hxxp://webmail[.]sogeim[.]it/

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-09-2024 07:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://webmail.sogeim.it/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2404	msedge.exe
2404	msedge.exe
1620	msedge.exe
1620	msedge.exe
4404	identity_helper.exe
4404	identity_helper.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe
1660	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 4396	1620	msedge.exe	83
PID 1620 wrote to memory of 4396	1620	msedge.exe	83
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 3556	1620	msedge.exe	84
PID 1620 wrote to memory of 2404	1620	msedge.exe	85
PID 1620 wrote to memory of 2404	1620	msedge.exe	85
PID 1620 wrote to memory of 3108	1620	msedge.exe	86
PID 1620 wrote to memory of 3108	1620	msedge.exe	86
PID 1620 wrote to memory of 3108	1620	msedge.exe	86
PID 1620 wrote to memory of 3108	1620	msedge.exe	86
PID 1620 wrote to memory of 3108	1620	msedge.exe	86
PID 1620 wrote to memory of 3108	1620	msedge.exe	86
PID 1620 wrote to memory of 3108	1620	msedge.exe	86
PID 1620 wrote to memory of 3108	1620	msedge.exe	86
PID 1620 wrote to memory of 3108	1620	msedge.exe	86
PID 1620 wrote to memory of 3108	1620	msedge.exe	86
PID 1620 wrote to memory of 3108	1620	msedge.exe	86
PID 1620 wrote to memory of 3108	1620	msedge.exe	86
PID 1620 wrote to memory of 3108	1620	msedge.exe	86
PID 1620 wrote to memory of 3108	1620	msedge.exe	86
PID 1620 wrote to memory of 3108	1620	msedge.exe	86
PID 1620 wrote to memory of 3108	1620	msedge.exe	86
PID 1620 wrote to memory of 3108	1620	msedge.exe	86
PID 1620 wrote to memory of 3108	1620	msedge.exe	86
PID 1620 wrote to memory of 3108	1620	msedge.exe	86
PID 1620 wrote to memory of 3108	1620	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://webmail.sogeim.it/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff96f2046f8,0x7ff96f204708,0x7ff96f204718
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1492,17506739728728846531,16826352089290828703,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1492,17506739728728846531,16826352089290828703,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1492,17506739728728846531,16826352089290828703,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1492,17506739728728846531,16826352089290828703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1492,17506739728728846531,16826352089290828703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1492,17506739728728846531,16826352089290828703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1492,17506739728728846531,16826352089290828703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1492,17506739728728846531,16826352089290828703,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1492,17506739728728846531,16826352089290828703,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1492,17506739728728846531,16826352089290828703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1492,17506739728728846531,16826352089290828703,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1492,17506739728728846531,16826352089290828703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1492,17506739728728846531,16826352089290828703,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1492,17506739728728846531,16826352089290828703,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
211KB

MD5
e7226392c938e4e604d2175eb9f43ca1

SHA1
2098293f39aa0bcdd62e718f9212d9062fa283ab

SHA256
d46ec08b6c29c4ca56cecbf73149cc66ebd902197590fe28cd65dad52a08c4e1

SHA512
63a4b99101c790d40a813db9e0d5fde21a64ccaf60a6009ead027920dbbdb52cc262af829e5c4140f3702a559c7ac46efa89622d76d45b4b49a9ce01625ef145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
f6022e41e598e5b462d858dd99962e9c

SHA1
6e0064382583c9569e9ff47430941dece19aeae5

SHA256
d7edb4328f4a547584546890f2d1cd03d7772826ca936f5ae4223ba9247b16be

SHA512
da1e9d327e8c5cca6a385f42f6a1c1757bc582f14e9660d31466408a2691537fb3004ef84f467831a13545bc750ceb256b78a758c9040b7f6d6529e3da727525

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7b5bace039c61e47a1861fea6f3fdf22

SHA1
df90a3901e078903745dc097cb99872fee334931

SHA256
9d5f9dfeea9f89f31a06b67b145941d2fb4db022de55da701cfeb4200590777f

SHA512
7acaea3efc91cdf5db12d00fd41cbecc2ef9e5cce4ee90235468e4c30d8be0d55c2b31f0607b8c42b13879fdae3656f9c604b6b51a43c922dad6b29fa4f8abe4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bf1f9c1a5f5e8328bd7cf4adc1e5834c

SHA1
2409bc8df33352381f5d2b3506c682238ae9e8a8

SHA256
627a85417b14dd9aecfd77923691d7c6d4beb1e5c72222d4c03eabfc1f29db2c

SHA512
ce72409518bded055b0cef4da327a4f01a3b1faf5364c11476a7f5ec2fe59902cf7004086b78978024f570a21c78bd0e3921ecead6d9bf69145130bb8d8d5633

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9a5727419a8ee0f23dec8c7753b5f10e

SHA1
4b275bd6f68b23183d03ab972e6765f88f888291

SHA256
c29370a6ba08406932a48a47419bf79cd3a774a071776a36f7170004e957a4d3

SHA512
fa98195e71e87a1ab5bf026642b00adce1a0ac0920c3759846820e2c6e1a6dc7f89cd6f984030545e34000c60c53452e4d66be916307b2caadee0050783d1185

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6054686e01a7ba2a1af9a15c4339a22d

SHA1
73ac28df507257528aa51eaad682841996f6f6f5

SHA256
20bc3373313a73e09a8e3785ce15f3f07b3f8aa7f2b49ffbe3a0d20c8688b643

SHA512
4a1c776be576386b80a37be9b4dd800cd94570532292f7866700924ebb0e9517bff7814f4b064444ced954d47c1ae32aa1669ff141ff9dca77f7b0ecbacb3e56

Download Submit