2208	3256	msedge.exe	87
PID 3256 wrote to memory of 2208	3256	msedge.exe	87
PID 3256 wrote to memory of 2208	3256	msedge.exe	87
PID 3256 wrote to memory of 2208	3256	msedge.exe	87
PID 3256 wrote to memory of 2208	3256	msedge.exe	87
PID 3256 wrote to memory of 2208	3256	msedge.exe	87
PID 3256 wrote to memory of 2208	3256	msedge.exe	87
PID 3256 wrote to memory of 2208	3256	msedge.exe	87
PID 3256 wrote to memory of 2208	3256	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://monogogo.info/JQJMLAWN#[email protected]
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb5fdb46f8,0x7ffb5fdb4708,0x7ffb5fdb4718
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,17547873665863131719,4177889415270664261,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,17547873665863131719,4177889415270664261,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,17547873665863131719,4177889415270664261,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17547873665863131719,4177889415270664261,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17547873665863131719,4177889415270664261,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,17547873665863131719,4177889415270664261,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,17547873665863131719,4177889415270664261,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17547873665863131719,4177889415270664261,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17547873665863131719,4177889415270664261,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17547873665863131719,4177889415270664261,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17547873665863131719,4177889415270664261,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,17547873665863131719,4177889415270664261,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
f3f6ea0d2811d61a7ba81596f3808f88

SHA1
cbe5d432e7be5b7216fa73fbd58a39dffabf3c65

SHA256
9e8515ce0792f98b007c23811426c7be05f2c576f43169e81c69469e82adebf7

SHA512
a7ac90ce1c76eea3091933fc7c4e60c40439ec7189fa87094ec3f43fa359862b8990937d5a0efcfe54bf4ad1e0c9e0faf6f7dda2de66f939c82f66baea9b655c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
771B

MD5
311f004b91ed1a1393add3b8d827f356

SHA1
a3ca4a506b9baa2a84f7c5e7297869c0be916154

SHA256
7a75fd280eb48d64a5408f5f851442c10a1b2575319a29e62b41e8c4363cec30

SHA512
af175af52bb9ff27da485e504a766a255da859ddfb138f0e85cf58e8526793c291761f437b77c02d361004826444a7b42973cc5dbd5ddcfa74b1c6986305f764

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
81463eb0c9fb202f7e8f35a58d67e01b

SHA1
47b8d6045deb560bea5a929a127cd7b08a049be0

SHA256
3e68b82ecd3300fd8960c87622785193450b11228aa76be2eccfec54eaea48be

SHA512
58cb6fe103173fa431beef34935eca89dae13e4243295ffd1e070a669077bacedd2c68ea6db3a17948a627c6df04114ec1e569f61fd18712f3fa282ec1ef7870

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c52a77ab292e74c9460b86b1b755f8d2

SHA1
fc7b5d788af42266c3eb0c305da6545e79158435

SHA256
9dcdab97494ec987daf8669d929ed559564b49f2216a35adb37cc390a45fa938

SHA512
b587d9d1f4c0e76ecd18d5103c36df7b7e199cb8b6d02342151727ce7b729cb6b8df5c40948de08a1c95b5b00a2b6da25cf0c802dab81410758fc15b24230bcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7bb70f2489ce6ae71e1e6370d374fb4f

SHA1
245a03f9c4e974940c51d2f28c4e953a5e137ff0

SHA256
91ed52e4cdee2eac926596b6d2c9ee28563bd61696e60625ffc422cb8a8a7f88

SHA512
7b4fdd55d9a3e29466446d3acc761fe8b017f936008a640e82a5b5201a5036edbffd2d4749eb1c699eb55221ac5f1723386ea612ccdecc17a2a51760bcd29792

Download Submit