hxxp://amasterdam[.]nl

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-09-2024 12:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://amasterdam.nl

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
692	msedge.exe
692	msedge.exe
4652	msedge.exe
4652	msedge.exe
3956	identity_helper.exe
3956	identity_helper.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 1076	4652	msedge.exe	83
PID 4652 wrote to memory of 1076	4652	msedge.exe	83
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 736	4652	msedge.exe	84
PID 4652 wrote to memory of 692	4652	msedge.exe	85
PID 4652 wrote to memory of 692	4652	msedge.exe	85
PID 4652 wrote to memory of 1900	4652	msedge.exe	86
PID 4652 wrote to memory of 1900	4652	msedge.exe	86
PID 4652 wrote to memory of 1900	4652	msedge.exe	86
PID 4652 wrote to memory of 1900	4652	msedge.exe	86
PID 4652 wrote to memory of 1900	4652	msedge.exe	86
PID 4652 wrote to memory of 1900	4652	msedge.exe	86
PID 4652 wrote to memory of 1900	4652	msedge.exe	86
PID 4652 wrote to memory of 1900	4652	msedge.exe	86
PID 4652 wrote to memory of 1900	4652	msedge.exe	86
PID 4652 wrote to memory of 1900	4652	msedge.exe	86
PID 4652 wrote to memory of 1900	4652	msedge.exe	86
PID 4652 wrote to memory of 1900	4652	msedge.exe	86
PID 4652 wrote to memory of 1900	4652	msedge.exe	86
PID 4652 wrote to memory of 1900	4652	msedge.exe	86
PID 4652 wrote to memory of 1900	4652	msedge.exe	86
PID 4652 wrote to memory of 1900	4652	msedge.exe	86
PID 4652 wrote to memory of 1900	4652	msedge.exe	86
PID 4652 wrote to memory of 1900	4652	msedge.exe	86
PID 4652 wrote to memory of 1900	4652	msedge.exe	86
PID 4652 wrote to memory of 1900	4652	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://amasterdam.nl
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83db846f8,0x7ff83db84708,0x7ff83db84718
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,17356565030790975784,7995833000380213581,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,17356565030790975784,7995833000380213581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,17356565030790975784,7995833000380213581,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17356565030790975784,7995833000380213581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17356565030790975784,7995833000380213581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17356565030790975784,7995833000380213581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17356565030790975784,7995833000380213581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,17356565030790975784,7995833000380213581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,17356565030790975784,7995833000380213581,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17356565030790975784,7995833000380213581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17356565030790975784,7995833000380213581,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17356565030790975784,7995833000380213581,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17356565030790975784,7995833000380213581,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,17356565030790975784,7995833000380213581,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
211KB

MD5
e7226392c938e4e604d2175eb9f43ca1

SHA1
2098293f39aa0bcdd62e718f9212d9062fa283ab

SHA256
d46ec08b6c29c4ca56cecbf73149cc66ebd902197590fe28cd65dad52a08c4e1

SHA512
63a4b99101c790d40a813db9e0d5fde21a64ccaf60a6009ead027920dbbdb52cc262af829e5c4140f3702a559c7ac46efa89622d76d45b4b49a9ce01625ef145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
95ef639ce6dbe627181e7599767d1888

SHA1
1c185e8a2c1cd9425da70b510f66dd3b883848ca

SHA256
32c4ac6ab96925fdf42d360c04c2c24631d3d988bbe1f5de68058e2b8d1803a6

SHA512
fa8c68660506d8bdd26055d882f17c2c70f71343e466385ff47485d1e7848f21b7d10db774cd31a924a434f7585a4f1b62f421501f59c11cb975f909b5b293d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5fdf7e9869df905994a7aa805090fe5d

SHA1
f19c932e830360954e82a5169c70bdc7060b77c0

SHA256
682727c0acf0f0c74c9fb6302c78ef94d6b8df20472bc022b2fcb0c83dd150b6

SHA512
af2553f1f4354b143c75bdb5c6cb377ef9f916ea2a2e0b716130d9432261407e82fe9c5470bcff272f373d28e7889fcba35f933a22d190883b6433ffd97a4950

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
281766a9f4c2ad6a6938156eddc2f063

SHA1
0411480396c746f3890961ecf8b01aea66e00553

SHA256
8699324cc13396e7b80dd8e9fa7f81ec1a068427be2fc2c614794d48039ba7d7

SHA512
46da3ad415331db7e0b83f0b1f845258b9bbebcfc743a64fe76fb1e61284530f3ccd2d30f6036d0eae7a92aea19b34b4253db271040bb79197a20e644074daeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e423df4303c91ca8c669fb740068f8c8

SHA1
7aae46b823c694553903074eacf54db0aacfe586

SHA256
0616e61649b3e1057048d0cf6be7c70c8f538feee6386e893aeabf48dc11c7c3

SHA512
ce72f51eb351d36373153cb6de738f56ecdcabc5c58adc32cdcac6a3d2f5db77fa99ac6e2b9d0a9a527ac073a27b881c63ac025fef875ffcb5fa5a3788fa7af1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
951d2c9dfd3b69c1d6a1b1681d35dfe2

SHA1
cf082741509405587d505438e89ec23b9968ca6a

SHA256
8ac64ea8cd0ff52acd88bae7fe20838459a3d2aaee18b1fb3e4da25aa8ed13c5

SHA512
6cbda7f8e08a3d404e442b0807d72de955216865d246daa0f1b16003b6744015ce851b6e7052aa0f1d01026cc7bb28137378e09532817fe0497d75ec85018471

Download Submit