hxxps://mandrillapp[.]com/track/click/30929223/globalstage[.]ro?p%3DeyJzIjoiVHhrNG9RRTZrNzNCRmNjSjRMWlJTZWh0Rnc4IiwidiI6MSwicCI6IntcInVcIjozMDkyOTIyMyxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2dsb2JhbHN0YWdlLnJvXFxcL3dwLWNvbnRlbnRcXFwvbGFuZ3VhXCIsXCJpZFwiOlwiMmIwZDg5OTkxNDZhNDU5NWE0NTVlNDI1ZmIzMDhlOGJcIixcInVybF9pZHNcIjpbXCJhZjU2NzBjOGI1MDQ3OWU2MjllZjNkNzc4NGU5MTUzYmQ4YmM2MzE0XCJdfSJ9

Analysis

max time kernel
145s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 13:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mandrillapp.com/track/click/30929223/globalstage.ro?p%3DeyJzIjoiVHhrNG9RRTZrNzNCRmNjSjRMWlJTZWh0Rnc4IiwidiI6MSwicCI6IntcInVcIjozMDkyOTIyMyxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2dsb2JhbHN0YWdlLnJvXFxcL3dwLWNvbnRlbnRcXFwvbGFuZ3VhXCIsXCJpZFwiOlwiMmIwZDg5OTkxNDZhNDU5NWE0NTVlNDI1ZmIzMDhlOGJcIixcInVybF9pZHNcIjpbXCJhZjU2NzBjOGI1MDQ3OWU2MjllZjNkNzc4NGU5MTUzYmQ4YmM2MzE0XCJdfSJ9

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3600	msedge.exe
3600	msedge.exe
2236	msedge.exe
2236	msedge.exe
3284	identity_helper.exe
3284	identity_helper.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe
2236	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1460	2236	msedge.exe	83
PID 2236 wrote to memory of 1460	2236	msedge.exe	83
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 4136	2236	msedge.exe	84
PID 2236 wrote to memory of 3600	2236	msedge.exe	85
PID 2236 wrote to memory of 3600	2236	msedge.exe	85
PID 2236 wrote to memory of 1920	2236	msedge.exe	86
PID 2236 wrote to memory of 1920	2236	msedge.exe	86
PID 2236 wrote to memory of 1920	2236	msedge.exe	86
PID 2236 wrote to memory of 1920	2236	msedge.exe	86
PID 2236 wrote to memory of 1920	2236	msedge.exe	86
PID 2236 wrote to memory of 1920	2236	msedge.exe	86
PID 2236 wrote to memory of 1920	2236	msedge.exe	86
PID 2236 wrote to memory of 1920	2236	msedge.exe	86
PID 2236 wrote to memory of 1920	2236	msedge.exe	86
PID 2236 wrote to memory of 1920	2236	msedge.exe	86
PID 2236 wrote to memory of 1920	2236	msedge.exe	86
PID 2236 wrote to memory of 1920	2236	msedge.exe	86
PID 2236 wrote to memory of 1920	2236	msedge.exe	86
PID 2236 wrote to memory of 1920	2236	msedge.exe	86
PID 2236 wrote to memory of 1920	2236	msedge.exe	86
PID 2236 wrote to memory of 1920	2236	msedge.exe	86
PID 2236 wrote to memory of 1920	2236	msedge.exe	86
PID 2236 wrote to memory of 1920	2236	msedge.exe	86
PID 2236 wrote to memory of 1920	2236	msedge.exe	86
PID 2236 wrote to memory of 1920	2236	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://mandrillapp.com/track/click/30929223/globalstage.ro?p%3DeyJzIjoiVHhrNG9RRTZrNzNCRmNjSjRMWlJTZWh0Rnc4IiwidiI6MSwicCI6IntcInVcIjozMDkyOTIyMyxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2dsb2JhbHN0YWdlLnJvXFxcL3dwLWNvbnRlbnRcXFwvbGFuZ3VhXCIsXCJpZFwiOlwiMmIwZDg5OTkxNDZhNDU5NWE0NTVlNDI1ZmIzMDhlOGJcIixcInVybF9pZHNcIjpbXCJhZjU2NzBjOGI1MDQ3OWU2MjllZjNkNzc4NGU5MTUzYmQ4YmM2MzE0XCJdfSJ9
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffb34246f8,0x7fffb3424708,0x7fffb3424718
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,7489850276973278403,14481043458634478745,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,7489850276973278403,14481043458634478745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,7489850276973278403,14481043458634478745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7489850276973278403,14481043458634478745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7489850276973278403,14481043458634478745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,7489850276973278403,14481043458634478745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4764 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,7489850276973278403,14481043458634478745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7489850276973278403,14481043458634478745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7489850276973278403,14481043458634478745,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7489850276973278403,14481043458634478745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7489850276973278403,14481043458634478745,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,7489850276973278403,14481043458634478745,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3060 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
183B

MD5
24e197d632901488dd8713cd35aef683

SHA1
7ea504f5c5e7e63a5cae96c98f9f428d0bcc74c3

SHA256
88d4f4a7167f7eede606088e3c820ff60413dfec6558db3ef4adfc3b777a51c8

SHA512
fd07252174c01be2973d6d785b5e17599adcaee3b9af009be853d91bc7f05ae57b8c6f0735768a05678590d8c02b4fbe0dc4d627e9978af9501cbe29af1d046a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
722d98b3508dd0e17c434e97b2bd71a7

SHA1
6f95cf3457ab2cacf434a8e05f1c8af96b59bc2b

SHA256
04dc59988177dc27f447ef83f6baebe61ec4d6a6a175391f40471be365548f42

SHA512
43c834198fc5e5e095c68a9fbf0dde5602a4eee156648a33d84e2cf7997e55f527575bd2a1bd9274ccd73518480d01e91defcd95245ce836fe84dfc21ce8f557

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3a9c3638ff3d062ea966c40adda2e2b6

SHA1
eb9d518f328ce39c3e3f327ddd7e680ec9b37b67

SHA256
8d342917e8d890c85ba65cc6defa4ef3438d88c63f1e9bf4178cd095366fc74a

SHA512
83937d4ec91d88f0f2deeb52c79a9be0edecbe946b5ae521e55b15eb6df999057023ea0ef2970c3d9f87eacf6203250cad76ade3b85fe3c39a3579154b0c8d34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f7786b2c9b889ee49a20dab4e1b6ae53

SHA1
7e4ed363e8106d0f14f3216ff4663e806f0d3a5c

SHA256
36bd7fbf81a36a31c59e1620e25ab06521f18f24028756a583ed7fe0b244e49c

SHA512
ede6a8f70e7b81ae60b35ec71b668fd0bba2842e0517617299a5c5adafc091c9b06e00e4b742bada8fa77c15fb9abade038288fdc01c2efa566746a57175777f

Download Submit