hxxps://ppastes[.]com/paste[.]php?p=1960bc062c28

Analysis

max time kernel
19s
max time network
10s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
23-08-2024 19:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://ppastes.com/paste.php?p=1960bc062c28

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
3000	msedge.exe
3000	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3000	msedge.exe
3000	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe
3000	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 880	3000	msedge.exe	81
PID 3000 wrote to memory of 880	3000	msedge.exe	81
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 4980	3000	msedge.exe	82
PID 3000 wrote to memory of 1584	3000	msedge.exe	83
PID 3000 wrote to memory of 1584	3000	msedge.exe	83
PID 3000 wrote to memory of 3016	3000	msedge.exe	84
PID 3000 wrote to memory of 3016	3000	msedge.exe	84
PID 3000 wrote to memory of 3016	3000	msedge.exe	84
PID 3000 wrote to memory of 3016	3000	msedge.exe	84
PID 3000 wrote to memory of 3016	3000	msedge.exe	84
PID 3000 wrote to memory of 3016	3000	msedge.exe	84
PID 3000 wrote to memory of 3016	3000	msedge.exe	84
PID 3000 wrote to memory of 3016	3000	msedge.exe	84
PID 3000 wrote to memory of 3016	3000	msedge.exe	84
PID 3000 wrote to memory of 3016	3000	msedge.exe	84
PID 3000 wrote to memory of 3016	3000	msedge.exe	84
PID 3000 wrote to memory of 3016	3000	msedge.exe	84
PID 3000 wrote to memory of 3016	3000	msedge.exe	84
PID 3000 wrote to memory of 3016	3000	msedge.exe	84
PID 3000 wrote to memory of 3016	3000	msedge.exe	84
PID 3000 wrote to memory of 3016	3000	msedge.exe	84
PID 3000 wrote to memory of 3016	3000	msedge.exe	84
PID 3000 wrote to memory of 3016	3000	msedge.exe	84
PID 3000 wrote to memory of 3016	3000	msedge.exe	84
PID 3000 wrote to memory of 3016	3000	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ppastes.com/paste.php?p=1960bc062c28
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe1fd23cb8,0x7ffe1fd23cc8,0x7ffe1fd23cd8
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,6037234986990323114,17524962938096161032,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1856 /prefetch:2
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,6037234986990323114,17524962938096161032,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,6037234986990323114,17524962938096161032,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,6037234986990323114,17524962938096161032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,6037234986990323114,17524962938096161032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9828ffacf3deee7f4c1300366ec22fab

SHA1
9aff54b57502b0fc2be1b0b4b3380256fb785602

SHA256
a3d21f0fb6563a5c9d0f7a6e9c125ec3faaa86ff43f37cb85a8778abc87950f7

SHA512
2e73ea4d2fcd7c8d52487816110f5f4a808ed636ae87dd119702d1cd1ae315cbb25c8094a9dddf18f07472b4deaed3e7e26c9b499334b26bdb70d4fa7f84168d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6fdbe80e9fe20761b59e8f32398f4b14

SHA1
049b1f0c6fc4e93a4ba6b3c992f1d6cecf3ada1f

SHA256
b7f0d9ece2307bdc4f05a2d814c947451b007067ff8af977f77f06c3d5706942

SHA512
cf25c7fd0d6eccc46e7b58949c16d17ebeefb7edd6c76aa62f7ab5da52d1c6fc88bde620be40396d336789bd0d62b2162209a947d7ab69389e8c03682e880234

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ceb7b08f3789ec2394deec05f774f1ae

SHA1
7bbc5fd254de6fb2531007b4c15df796ec87a30c

SHA256
b05de5527148c778508ecde2ff739f0cc730edbb5c769552ccbbd4b6981892b4

SHA512
c44efc3fc271a7ce451275daba547f3e572dbd4d50f6be65ecf0e699dc0641b065db24a5b9917a46f9b4c23e23a4c9f57316ba7ba8cb39535efc4f15898ac534

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e58e8fcb8a4a69b0a75210f0794759e2

SHA1
19717abf05258204df9c040daf00293046c47013

SHA256
c528f68cf2bd192f0627f50b7b796bad70633f824b05c75a7ea0a62c46181716

SHA512
627bbcb17fb4e0e37f780c12de65ec3dcaade1b7b65da3cb65ad042202e3eb1f165eeae1d4895501583d367e66f600fa5be5e534179b908e83481baf110234f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
28de0774954f417fa6dc29ad64b41418

SHA1
6bd97f71b5f4267a4cc4d725e20e921541de2e56

SHA256
279a3cad5795c1ff22c19a039b6822bc328e65984c374b2256f57a76879d013e

SHA512
7243c9e09a50821d6d9e64c0dd711f2fcf587800eabcf8019ddce9022aae358f4c606010c216b0e0fdd68139135c1f475ab9c63a2a314240c359a6ca7271e1d2

Download Submit