hxxp://www[.]geoplugin[.]net

Analysis

max time kernel
35s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 06:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.geoplugin.net

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
2072	msedge.exe
2072	msedge.exe
4204	identity_helper.exe
4204	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 4404	2072	msedge.exe	86
PID 2072 wrote to memory of 4404	2072	msedge.exe	86
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 3140	2072	msedge.exe	87
PID 2072 wrote to memory of 5080	2072	msedge.exe	88
PID 2072 wrote to memory of 5080	2072	msedge.exe	88
PID 2072 wrote to memory of 1020	2072	msedge.exe	89
PID 2072 wrote to memory of 1020	2072	msedge.exe	89
PID 2072 wrote to memory of 1020	2072	msedge.exe	89
PID 2072 wrote to memory of 1020	2072	msedge.exe	89
PID 2072 wrote to memory of 1020	2072	msedge.exe	89
PID 2072 wrote to memory of 1020	2072	msedge.exe	89
PID 2072 wrote to memory of 1020	2072	msedge.exe	89
PID 2072 wrote to memory of 1020	2072	msedge.exe	89
PID 2072 wrote to memory of 1020	2072	msedge.exe	89
PID 2072 wrote to memory of 1020	2072	msedge.exe	89
PID 2072 wrote to memory of 1020	2072	msedge.exe	89
PID 2072 wrote to memory of 1020	2072	msedge.exe	89
PID 2072 wrote to memory of 1020	2072	msedge.exe	89
PID 2072 wrote to memory of 1020	2072	msedge.exe	89
PID 2072 wrote to memory of 1020	2072	msedge.exe	89
PID 2072 wrote to memory of 1020	2072	msedge.exe	89
PID 2072 wrote to memory of 1020	2072	msedge.exe	89
PID 2072 wrote to memory of 1020	2072	msedge.exe	89
PID 2072 wrote to memory of 1020	2072	msedge.exe	89
PID 2072 wrote to memory of 1020	2072	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.geoplugin.net
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff956bc46f8,0x7ff956bc4708,0x7ff956bc4718
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,14558185075147715095,3357400052675677026,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,14558185075147715095,3357400052675677026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,14558185075147715095,3357400052675677026,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14558185075147715095,3357400052675677026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14558185075147715095,3357400052675677026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,14558185075147715095,3357400052675677026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,14558185075147715095,3357400052675677026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14558185075147715095,3357400052675677026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14558185075147715095,3357400052675677026,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14558185075147715095,3357400052675677026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14558185075147715095,3357400052675677026,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14558185075147715095,3357400052675677026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:4540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
24e31476d415c3e50c973f7dc38a6739

SHA1
6400722230cff1da58745767e7097cae9b598e4c

SHA256
3933133e939b0c29040072b960a555f49e41b9d75d8a7cad271f0821c0b5bb4c

SHA512
138c163a8119e8cb1522ca4f962c92a74bde6c1f6f960dca461e60f23b073cd112d1b28dd6499eb680a8baaab981755b099ff89e09da0169a50b394140ecb4d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e5c325f691f9da0bc25fb0b8d152554b

SHA1
30c712aadc174ebdfce6460a7daf112daafe0306

SHA256
df39933dc6af72bd70d593d7c85006d5d5e30f35c984558a2a0fd896fb78e2e2

SHA512
1c5c3ad20b6bce3b8e5fc2ddeeb36ed13d3e1167698146919f6f06ab480acc63c5f1a10e762b5427d744d263f3d7dd3d32ede968e85a856ad12c4fb1e95b1372

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0a175886faf78b773bec4f81b62910bd

SHA1
66fe224f0d4655a272c808fd91d9d9f9b2effd9a

SHA256
9be8202e7cbed437ab652b206acc97a54c0c137b0ce1d25697e6246f5833777e

SHA512
b8a9088a17b9bfec2968d1c0e3b4ed6e12db30d85ac2e6a7051e894d85c02af29bbbd79171a79d41dadb9b4e3699944d131172eca2096258ca856c9438908960

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3b14ef36d37d94a4fb83502150dc7a05

SHA1
e3fe23b9e574e9eaf838dac7f04aa12a7f1be6fa

SHA256
2d2fca3d208c39c320856806f9b90cab4e24cd47def6109fcbf941d87ee3f428

SHA512
847bc4030b137d19e4da2aab73f21e3b020f7b707a7179f4460b6b61ddbbbe71096269da0cf6f554bb28d960b60b9db7fe1f9634e8762604e19b50959267bc2a

Download Submit