hxxps://www[.]peeringdb[.]com/asn/13335

Analysis

max time kernel
145s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-09-2024 17:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.peeringdb.com/asn/13335

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1848	msedge.exe
1848	msedge.exe
2452	msedge.exe
2452	msedge.exe
4964	identity_helper.exe
4964	identity_helper.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 1752	2452	msedge.exe	84
PID 2452 wrote to memory of 1752	2452	msedge.exe	84
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1360	2452	msedge.exe	85
PID 2452 wrote to memory of 1848	2452	msedge.exe	86
PID 2452 wrote to memory of 1848	2452	msedge.exe	86
PID 2452 wrote to memory of 3852	2452	msedge.exe	87
PID 2452 wrote to memory of 3852	2452	msedge.exe	87
PID 2452 wrote to memory of 3852	2452	msedge.exe	87
PID 2452 wrote to memory of 3852	2452	msedge.exe	87
PID 2452 wrote to memory of 3852	2452	msedge.exe	87
PID 2452 wrote to memory of 3852	2452	msedge.exe	87
PID 2452 wrote to memory of 3852	2452	msedge.exe	87
PID 2452 wrote to memory of 3852	2452	msedge.exe	87
PID 2452 wrote to memory of 3852	2452	msedge.exe	87
PID 2452 wrote to memory of 3852	2452	msedge.exe	87
PID 2452 wrote to memory of 3852	2452	msedge.exe	87
PID 2452 wrote to memory of 3852	2452	msedge.exe	87
PID 2452 wrote to memory of 3852	2452	msedge.exe	87
PID 2452 wrote to memory of 3852	2452	msedge.exe	87
PID 2452 wrote to memory of 3852	2452	msedge.exe	87
PID 2452 wrote to memory of 3852	2452	msedge.exe	87
PID 2452 wrote to memory of 3852	2452	msedge.exe	87
PID 2452 wrote to memory of 3852	2452	msedge.exe	87
PID 2452 wrote to memory of 3852	2452	msedge.exe	87
PID 2452 wrote to memory of 3852	2452	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.peeringdb.com/asn/13335
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e2d446f8,0x7ff9e2d44708,0x7ff9e2d44718
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,7314320029039900049,9846092972815924744,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,7314320029039900049,9846092972815924744,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,7314320029039900049,9846092972815924744,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7314320029039900049,9846092972815924744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7314320029039900049,9846092972815924744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7314320029039900049,9846092972815924744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,7314320029039900049,9846092972815924744,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,7314320029039900049,9846092972815924744,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7314320029039900049,9846092972815924744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7314320029039900049,9846092972815924744,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7314320029039900049,9846092972815924744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7314320029039900049,9846092972815924744,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1256 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,7314320029039900049,9846092972815924744,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=180 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
ddb166ace7b773545149ed3c58c9bbaa

SHA1
7894472c28978ab578d0f69fe118ccc3cca9e95a

SHA256
f3c9a27341ed7c85500b2f1653a4ea57903e4f6d3afed1194c6e4d35f84b72c2

SHA512
a4716685905f2c7019da9e6d11522e5942206e603d371565aac0a958e056cbdd6e8402239b9eb0e158c70f97d79a03a39948607b99bc9d9bb61bb3aa9b55d785

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f4f3abd8e861ef505fbb8914b625355e

SHA1
3e96470f0e263e6f6684487242693cf88e467eab

SHA256
a7348ac684bb1aa908e89d0d9eaac9ec24bc72f333cc705c34dbb8b9ebf62e17

SHA512
681be3f48a1383dca881ca59efc9c10772d29c1e972be10588e7956d9711642bd4ec011101b9cf1a6520fc57f3dc17bcea849447865f947a67a39ad5499d48fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bcd9f7d46299ea4f71f712a419f3d2ff

SHA1
5a3685d11d8cc3090d7938e9b8762fb763425883

SHA256
1438237c9003a8f71cd0d7c1e61d60ee96231106f119ef166441921e13cbb1c7

SHA512
b92bbb89eeb84d485b716b231a5f2119b3b19c5c83f3f2ee1276c1bf63eb07e9936df283790e2c407d9084448b83d2e478f1fb8a507710b5199c8b90ebc097a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5a090e0bd27530f6a8588532672ef055

SHA1
2201388040106a70c588a1e056ab6c6bb2f3c402

SHA256
ebbe6261a2e89a5be6b3223c1bdf47e963f7aca622f6712bfcf125a79f449d71

SHA512
6f5938aaf790d301e26b2ad24d61ed7d996708e828bc50ee4aef12e329c6970888f226c65671d0cdca1b37931c5390e639ab1f66442573e7b373742b1a1bd316

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6cd5a9b2c568786d4943307374d644d7

SHA1
7b3f1673e7c4a0e86708c3f6f1c8569b7c53ad4f

SHA256
67d70e431b6759083d1191223aca7ff7285448dbe10153beff0b503df0af7287

SHA512
9008e8169afee1757f214ff65b35a193dafe5428bded00c5c6a70fa5c37a02ee8c8290705a1a4f0c71e9c35faf3c88ce064ab3bbc4aee967140c786c769c2711

Download Submit