hxxps://dixonvalve[.]com/en/home

Analysis

max time kernel
145s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 11:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://dixonvalve.com/en/home

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3344	msedge.exe
3344	msedge.exe
2344	msedge.exe
2344	msedge.exe
220	identity_helper.exe
220	identity_helper.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 5032	2344	msedge.exe	85
PID 2344 wrote to memory of 5032	2344	msedge.exe	85
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 628	2344	msedge.exe	86
PID 2344 wrote to memory of 3344	2344	msedge.exe	87
PID 2344 wrote to memory of 3344	2344	msedge.exe	87
PID 2344 wrote to memory of 1780	2344	msedge.exe	88
PID 2344 wrote to memory of 1780	2344	msedge.exe	88
PID 2344 wrote to memory of 1780	2344	msedge.exe	88
PID 2344 wrote to memory of 1780	2344	msedge.exe	88
PID 2344 wrote to memory of 1780	2344	msedge.exe	88
PID 2344 wrote to memory of 1780	2344	msedge.exe	88
PID 2344 wrote to memory of 1780	2344	msedge.exe	88
PID 2344 wrote to memory of 1780	2344	msedge.exe	88
PID 2344 wrote to memory of 1780	2344	msedge.exe	88
PID 2344 wrote to memory of 1780	2344	msedge.exe	88
PID 2344 wrote to memory of 1780	2344	msedge.exe	88
PID 2344 wrote to memory of 1780	2344	msedge.exe	88
PID 2344 wrote to memory of 1780	2344	msedge.exe	88
PID 2344 wrote to memory of 1780	2344	msedge.exe	88
PID 2344 wrote to memory of 1780	2344	msedge.exe	88
PID 2344 wrote to memory of 1780	2344	msedge.exe	88
PID 2344 wrote to memory of 1780	2344	msedge.exe	88
PID 2344 wrote to memory of 1780	2344	msedge.exe	88
PID 2344 wrote to memory of 1780	2344	msedge.exe	88
PID 2344 wrote to memory of 1780	2344	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dixonvalve.com/en/home
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90de746f8,0x7ff90de74708,0x7ff90de74718
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4201829282181754666,10836978497549253831,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,4201829282181754666,10836978497549253831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,4201829282181754666,10836978497549253831,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4201829282181754666,10836978497549253831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4201829282181754666,10836978497549253831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4201829282181754666,10836978497549253831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,4201829282181754666,10836978497549253831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,4201829282181754666,10836978497549253831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4201829282181754666,10836978497549253831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4201829282181754666,10836978497549253831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4201829282181754666,10836978497549253831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4201829282181754666,10836978497549253831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4201829282181754666,10836978497549253831,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
768B

MD5
a11f172c96b7fc3a79767fa956626a30

SHA1
96e1bf846291026c9b22d1c4596bd7285378c8e7

SHA256
8e7c499cdb4cb838a68cbb6d6510ea7c796d650052790369a502bfc89854cdf6

SHA512
e87c8957474d339ce8c490713637569513d27330858660cdf959b9d14818e97d560a7e6652aeaa4b3381f6c1ad215b004757e8677a41d3858cf9c017bb2063e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
dfabcd14885656fead133a7c275527f0

SHA1
e1263534759d82497730e84980b086e85e5db536

SHA256
9fac9a083fff6d83c7b64b8c8f5131b8c8cf3bc145a01faca558208cd3173833

SHA512
10f76afe068c3101fd9ba8450d3c92e8bfec020ff93ea370e8ce017ebc84e28ba481f0e7782c5d7c0001e19e89a2e69cd299a8d51bf9f3f088d7e3dc230a143e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cadc00aba7e85936b6b3e12607351497

SHA1
0eb0d7a4128b58467cbe79e2067b8a086a130fd3

SHA256
11ab0a8d2d860318717203306a438520a11f165c1296a45088a6f20b8c7b6478

SHA512
72df6ec866bd933bd1ecbf4bfe5b3a0ee378bcab753149f9b7051b4f2d6dbafe46457065d58d2f5316bb0d6add0232cebd451b458ca50cdaf4dcd7dbc4796414

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
401944b5ddc755d1bfd22dfaec37d24c

SHA1
f6fe1a3df40d58f9a1a9cb2d984544600266c5b3

SHA256
79c1d35e1befd28858d2c71fa14994af8b6e52a467a073cb531f72f9fee97db7

SHA512
78766d2d239ed5c7332a225587110ff8cba6ec7655f9c589633bc4dbd64331257aa348052d9b9466e55b04b8c94e470df37a0c764b3fa794581fabbedcd23f17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
cffb3b1ba6360cf1451086fb8237d5ee

SHA1
c0bf9791520917a63f8f292f2bcac34883ec43d3

SHA256
400ef68cbd02b698103c15c3be436b5ac5d173f41f8d84b774f74255277d5243

SHA512
a679d229c377b6ed50be2ab356a0b80697e16f2df92b61ae8b756679dca2b6fb8206911c5b80556181aa0c4cb8c5e3afb19c70308cf770182245a5978b778944

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe599a71.TMP

Filesize
2KB

MD5
eda8b63b7a3e40d3e6373eba85dac959

SHA1
254b2f033a85cdef820071ac51e0dc578e5bc08f

SHA256
ebff874cd5dcfb9f3cf00a8691b91f13ab54f975b58d2a3c4e82c0b93a3aebee

SHA512
af27d4f7f0b59db46aeec6d93554cc82cf828307e247849208fb9b56cc5f0c8101cfc5af54cbb80bdfa12eeaeb8ed17f21ca3c72d4ae46bd15b0465da7d53a84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
708cf81e85e6ff58ad04c67a3112c4db

SHA1
6411f13feef638ef15f64a2536019a0857842ae3

SHA256
de19bdc1a4cce58a8d95fe169f34e229537ed22248c602984eb065d0dc0ca37e

SHA512
a36e98c1f8591d4192e0088539de06f4149d9b8a835661c5526a3af32ed386f2791dd548e77273077571266c730a02c696c96032e3222541ebcf6d8e2dd0a87b

Download Submit