hxxp://bloxtools[.]eu/CopyToolV8

Analysis

max time kernel
40s
max time network
22s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
21/11/2024, 10:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://bloxtools.eu/CopyToolV8

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3448	msedge.exe
3448	msedge.exe
1492	msedge.exe
1492	msedge.exe
2344	msedge.exe
2344	msedge.exe
4676	identity_helper.exe
4676	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 2952	1492	msedge.exe	79
PID 1492 wrote to memory of 2952	1492	msedge.exe	79
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 4828	1492	msedge.exe	81
PID 1492 wrote to memory of 3448	1492	msedge.exe	82
PID 1492 wrote to memory of 3448	1492	msedge.exe	82
PID 1492 wrote to memory of 2188	1492	msedge.exe	83
PID 1492 wrote to memory of 2188	1492	msedge.exe	83
PID 1492 wrote to memory of 2188	1492	msedge.exe	83
PID 1492 wrote to memory of 2188	1492	msedge.exe	83
PID 1492 wrote to memory of 2188	1492	msedge.exe	83
PID 1492 wrote to memory of 2188	1492	msedge.exe	83
PID 1492 wrote to memory of 2188	1492	msedge.exe	83
PID 1492 wrote to memory of 2188	1492	msedge.exe	83
PID 1492 wrote to memory of 2188	1492	msedge.exe	83
PID 1492 wrote to memory of 2188	1492	msedge.exe	83
PID 1492 wrote to memory of 2188	1492	msedge.exe	83
PID 1492 wrote to memory of 2188	1492	msedge.exe	83
PID 1492 wrote to memory of 2188	1492	msedge.exe	83
PID 1492 wrote to memory of 2188	1492	msedge.exe	83
PID 1492 wrote to memory of 2188	1492	msedge.exe	83
PID 1492 wrote to memory of 2188	1492	msedge.exe	83
PID 1492 wrote to memory of 2188	1492	msedge.exe	83
PID 1492 wrote to memory of 2188	1492	msedge.exe	83
PID 1492 wrote to memory of 2188	1492	msedge.exe	83
PID 1492 wrote to memory of 2188	1492	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://bloxtools.eu/CopyToolV8
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff924a13cb8,0x7ff924a13cc8,0x7ff924a13cd8
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,8995759424130424967,13473605849936167527,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,8995759424130424967,13473605849936167527,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,8995759424130424967,13473605849936167527,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,8995759424130424967,13473605849936167527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,8995759424130424967,13473605849936167527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,8995759424130424967,13473605849936167527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,8995759424130424967,13473605849936167527,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,8995759424130424967,13473605849936167527,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3264 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,8995759424130424967,13473605849936167527,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,8995759424130424967,13473605849936167527,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,8995759424130424967,13473605849936167527,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
826c7cac03e3ae47bfe2a7e50281605e

SHA1
100fbea3e078edec43db48c3312fbbf83f11fca0

SHA256
239b1d7cc6f76e1d1832b0587664f114f38a21539cb8548e25626ed5053ea2ab

SHA512
a82f3c817a6460fd8907a4ac6ab37c2129fb5466707edcfb565c255680d7f7212a5669fe2a42976150f16e4e549ea8310078f22ed35514ee1b7b45b46d8cc96e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
02a4b762e84a74f9ee8a7d8ddd34fedb

SHA1
4a870e3bd7fd56235062789d780610f95e3b8785

SHA256
366e497233268d7cdf699242e4b2c7ecc1999d0a84e12744f5af2b638e9d86da

SHA512
19028c45f2e05a0cb32865a2554513c1536bf9da63512ff4e964c94a3e171f373493c7787d2d2a6df8012648bbefab63a9de924f119c50c39c727cf81bdc659f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
430da86aaaca59a539087abca76f2e58

SHA1
24ed919247f03efdf131d2d712ca7403db0c6672

SHA256
edb4b3a39c8b14729a9aa9ef9bd1905e689a3c4f9b75d9b75da56c64c321fe1d

SHA512
f0846fa45d9c87c37e506fa5413a469fb447ebd5e965c0148a0c5e8e15d58d196ea518c0ce8d4d24f18a2b560933c3eda89419c21c055755eea4c201b99697f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6ea8e4a90b741147646ba503c490d3e5

SHA1
d4adaf648b9912271e12254907e4566fd1a8d024

SHA256
92ad49bcdf50e499fa078761880fbf9f5d8ec59c3f0a7900690ba81da6af672d

SHA512
1aa7773466130ab683358be6e9263147c4abbfa3431c7d0bc1c4f0ed7b159079e6ccd2f50694d44bb81a6d3469f92bf1b9b0acfc274e7f8f5e55cdbbfcd7dbbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
469bb99feaf73e6a10d27e0a2f67d886

SHA1
dfd239a8eb3ce44006f60278d9d368a6fe9c81a7

SHA256
e6fa3d2448dcfa93ffe53b0c1753236123ac42115dff254efe13e7a346dfc611

SHA512
52766111a94b9fdc8db87d9c220393d85af70a14d9020c2183ca268d3915bf35a7c61f2f0c8e3f44fe68cba5d14281345bc43fdb410cea599bec410f47ccc76c

Download Submit