hxxps://trustwallet[.]com/

Analysis

max time kernel
17s
max time network
19s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2024 19:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://trustwallet.com/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1480	msedge.exe
1480	msedge.exe
4160	msedge.exe
4160	msedge.exe
2300	identity_helper.exe
2300	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 3088	4160	msedge.exe	84
PID 4160 wrote to memory of 3088	4160	msedge.exe	84
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1524	4160	msedge.exe	85
PID 4160 wrote to memory of 1480	4160	msedge.exe	86
PID 4160 wrote to memory of 1480	4160	msedge.exe	86
PID 4160 wrote to memory of 2028	4160	msedge.exe	87
PID 4160 wrote to memory of 2028	4160	msedge.exe	87
PID 4160 wrote to memory of 2028	4160	msedge.exe	87
PID 4160 wrote to memory of 2028	4160	msedge.exe	87
PID 4160 wrote to memory of 2028	4160	msedge.exe	87
PID 4160 wrote to memory of 2028	4160	msedge.exe	87
PID 4160 wrote to memory of 2028	4160	msedge.exe	87
PID 4160 wrote to memory of 2028	4160	msedge.exe	87
PID 4160 wrote to memory of 2028	4160	msedge.exe	87
PID 4160 wrote to memory of 2028	4160	msedge.exe	87
PID 4160 wrote to memory of 2028	4160	msedge.exe	87
PID 4160 wrote to memory of 2028	4160	msedge.exe	87
PID 4160 wrote to memory of 2028	4160	msedge.exe	87
PID 4160 wrote to memory of 2028	4160	msedge.exe	87
PID 4160 wrote to memory of 2028	4160	msedge.exe	87
PID 4160 wrote to memory of 2028	4160	msedge.exe	87
PID 4160 wrote to memory of 2028	4160	msedge.exe	87
PID 4160 wrote to memory of 2028	4160	msedge.exe	87
PID 4160 wrote to memory of 2028	4160	msedge.exe	87
PID 4160 wrote to memory of 2028	4160	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://trustwallet.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffdcac46f8,0x7fffdcac4708,0x7fffdcac4718
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,112835933975187464,3358235768918119950,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,112835933975187464,3358235768918119950,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,112835933975187464,3358235768918119950,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,112835933975187464,3358235768918119950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,112835933975187464,3358235768918119950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,112835933975187464,3358235768918119950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,112835933975187464,3358235768918119950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,112835933975187464,3358235768918119950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,112835933975187464,3358235768918119950,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,112835933975187464,3358235768918119950,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,112835933975187464,3358235768918119950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,112835933975187464,3358235768918119950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,112835933975187464,3358235768918119950,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,112835933975187464,3358235768918119950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,112835933975187464,3358235768918119950,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:3528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
8a842b30f6486ac9f0a26f5364e1d6ca

SHA1
9cca28ff0a604a8b198c43349c4f57ec2718a381

SHA256
969dcb4b16a896cd2c9a0197df45cfd20cca35fa4c65f9043ff74d1c5e0bf1d2

SHA512
a9b25614649b28e2135846839aa7121baa2bbf584a4f28156f2df2501b69132a8d1f987104fdee4033d5a9c1c1b96f5ccd668a68bff20b6d8cceb2138abdfabb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
349B

MD5
1e93c27a69876f883f0cba3acd47a5d7

SHA1
0e09c6c84861ee341fbee8fbab3a51a5baf0d2db

SHA256
ebe902227ed5d7a1dd74bbb7a22b7a67197d5d45269336493f6b2e472974af98

SHA512
d86e6d71adea9b5131d23f4cb2e4fd744976751cab7247c2e080af60d53583dc0215aae76d82abcfd9405116a4b502270c285d30eddb44538326c302c820840c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b2937be2fc26cbca26657aeb9c53339c

SHA1
324be295e844d3ccce6b9bb988fa1f58111b50a9

SHA256
83d0da0db7e46b366d153e91b0cf66495cc5c1a5b64734999ddb9a0e5650813c

SHA512
34656609aba6e6480d2e482238bbde70fdc66890f89ba0a78de11b3fc32e7466a25f822872d570ca58d314455b689f8dd40a0630aedf49fc0d6ed7ee3df3eb75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1b80a788d3a0f28c888e9914e393ec9a

SHA1
09fa526e9c644a84b4c6ba1a64fb9804df8fe6d1

SHA256
858a628b24365de4072cb306d8a41c957b516b8ce42dddf77a081e72deae6228

SHA512
821ad3b17beec0d83d03d0a91ed17738c09921f10a74f7ce0d18a353118c3dee0ffaac85e17d245968728658fc4a93581b9d4270b4fbfc1c0f499531513ea8c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3782d88a3fbda2d0be37a65ebd1fa981

SHA1
90606cbffd737bae86c4dca4162c5cdf4dc16d25

SHA256
39ccc48c8d487c883931c0a875b68a72264837f9c893c2ef0eb9f1b130b1122b

SHA512
818c41f820a8369b19dfba485066c1e9cb8854aa359e931bd4cf385267f2ef69d713973aa751ed64e3f86224b792b47a947285f9d32bcf68f5b7b64a69762399

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
aa70b81512e7a31c888a904a1d56c900

SHA1
5743ef85a078bf30b35ae41808a22e85e83cf6fe

SHA256
d04de69b87992d8ad6b3a2f61335c0d2b413260d5206e487564d39242836d7f8

SHA512
d2553c6e0d9c5762f66d1ecf5e7bc862887c89651804d20b9ad1d039f0f4cb5457b72e470cab3a2b3e89068569b93cb15b37b75999304ac11da0d8128f0cf2a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
59d532e0f0875f08affe13f6020a88b1

SHA1
c3dcd9e500d98a4b67a3ebc3ba6468d24f4933e0

SHA256
1aace5dc974c0255f4863f4400d9ce14728da655a9ce87054e473c53a189748b

SHA512
ad492ccc451e30acf0414c8ed5b77125e362cb6f4b1495efdeb282b68939930ba6e9ceb691f53cf6fd3899d06381f229d3321c35d1c2a080dd8fb498d2e13082

Download Submit