hxxps://pub-eceebbde34164c6a94e428fa59e8f396[.]r2[.]dev/oza[.]html#ahmed[.]adli@goc[.]ae

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 22:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://pub-eceebbde34164c6a94e428fa59e8f396.r2.dev/oza.html#[email protected]

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3056	msedge.exe
3056	msedge.exe
4120	msedge.exe
4120	msedge.exe
4804	identity_helper.exe
4804	identity_helper.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe
1432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

4120 msedge.exe
4120 msedge.exe
4120 msedge.exe
4120 msedge.exe
4120 msedge.exe
4120 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4120 wrote to memory of 3740	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 3740	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 1728	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 3056	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 3056	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 4868	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 4868	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 4868	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 4868	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 4868	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 4868	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 4868	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 4868	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 4868	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 4868	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 4868	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 4868	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 4868	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 4868	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 4868	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 4868	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 4868	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 4868	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 4868	4120	msedge.exe	msedge.exe
PID 4120 wrote to memory of 4868	4120	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://pub-eceebbde34164c6a94e428fa59e8f396.r2.dev/oza.html#[email protected]
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd769d46f8,0x7ffd769d4708,0x7ffd769d4718
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,15723329303315460507,12572455066018847216,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,15723329303315460507,12572455066018847216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,15723329303315460507,12572455066018847216,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15723329303315460507,12572455066018847216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15723329303315460507,12572455066018847216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,15723329303315460507,12572455066018847216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,15723329303315460507,12572455066018847216,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15723329303315460507,12572455066018847216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15723329303315460507,12572455066018847216,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15723329303315460507,12572455066018847216,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15723329303315460507,12572455066018847216,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,15723329303315460507,12572455066018847216,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
35f58be06c9980a6efef3e5be7a5fdfe

SHA1
0e311455731c955a70f584e1444a96e5f9412dda

SHA256
3f98d6e6343273dc71663f4536256bd8df2e5526f520f0ffd4730f8437ff3946

SHA512
0240c3b00cbf70e705babc27673e20775f586833a0e1952eb5ea8c62ae381d54e58657b36f2176c9e028394623d58b548b59549088095d9950921507f26fc0d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
701B

MD5
5f99a2f861f4a6b638bffe4617dc94bc

SHA1
afdfddbbfab618052fa45b89bbb6348345b474e6

SHA256
968c0f2c7ecc430b6cee502887becd4c7e526734d1563be9748acdd4cb402243

SHA512
d17691abe0a3c76e51884da8c0767dbe32a3cc7e364eb99f016b27824a689cf911d3fa30911e681da95dfcf4837a3456c15f8b1b8ee461cbec0dc3b1a6f662b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cc07ae603ced4c2e1ed0c3ad72772955

SHA1
b8a8681fd04f7cdbbb51eba332c333b4003634a2

SHA256
9cd364a605c34ae516959630c84d80f999aef440b57658f5d27c94fd81bf21cb

SHA512
e5f8adf056d4b9e708e43659173a6705616d679d324a7c20a365ce55fb40f7d95b2d2041cb23fa23fead7bbbb1c27297b06395e3af1b6e9e4f30659c2ed9314b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
04db16d044ed2bd3ef04db6d5bd5f480

SHA1
0d41fab2a2e1a2ce2d44a92a06c76217c5288c81

SHA256
4dd085454bbc8a7f5e93cc51cbcb1c0510787d68f07e6a3e564ec7b06053b0ed

SHA512
b343a50daaa5c1f3fcf4ea4d7d4212e99df48fbf9f0975a4816baab0e9b746351d378ed5158b5cf8eb5f4b0feaac41069bd790f3bff8234e90c22fd99996348e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d42e80da33db519be14be2c2c5acb11a

SHA1
422c24c2e56154d76294351ff8d4a411b244c42b

SHA256
0005caadcee55f3cd120768c1b07c0b22e972eb21f49b0344911033f156f867c

SHA512
66bbbfa5a8f483f959aca841085f472ee75f670743bce1ff2f678538eedca3b198f72d07d7897eab160d75ef26e0e5ea0569d3bc47c1be8257f4d583c2daeae3

Download Submit
\??\pipe\LOCAL\crashpad_4120_GVMYNPDLAVMNOBFS

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit