hxxps://t[.]e2ma[.]net/optout/pmm6idb/pq9i7j3d?s=ADZspO42FBfVDOJtVpyzSXmXhO85BFioQsOzXM_5xls

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 03:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://t.e2ma.net/optout/pmm6idb/pq9i7j3d?s=ADZspO42FBfVDOJtVpyzSXmXhO85BFioQsOzXM_5xls

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4904	msedge.exe
4904	msedge.exe
1428	identity_helper.exe
1428	identity_helper.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 1960	4904	msedge.exe	86
PID 4904 wrote to memory of 1960	4904	msedge.exe	86
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4696	4904	msedge.exe	87
PID 4904 wrote to memory of 4828	4904	msedge.exe	88
PID 4904 wrote to memory of 4828	4904	msedge.exe	88
PID 4904 wrote to memory of 116	4904	msedge.exe	89
PID 4904 wrote to memory of 116	4904	msedge.exe	89
PID 4904 wrote to memory of 116	4904	msedge.exe	89
PID 4904 wrote to memory of 116	4904	msedge.exe	89
PID 4904 wrote to memory of 116	4904	msedge.exe	89
PID 4904 wrote to memory of 116	4904	msedge.exe	89
PID 4904 wrote to memory of 116	4904	msedge.exe	89
PID 4904 wrote to memory of 116	4904	msedge.exe	89
PID 4904 wrote to memory of 116	4904	msedge.exe	89
PID 4904 wrote to memory of 116	4904	msedge.exe	89
PID 4904 wrote to memory of 116	4904	msedge.exe	89
PID 4904 wrote to memory of 116	4904	msedge.exe	89
PID 4904 wrote to memory of 116	4904	msedge.exe	89
PID 4904 wrote to memory of 116	4904	msedge.exe	89
PID 4904 wrote to memory of 116	4904	msedge.exe	89
PID 4904 wrote to memory of 116	4904	msedge.exe	89
PID 4904 wrote to memory of 116	4904	msedge.exe	89
PID 4904 wrote to memory of 116	4904	msedge.exe	89
PID 4904 wrote to memory of 116	4904	msedge.exe	89
PID 4904 wrote to memory of 116	4904	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.e2ma.net/optout/pmm6idb/pq9i7j3d?s=ADZspO42FBfVDOJtVpyzSXmXhO85BFioQsOzXM_5xls
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd73946f8,0x7ffcd7394708,0x7ffcd7394718
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,14550141095055507234,6880750345042169795,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,14550141095055507234,6880750345042169795,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,14550141095055507234,6880750345042169795,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14550141095055507234,6880750345042169795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14550141095055507234,6880750345042169795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,14550141095055507234,6880750345042169795,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,14550141095055507234,6880750345042169795,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14550141095055507234,6880750345042169795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14550141095055507234,6880750345042169795,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14550141095055507234,6880750345042169795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14550141095055507234,6880750345042169795,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,14550141095055507234,6880750345042169795,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3040 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
548B

MD5
a586c18b1c78f55ab855ab642457f41b

SHA1
c7a64774721eb98611ece80c28d653f3ed1c3487

SHA256
360165ed742da7c9f9a6c8057829d079867980d056438b2dc37d98e9fbb68176

SHA512
32a74e4aac363ba0d050048fb832bbc45e843108bb3c3a4515ce382ede88855d173a627a861ae3d53f4363a18bc313f3d39088d31dbedb30ba859e31f1e9813f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2fddb10939f566c56046e9d18cbd1f80

SHA1
200df4d339e7ebd4c34f5b123ab13271baf76c61

SHA256
adeb973b1b3a7c9b50f1d75e5097c3185511f0ff3208b02a4d93ad30b4d79b75

SHA512
9636c52c057df9f4b5f60cab173f246a8d3dd833a6b6b2f24053963129dbfee597cfee322edda795ea843afd79b39ccc3e8ff1106f7f0cce52d720f309bff64d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bb02b93150eaba981ee2a168ae948513

SHA1
3a204b1c0b93c6200136604c3cb485f7b680a790

SHA256
749ffd65a35385872299c62c04ea4334c1c7a2a8acfb33c61385bcf8a9cb180c

SHA512
c05433705ef52984d84628c3e37a042019762a65ab74c08b68c63f5a5cfd8feda422d28488dd821cb1f0041a23981abd1df0847ba3b742a46e0a684d711c3c4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
65ac8c80efbb0f1a344ff9112a3ad6ed

SHA1
7f8744be59cd68eef89a4a121df73e6b6bb63128

SHA256
a79d4b59add4b16597d92ec510adfd04ca77d5cc57903728d7c645db321b3a8c

SHA512
d80554de3f8c92f9b8c029473dc943aa1f4811e26dae1ff36333f7f03897580256792f7c2ad849a115579ba823fd87139630b8d9660969bce5c1e0ef54ec017e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
367B

MD5
7c7ed25598eff42c1e0d3038ec27f00c

SHA1
b6f03122c2dd93c953009c13bd3fda47a196da71

SHA256
eedd48c278104eea55bd760512bf72688538d3d511459afe21a98e0065f787a7

SHA512
ddf43f06d423faf02c2079a27d1a764c6794677f4706b13f6915ca9c483ad7f00cec47720784107ed50116c320ffd6d2c23a1a7962cc3e99625d65b372cd8194

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5814bc.TMP

Filesize
367B

MD5
faf341080dbc8d766e9ad1fc006e814a

SHA1
f41f0f6a2ba5943e993a645e485382ec959743c8

SHA256
d3703d8da906120e46747ef13effa79c3b8569e07c7a7093365f4fa6578af9ed

SHA512
e62c4bfce5b7f3878865e8cb2084c070a559829cf657cd8f16fa21b57dc418768ed2fbf130bb8d2bd7dbf7a155de6138d888178be1476e0a1986b70061e97c0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8c226cbf272e19dbb7fbedb183d3fa80

SHA1
1773faf794ca415f18c95ddfdb0da8c2980b80f4

SHA256
080ed92684ad4ba3cc85a2896dfb4da6acedc1ded0acbf6d7e6b6cf6217c01cf

SHA512
c3de386dfb2e83c88392278aa9d290edd18a88f3d453311ba898bc662333b62fb0b0b08b34ac35ff56b8fdca2d9e82006759965992fb12e0615210aad995a0f6

Download Submit