hxxps://finatal[.]us2[.]list-manage[.]com/track/click?u=f73f7708eca5e1d2f61bc2a09&id=82613a7740&e=6cee04d59a

Resubmissions

19/11/2024, 12:47

241119-p1dgyswcmd 3

19/11/2024, 11:55

241119-n3q1dsvhqd 3

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 11:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://finatal.us2.list-manage.com/track/click?u=f73f7708eca5e1d2f61bc2a09&id=82613a7740&e=6cee04d59a

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1600	msedge.exe
1600	msedge.exe
3080	msedge.exe
3080	msedge.exe
3684	identity_helper.exe
3684	identity_helper.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 4884	3080	msedge.exe	84
PID 3080 wrote to memory of 4884	3080	msedge.exe	84
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 4984	3080	msedge.exe	85
PID 3080 wrote to memory of 1600	3080	msedge.exe	86
PID 3080 wrote to memory of 1600	3080	msedge.exe	86
PID 3080 wrote to memory of 3016	3080	msedge.exe	87
PID 3080 wrote to memory of 3016	3080	msedge.exe	87
PID 3080 wrote to memory of 3016	3080	msedge.exe	87
PID 3080 wrote to memory of 3016	3080	msedge.exe	87
PID 3080 wrote to memory of 3016	3080	msedge.exe	87
PID 3080 wrote to memory of 3016	3080	msedge.exe	87
PID 3080 wrote to memory of 3016	3080	msedge.exe	87
PID 3080 wrote to memory of 3016	3080	msedge.exe	87
PID 3080 wrote to memory of 3016	3080	msedge.exe	87
PID 3080 wrote to memory of 3016	3080	msedge.exe	87
PID 3080 wrote to memory of 3016	3080	msedge.exe	87
PID 3080 wrote to memory of 3016	3080	msedge.exe	87
PID 3080 wrote to memory of 3016	3080	msedge.exe	87
PID 3080 wrote to memory of 3016	3080	msedge.exe	87
PID 3080 wrote to memory of 3016	3080	msedge.exe	87
PID 3080 wrote to memory of 3016	3080	msedge.exe	87
PID 3080 wrote to memory of 3016	3080	msedge.exe	87
PID 3080 wrote to memory of 3016	3080	msedge.exe	87
PID 3080 wrote to memory of 3016	3080	msedge.exe	87
PID 3080 wrote to memory of 3016	3080	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://finatal.us2.list-manage.com/track/click?u=f73f7708eca5e1d2f61bc2a09&id=82613a7740&e=6cee04d59a
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa303246f8,0x7ffa30324708,0x7ffa30324718
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,14477984501556025731,14490152081960108769,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,14477984501556025731,14490152081960108769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2572 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,14477984501556025731,14490152081960108769,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14477984501556025731,14490152081960108769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14477984501556025731,14490152081960108769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,14477984501556025731,14490152081960108769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,14477984501556025731,14490152081960108769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14477984501556025731,14490152081960108769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14477984501556025731,14490152081960108769,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14477984501556025731,14490152081960108769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14477984501556025731,14490152081960108769,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,14477984501556025731,14490152081960108769,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
195B

MD5
ca231a0de9999273c3e208aee479a838

SHA1
2d67d2031652e5fe7343f48ed093802342797b56

SHA256
d9bd5f75f905bcb968e2fab3fb1a92c7f421d159c33d6173fae01d07a0474abc

SHA512
a7fabc2adfe3efb86889f258d0621516f35a36bceb7642c76aa50d3cc32f233261830a2080a4f7dbc6b9b2b311fb92723505f4bc2cdff16d418f24ebb253e31d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
242a5aaa9da3cf784608ff1c3d084315

SHA1
7e69efa6198b1964418bc03bc07794c9744594f0

SHA256
39f8b6a1afd596b38a53e05e25d30a78e64595c7e1e8891201061465dcb55140

SHA512
7a97777b638b00c0a01b74756fdf2719fecee736a210871eb55adea8bcf23264d2af04cb5a14b9825fca31286a55d018608b6940cf102f3bfe9a76080097c2db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8a16301212d6dc6955e5a96b44bd003d

SHA1
b2cd3792c116e8500da40772e2267bc9f2b1f682

SHA256
3577f8546b6943875c4d3c141abf0f5a6c2869a795e3dfa0f1e6f1e1c0c5a09a

SHA512
0dbe75e4912930b28148863301410b3b4a3ac239670925570080d7d937c5c7e3027865569af1704d367cfd064c8cf3f0b63175247de6561393e3cb7838d9b8f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4f699007eb120a50001dce2a3fee4d0a

SHA1
706adb73fbaaf41ca66f97c978979ad15a2c9f3c

SHA256
2040e6b6b0ca38cb69cb4e00b643a6238496f2b126a9b8a55273a4d046081dc5

SHA512
9884db6c3303ee7905698394471ebf24aae75175f9a47163426d7edc6b74b5aed6a22fd6a91411eeaf862c685edc13af09c4d707ed2ce5a12f99b6226affad8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
9abf1c460e094773ffb87be206b774f3

SHA1
0f233d25722e7973dfff6672c9bdb7f7a3f25bb9

SHA256
a5a921d492b984132bf095929d12eb9f4ebb3383c634b2722e2eb7e2fc79e8e0

SHA512
25e13546072631fd4acc81dfaba728b336f485b7bc2dd99d7d03e8c6e4f86fbaeb7227109e725cf0ac14d56c76d307805e890939b6a05259afca5a6d158e9168

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57db4c.TMP

Filesize
204B

MD5
8b8f1437debd5a1f2e29fe729457897f

SHA1
e235617ba86d03376eb7058f7fe68bd898fc0736

SHA256
8b107de26be5635796aa7b70b9cf2c1b6ab95106448346b61182fc45654be976

SHA512
695eb88a1f999cc241ca7921fb316838df2be6226cbbc91167202acae35e875fa379ce0787a8892ca1f136605862bf5becfe01df363833948d9cf7ff9af910ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
46ee228d9b5dcd79bbc25b1f5fd3d8f5

SHA1
85c633660691d84a95ab0d49cd3244bf83d736eb

SHA256
0a708f689a485db3149b22138924a93052752d29b2308c68118270304c5795bf

SHA512
faee9eb04a66076bc0cd490f836aafc1832864e6b45ec7654dee9e1d33a7186840a81acc8720cb4ad508aba6ca26b67f2e90cde5d7f4018382bd89dd4ace95f3

Download Submit