hxxps://www[.]artificial-intelligence-cobots-manufacturing[.]com/unsubscribe

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2024 15:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.artificial-intelligence-cobots-manufacturing.com/unsubscribe

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe
2432	msedge.exe
2432	msedge.exe
2368	identity_helper.exe
2368	identity_helper.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe
2820	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 4892	2432	msedge.exe	83
PID 2432 wrote to memory of 4892	2432	msedge.exe	83
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 2072	2432	msedge.exe	84
PID 2432 wrote to memory of 4364	2432	msedge.exe	85
PID 2432 wrote to memory of 4364	2432	msedge.exe	85
PID 2432 wrote to memory of 4796	2432	msedge.exe	86
PID 2432 wrote to memory of 4796	2432	msedge.exe	86
PID 2432 wrote to memory of 4796	2432	msedge.exe	86
PID 2432 wrote to memory of 4796	2432	msedge.exe	86
PID 2432 wrote to memory of 4796	2432	msedge.exe	86
PID 2432 wrote to memory of 4796	2432	msedge.exe	86
PID 2432 wrote to memory of 4796	2432	msedge.exe	86
PID 2432 wrote to memory of 4796	2432	msedge.exe	86
PID 2432 wrote to memory of 4796	2432	msedge.exe	86
PID 2432 wrote to memory of 4796	2432	msedge.exe	86
PID 2432 wrote to memory of 4796	2432	msedge.exe	86
PID 2432 wrote to memory of 4796	2432	msedge.exe	86
PID 2432 wrote to memory of 4796	2432	msedge.exe	86
PID 2432 wrote to memory of 4796	2432	msedge.exe	86
PID 2432 wrote to memory of 4796	2432	msedge.exe	86
PID 2432 wrote to memory of 4796	2432	msedge.exe	86
PID 2432 wrote to memory of 4796	2432	msedge.exe	86
PID 2432 wrote to memory of 4796	2432	msedge.exe	86
PID 2432 wrote to memory of 4796	2432	msedge.exe	86
PID 2432 wrote to memory of 4796	2432	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.artificial-intelligence-cobots-manufacturing.com/unsubscribe
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa202f46f8,0x7ffa202f4708,0x7ffa202f4718
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,15545754620758581188,2791218641042631384,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,15545754620758581188,2791218641042631384,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,15545754620758581188,2791218641042631384,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15545754620758581188,2791218641042631384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15545754620758581188,2791218641042631384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15545754620758581188,2791218641042631384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15545754620758581188,2791218641042631384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15545754620758581188,2791218641042631384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,15545754620758581188,2791218641042631384,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,15545754620758581188,2791218641042631384,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15545754620758581188,2791218641042631384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15545754620758581188,2791218641042631384,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15545754620758581188,2791218641042631384,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15545754620758581188,2791218641042631384,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,15545754620758581188,2791218641042631384,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6116 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
682808465369c5577a66d8ecdb05e095

SHA1
4f5e72071552ee66796c52394d950ed99b014aed

SHA256
b39a062ccf71a0e1924477b4c72b19decebcc1e25021e94cc54e5ba9f4747dff

SHA512
126c8e81f87d3dec89d9eeb7b1fb24351ff76e96b01f47afbc8c44420f5a57f8f7f194a48095ec9e018d4ac70abe8cea444d45a75b3d7195cba97dadbe1fcfdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
24f3bdfe1b0665dbfc4313461dff8f0c

SHA1
a3ed2040209da42b65c393b53388d5b63cd826e4

SHA256
34afabe31672b70cb0ca092c6e6b72cdae4905222e370d285d4321b84c808ae9

SHA512
eaa835528cdd827c88899cfb449160096ea55cc7f257b4a74e3bf299e81da8263f07b223a33594c00ade1e3f5b7e8792784073d0fb273883d8f9e14e5812dab0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7606c0868b7c7dfe62821a23c8c6b03c

SHA1
1eed1426f86788d38836f0508d9e7c72e1134a3e

SHA256
c964c3744343fe58235b8160f54f19fc4fca2faf87f5c0f8d6d41fa35875ad4d

SHA512
e2ba75b6ac10d0e774c3560d8fb7f6baaa856dd97b2c2ffdd90cbda4f8e7922aa91b35a7fe2855a661168cda9897e84602c18645e0e23a09e7d1dfc7337a651c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c0dd93a3ef7f6e400f2a2b2fd54a36e7

SHA1
d1bf99127d9aaef79a0e1dd73de1cd512de11ae6

SHA256
48fb6f9621f4f48f114d5485c7785bdbb86c60b048cc3a80e25fe5dabbc594c3

SHA512
d9f363737abb601fc2fa37b8963dfcc1b4bafef108439dfb055f1f38cf64f318c1990a8b7343705ed77f7be41653252c3fa1b19a68b9e4a8f00bc8019260860d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
accad805297bf3183d39cb70941bd36e

SHA1
4f719c23b6b52b699c848b7039fbf5a9dd5f588d

SHA256
c39966b3b742958dff79b52039c803960b7080f40a623806b9cf594322c26d8d

SHA512
899289508b72f6f5339b8652dba35de05c9c1c4b66d77faddebe7e5738d9dc7a2257afb0e94d809168abbc127865d8f3a27145259548b632cb85ede18a009aeb

Download Submit