hxxps://7ehdjhnjneo[.]z28[.]web[.]core[.]windows[.]net/?lu=aHR0cHM6Ly9wdWItZDcyZDdkMTViZDAxNDk0Nzg1YTRhZjI5MjZjOGM1NWMucjIuZGV2Lzg0ODc4NjM3Njg0LzQyZmcyN2RuLmh0bWwjYW1WaGJpMTVkbVZ6TG1KeVlYTmphRUJuY21Gd2FHbDBaV05vTFc1MVkyeGxZWEl1WTI5dA==

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 09:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://7ehdjhnjneo.z28.web.core.windows.net/?lu=aHR0cHM6Ly9wdWItZDcyZDdkMTViZDAxNDk0Nzg1YTRhZjI5MjZjOGM1NWMucjIuZGV2Lzg0ODc4NjM3Njg0LzQyZmcyN2RuLmh0bWwjYW1WaGJpMTVkbVZ6TG1KeVlYTmphRUJuY21Gd2FHbDBaV05vTFc1MVkyeGxZWEl1WTI5dA==

Score

4^/10

discovery phishing

Malware Config

Signatures

Detected phishing page
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
2980	msedge.exe
2980	msedge.exe
2400	identity_helper.exe
2400	identity_helper.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 4720	2980	msedge.exe	83
PID 2980 wrote to memory of 4720	2980	msedge.exe	83
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 2040	2980	msedge.exe	84
PID 2980 wrote to memory of 4772	2980	msedge.exe	85
PID 2980 wrote to memory of 4772	2980	msedge.exe	85
PID 2980 wrote to memory of 3816	2980	msedge.exe	86
PID 2980 wrote to memory of 3816	2980	msedge.exe	86
PID 2980 wrote to memory of 3816	2980	msedge.exe	86
PID 2980 wrote to memory of 3816	2980	msedge.exe	86
PID 2980 wrote to memory of 3816	2980	msedge.exe	86
PID 2980 wrote to memory of 3816	2980	msedge.exe	86
PID 2980 wrote to memory of 3816	2980	msedge.exe	86
PID 2980 wrote to memory of 3816	2980	msedge.exe	86
PID 2980 wrote to memory of 3816	2980	msedge.exe	86
PID 2980 wrote to memory of 3816	2980	msedge.exe	86
PID 2980 wrote to memory of 3816	2980	msedge.exe	86
PID 2980 wrote to memory of 3816	2980	msedge.exe	86
PID 2980 wrote to memory of 3816	2980	msedge.exe	86
PID 2980 wrote to memory of 3816	2980	msedge.exe	86
PID 2980 wrote to memory of 3816	2980	msedge.exe	86
PID 2980 wrote to memory of 3816	2980	msedge.exe	86
PID 2980 wrote to memory of 3816	2980	msedge.exe	86
PID 2980 wrote to memory of 3816	2980	msedge.exe	86
PID 2980 wrote to memory of 3816	2980	msedge.exe	86
PID 2980 wrote to memory of 3816	2980	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://7ehdjhnjneo.z28.web.core.windows.net/?lu=aHR0cHM6Ly9wdWItZDcyZDdkMTViZDAxNDk0Nzg1YTRhZjI5MjZjOGM1NWMucjIuZGV2Lzg0ODc4NjM3Njg0LzQyZmcyN2RuLmh0bWwjYW1WaGJpMTVkbVZ6TG1KeVlYTmphRUJuY21Gd2FHbDBaV05vTFc1MVkyeGxZWEl1WTI5dA==
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa803c46f8,0x7ffa803c4708,0x7ffa803c4718
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,261374829892016757,6891805941419314730,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,261374829892016757,6891805941419314730,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,261374829892016757,6891805941419314730,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,261374829892016757,6891805941419314730,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,261374829892016757,6891805941419314730,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,261374829892016757,6891805941419314730,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,261374829892016757,6891805941419314730,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3548 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,261374829892016757,6891805941419314730,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3548 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,261374829892016757,6891805941419314730,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,261374829892016757,6891805941419314730,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,261374829892016757,6891805941419314730,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,261374829892016757,6891805941419314730,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,261374829892016757,6891805941419314730,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
a91ffc4d3661d08cb92b6ef253bd5191

SHA1
1d36f81b8baff5f14c2c42ec984fedf139583188

SHA256
09ae6ce399a82554b6a96d3fed27a1d577b9b634cb84df0d4b671822c41fe152

SHA512
ed644dc8c3e8dea887852d053f8a78695f4c680750f6f520540e1d1daf91f6233e735c4bdd1b0a4b07108b9bb34d5773e8c1fce132d693cda2a1e7f81aa68de4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0c3bac0a37924f1a1792d4c304b97830

SHA1
86ba4de357ad181ab189b093ee16d6f45d7623d2

SHA256
51ead67d05984c5f78e87ee9f4d173218fbfbde88101ed87f9d04b0dc3237941

SHA512
7c76f7902801d06cd60a902690452afa957fff4c878decf40f00b8f3fd7aa7d29ac8af541d89bc5f4060b3931a6d9d7948bd35f7a293d3d5e83fbfc1a52f90b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c3855444db7cdecaed2cdb1fd9ff2c19

SHA1
4fbc117d0dfa9e0b3e0473665ba09bc2e558306b

SHA256
52d3ca8388085c66d73c8b44c8e8ebb546d1b06f793a05b1ac12e99cfafb926c

SHA512
bc605b2a0024151e7a9c9f3277e253ae674c97c4d5cbaba2447590008cd6a141412e17344207909a9ed1cf60b8aa15222a15a2d48e67c617ec1ed3790ce28b51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b6704bab50d04880bca16fb48f61351c

SHA1
612f75fc901bce4b34e97e03c5e12f2bc06c8dc9

SHA256
55ace97708b925110739a4f7ea38eb373cb1a22256c63357053d18bde3b0a76a

SHA512
b29e545133245e9e700d0e51d6675166c590e3b86031467b2edc949c19652070c11750a5992d1cdd657812cbcf9742e4473b78f95d7ba8011687e199e1fc23ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
642ae3688b802c4763ea2234fadb77ef

SHA1
518a35da19e44ad403df92d6b7f944df137815ff

SHA256
381c18f7cef865682d00749a4685475c254659a7f45ac66fd6a9e64a95dedd70

SHA512
5df5ca4b2174f2dd9149656a81e6eb32833fb56f6d9518a2f1c5f0fb3d55edab9795f52b49035b13c23e860bff555ff7e167f098255228428424d7e50827a411

Download Submit