hxxp://dashboard[.]sogem[.]it

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 07:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://dashboard.sogem.it

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2292	msedge.exe
2292	msedge.exe
5104	msedge.exe
5104	msedge.exe
2880	identity_helper.exe
2880	identity_helper.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 3512	5104	msedge.exe	84
PID 5104 wrote to memory of 3512	5104	msedge.exe	84
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 4036	5104	msedge.exe	85
PID 5104 wrote to memory of 2292	5104	msedge.exe	86
PID 5104 wrote to memory of 2292	5104	msedge.exe	86
PID 5104 wrote to memory of 2576	5104	msedge.exe	87
PID 5104 wrote to memory of 2576	5104	msedge.exe	87
PID 5104 wrote to memory of 2576	5104	msedge.exe	87
PID 5104 wrote to memory of 2576	5104	msedge.exe	87
PID 5104 wrote to memory of 2576	5104	msedge.exe	87
PID 5104 wrote to memory of 2576	5104	msedge.exe	87
PID 5104 wrote to memory of 2576	5104	msedge.exe	87
PID 5104 wrote to memory of 2576	5104	msedge.exe	87
PID 5104 wrote to memory of 2576	5104	msedge.exe	87
PID 5104 wrote to memory of 2576	5104	msedge.exe	87
PID 5104 wrote to memory of 2576	5104	msedge.exe	87
PID 5104 wrote to memory of 2576	5104	msedge.exe	87
PID 5104 wrote to memory of 2576	5104	msedge.exe	87
PID 5104 wrote to memory of 2576	5104	msedge.exe	87
PID 5104 wrote to memory of 2576	5104	msedge.exe	87
PID 5104 wrote to memory of 2576	5104	msedge.exe	87
PID 5104 wrote to memory of 2576	5104	msedge.exe	87
PID 5104 wrote to memory of 2576	5104	msedge.exe	87
PID 5104 wrote to memory of 2576	5104	msedge.exe	87
PID 5104 wrote to memory of 2576	5104	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://dashboard.sogem.it
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e8a146f8,0x7ff8e8a14708,0x7ff8e8a14718
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,9124584277487398780,947111690229343248,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,9124584277487398780,947111690229343248,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,9124584277487398780,947111690229343248,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9124584277487398780,947111690229343248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9124584277487398780,947111690229343248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9124584277487398780,947111690229343248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9124584277487398780,947111690229343248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3844 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,9124584277487398780,947111690229343248,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,9124584277487398780,947111690229343248,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9124584277487398780,947111690229343248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9124584277487398780,947111690229343248,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9124584277487398780,947111690229343248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9124584277487398780,947111690229343248,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,9124584277487398780,947111690229343248,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
212KB

MD5
2257803a7e34c3abd90ec6d41fd76a5a

SHA1
f7a32e6635d8513f74bd225f55d867ea56ae4803

SHA256
af23860fb3a448f2cc6107680078402555a345eb45bc5efb750f541fe5d7c174

SHA512
e9f4dc90d0829885f08879e868aa62041150b500f62682fc108da258eee26ad9509dcbf6e8a55f2d0bdba7aa9118dd149a70a7d851820d4ea683db7808c48540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
ab689d40946f7e9445d934146c82974c

SHA1
22708f3f5806efe8c3c99552704490110d5e9e80

SHA256
c038bff7d11c7080d25cd7881b19ed36eaea021d6171cad999c2999df2589780

SHA512
b9e8f7c0f5c55a23b2571c975e06bd3842606b177237efd258dc409385c3087df4a0376e8797451159a84c97af6eb5c1fd1f0a97392fec1bee927b8eb7af4c07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4756ba1fa29a96316dbdaa95c06b1eab

SHA1
2bc5c8511fd13f92c21b4f7cc3206e92f996596a

SHA256
52790c3d8f11471169e8856b44768e1550068a6723112bf054b9ac57761f6e8d

SHA512
817ac052ad23c4c9b5b49fc84dc0207b2fc8820b55bcecc8c45c8f79451f5072105faf406e97e08cd51e4f316f2844a1e4800a081ca791f4a7808f5c7faf7832

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
64dd9e0e14f8f0791ae2d53c81409e82

SHA1
dfc31f3e72b000c1e1c41148fd3705935818efb7

SHA256
830bb99b7043639444b22bd4f55c5b7db080be202db01e439cdf9d99b71b14fb

SHA512
979d848289060e4afe213bfb4c7402e822f1ffd496da6ec0a1d7bb3ab2da918fd674a2b31899d393b3e0caab8e324f767f4d82333cb483f9d06e0641c4af6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1c00d2dba4852d2ed193896b64b53cf1

SHA1
19d3d9cafb9865409f9465c15119b67da8123dcf

SHA256
a760bece91b6b9f2c0668871d1659685ab9aa3e121896fa56f2fc08f8c7a18bc

SHA512
d055346d1ea4e0ae1091453a5d4198b5e1b1e2997ee94d6de3cd62931d4fdaa0e8177e9996e1fe1573f07f668d2b7ad38685225de4d45c460d2088510782a6ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5c608d4cc1a043773ff2a5c51fdf0213

SHA1
89367be8d5e18a6710cd1ac50f15afa6d6b02cc0

SHA256
f221e412299e978b93882c12d752e986e8708735936108625163bd59f92f3b97

SHA512
ce560e572938bdb6f601d37605cf64c515049fc57f43670ced558f48ae97a517c697174749aa294a468a7b1e0cbc031df9d3328f9e8f130a7e698447e209bd3b

Download Submit