hxxp://wiki[.]pokeclicker[.]com

Analysis

max time kernel
145s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
12/09/2024, 18:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://wiki.pokeclicker.com

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3132	msedge.exe
3132	msedge.exe
2868	msedge.exe
2868	msedge.exe
3616	msedge.exe
3616	msedge.exe
676	identity_helper.exe
676	identity_helper.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 3740	2868	msedge.exe	78
PID 2868 wrote to memory of 3740	2868	msedge.exe	78
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 4864	2868	msedge.exe	79
PID 2868 wrote to memory of 3132	2868	msedge.exe	80
PID 2868 wrote to memory of 3132	2868	msedge.exe	80
PID 2868 wrote to memory of 2944	2868	msedge.exe	81
PID 2868 wrote to memory of 2944	2868	msedge.exe	81
PID 2868 wrote to memory of 2944	2868	msedge.exe	81
PID 2868 wrote to memory of 2944	2868	msedge.exe	81
PID 2868 wrote to memory of 2944	2868	msedge.exe	81
PID 2868 wrote to memory of 2944	2868	msedge.exe	81
PID 2868 wrote to memory of 2944	2868	msedge.exe	81
PID 2868 wrote to memory of 2944	2868	msedge.exe	81
PID 2868 wrote to memory of 2944	2868	msedge.exe	81
PID 2868 wrote to memory of 2944	2868	msedge.exe	81
PID 2868 wrote to memory of 2944	2868	msedge.exe	81
PID 2868 wrote to memory of 2944	2868	msedge.exe	81
PID 2868 wrote to memory of 2944	2868	msedge.exe	81
PID 2868 wrote to memory of 2944	2868	msedge.exe	81
PID 2868 wrote to memory of 2944	2868	msedge.exe	81
PID 2868 wrote to memory of 2944	2868	msedge.exe	81
PID 2868 wrote to memory of 2944	2868	msedge.exe	81
PID 2868 wrote to memory of 2944	2868	msedge.exe	81
PID 2868 wrote to memory of 2944	2868	msedge.exe	81
PID 2868 wrote to memory of 2944	2868	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://wiki.pokeclicker.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb4ba23cb8,0x7ffb4ba23cc8,0x7ffb4ba23cd8
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,364650769806142599,900441784100760364,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,364650769806142599,900441784100760364,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,364650769806142599,900441784100760364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,364650769806142599,900441784100760364,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,364650769806142599,900441784100760364,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,364650769806142599,900441784100760364,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,364650769806142599,900441784100760364,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3520 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,364650769806142599,900441784100760364,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,364650769806142599,900441784100760364,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,364650769806142599,900441784100760364,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,364650769806142599,900441784100760364,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,364650769806142599,900441784100760364,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,364650769806142599,900441784100760364,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3488 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
302c3de891ef3a75b81a269db4e1cf22

SHA1
5401eb5166da78256771e8e0281ca2d1f471c76f

SHA256
1d1640e5755779c90676290853d2e3ca948f57cf5fb1df4b786e277a97757f58

SHA512
da18e7d40376fd13255f3f67a004c3a7f408466bd7ce92e36a4d0c20441279fe4b1b6e0874ab74c494663fb97bd7992b5e7c264b3fc434c1e981326595263d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9efc5ba989271670c86d3d3dd581b39

SHA1
3ad714bcf6bac85e368b8ba379540698d038084f

SHA256
c2e16990b0f6f23efdcecd99044993a4c2b8ba87bd542dd8f6256d69e24b93b3

SHA512
c1bc0dc70ab827b54feb64ad069d21e1c3c28d57d126b08314a9670437881d77dba02b5cca57ef0f2aa7f8e7d4d163fbd2c6f246ea2d51ce201d61a89015e8b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\793ff840-bc7f-4aa7-ab23-62f5da3ae0a7.tmp

Filesize
1KB

MD5
76676398eb4ae97c0d4e21cc71ac7966

SHA1
fd230786e8c273ad3264bba7731fba58ab25c49d

SHA256
96940e0671baec341e887ee67ddef6a62d1d09919faef3a2326a532c8e8ea374

SHA512
19b89d4d508cb1136f2d3133759eb336e549d2e6aaa7b2ef25cba74dfbc1127a522ca50a4a2fd36ee7ef0a9f19bf3a7c6951fb3b35c775dd8c864b2758f20d09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
aaf934b5557638e7cc6b9715cf8e2a09

SHA1
7cab64c3462d1b55ea596b2fe614df5500bee60c

SHA256
a5587e307dfb07841ba4dac7861fcf242e5c84daa3f3364843de6bb1cca86a00

SHA512
7ce1734243435478e008d21d45a2a3ac4eb4de590ef0712a54727fbc744b2218250410d94cc46a774946f0c79f9c7c464e410d3d5900154563bdc94147955097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5c2dd3d76b827e7d363d38206173e32c

SHA1
b452710549c82ad382d06b6693580ee54c3c4044

SHA256
935aa421a2828cc97ca29e8de978763b3b963623271a29e54ee86bcc1cb7c245

SHA512
7e96ce2f6af8f72fc2d7be0f8ff309d04055fa7288dd3463d77caab7407917c11bbe0525300c689a9329a3d32a2e8fd193e46ad12f39ad481f345af41edd01ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
79cde3328bcd815494e4c51a28f440dd

SHA1
31d951e646aef74a144f1a141d6c4db29a155041

SHA256
e46b2367ccf28d3ceee3d1c4ce7bf32602873dd8e1e7fe4b06df878be4f91bca

SHA512
bdcbb8e507a2a78dec07a81801da93012308eb5ff4fa640cca5bbd0d0a116879b988b4a152c736be58e245a9b4dc18db4bc8fa15551e1adb56a4cdda74d476cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
57571408a743f388ea9bcfe21eec2756

SHA1
b0a8af32bdab9f65ae72f98fa21128b1d50170d2

SHA256
3321d8d1889e81a9c5b513b778fe35764cfab59d66ebe1cc17d27c3f01443d28

SHA512
21f2d6e248713e2bbb65c640c292a9fc660ec19605110ce9efb3b5363b13a1b24f0904a24960f246c8280a35ddc937c31ece5f7e19fe5983866f03200c2a1d40

Download Submit