hxxps://www[.]api[.]soget[.]it/ and hxxp[://]www[.]api[.]soget[.]it/

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 07:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.api.soget.it/ and hxxp://www.api.soget.it/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
3616	msedge.exe
3616	msedge.exe
4952	identity_helper.exe
4952	identity_helper.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe
3616	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 416	3616	msedge.exe	84
PID 3616 wrote to memory of 416	3616	msedge.exe	84
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4388	3616	msedge.exe	85
PID 3616 wrote to memory of 4640	3616	msedge.exe	86
PID 3616 wrote to memory of 4640	3616	msedge.exe	86
PID 3616 wrote to memory of 4544	3616	msedge.exe	87
PID 3616 wrote to memory of 4544	3616	msedge.exe	87
PID 3616 wrote to memory of 4544	3616	msedge.exe	87
PID 3616 wrote to memory of 4544	3616	msedge.exe	87
PID 3616 wrote to memory of 4544	3616	msedge.exe	87
PID 3616 wrote to memory of 4544	3616	msedge.exe	87
PID 3616 wrote to memory of 4544	3616	msedge.exe	87
PID 3616 wrote to memory of 4544	3616	msedge.exe	87
PID 3616 wrote to memory of 4544	3616	msedge.exe	87
PID 3616 wrote to memory of 4544	3616	msedge.exe	87
PID 3616 wrote to memory of 4544	3616	msedge.exe	87
PID 3616 wrote to memory of 4544	3616	msedge.exe	87
PID 3616 wrote to memory of 4544	3616	msedge.exe	87
PID 3616 wrote to memory of 4544	3616	msedge.exe	87
PID 3616 wrote to memory of 4544	3616	msedge.exe	87
PID 3616 wrote to memory of 4544	3616	msedge.exe	87
PID 3616 wrote to memory of 4544	3616	msedge.exe	87
PID 3616 wrote to memory of 4544	3616	msedge.exe	87
PID 3616 wrote to memory of 4544	3616	msedge.exe	87
PID 3616 wrote to memory of 4544	3616	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.api.soget.it/ and hxxp://www.api.soget.it/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1fdd46f8,0x7ffa1fdd4708,0x7ffa1fdd4718
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,8514913604150235692,10447258629473614490,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,8514913604150235692,10447258629473614490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,8514913604150235692,10447258629473614490,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8514913604150235692,10447258629473614490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8514913604150235692,10447258629473614490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8514913604150235692,10447258629473614490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8514913604150235692,10447258629473614490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,8514913604150235692,10447258629473614490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,8514913604150235692,10447258629473614490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8514913604150235692,10447258629473614490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8514913604150235692,10447258629473614490,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8514913604150235692,10447258629473614490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8514913604150235692,10447258629473614490,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,8514913604150235692,10447258629473614490,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4708 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
212KB

MD5
2257803a7e34c3abd90ec6d41fd76a5a

SHA1
f7a32e6635d8513f74bd225f55d867ea56ae4803

SHA256
af23860fb3a448f2cc6107680078402555a345eb45bc5efb750f541fe5d7c174

SHA512
e9f4dc90d0829885f08879e868aa62041150b500f62682fc108da258eee26ad9509dcbf6e8a55f2d0bdba7aa9118dd149a70a7d851820d4ea683db7808c48540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
1f571a7d7334147225484fb8057a88ed

SHA1
414769e6993f7a305110d0f53094466d62727cd9

SHA256
fd1df585758e07c9a8bf34dc1a9308162997d6c0d4215835842e2df26bb98137

SHA512
20545909d2219482de9a762306a11642477359d089a9ad71c9d704e0fb22116d552ea80537e9769ba722348e8f51cae22ea23d9aec157ca98f177d22a7069615

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3fa86b60a1c2e6a408ca9dd9d6808828

SHA1
ffa0231dd6b3c80795cab8645649aeba0fc0e364

SHA256
8c6e96561f15923c39497403f9727ae65a3306a9ed3d37948ae19c53848fe6ab

SHA512
759211e4a610bf8ac4b985e6a973962695df3a8c30e8623e47c344429736c9c17dd6120e7669cf02767ff8d45218be1814384921b39442664f122a1b6b5ea3bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4dee840edc233301a38df51210b9c788

SHA1
a163119046d05eeae988f1bdcc2b53da2b02f82f

SHA256
a832f465ff645574936b8a2ac1da5dc8942b3ca6f58339af38bdb076f466e5bd

SHA512
fc614a127d580466d871ec5fba2c95e2eb97893b36daa88164aff95cf59eecaa0b0b456899f06c0827d9ba3f9a0df709389fbb49b6e9d7a9900f1288e5425dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
780394a5522ebe428c1165f4f9e6f5ce

SHA1
0b7ecb28358b773258d0c214aed6cc23a5928ff6

SHA256
6663ab91234ce6d8956bfa1469a580abe3fb4264ceb4ad93425affef9f4eae6b

SHA512
441538b8bb1434f4815093364f221c6e0288691a4b93d42f264faa855472c50e2fb14df2a27fb88150f2d39d4142898d61483ca04f241341ba60782b56ef88c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e22b2cbdee3952211967cec152a3a720

SHA1
4a3822f45f253d30a2fc660e0dc4f96d79b698c9

SHA256
aa3bced28ea62eb9253eae81987614add77607fcad045129ff3591f75e9e41f8

SHA512
d40c2dffc6661e7e1aeaf45f314f239590a6f030c5e0c70683198c35c958a0ea09d88a97a749916fc7905d71d194ef523d55e139a8954a0d6819f468698c865b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4a8dc9df880e70606effcf1d8335e597

SHA1
d5a8084a9df97acb08d85a37b887283ff7277329

SHA256
31d0d8c28583e8cd38e38a83f4587b10c538dafa71987063b728467667a34081

SHA512
50b8495f71369fcfecd1cd2291e9a1249a09fdcf8cd096dc9c74c36f1138c845d8127ea90150712d5d5c7bbe00852401a4c727614b7da895c277f33c432610d1

Download Submit