hxxps://edf[.]cinasev[.]com/

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 12:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://edf.cinasev.com/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
436	msedge.exe
436	msedge.exe
544	msedge.exe
544	msedge.exe
4592	identity_helper.exe
4592	identity_helper.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 544 wrote to memory of 1004	544	msedge.exe	82
PID 544 wrote to memory of 1004	544	msedge.exe	82
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 5052	544	msedge.exe	83
PID 544 wrote to memory of 436	544	msedge.exe	84
PID 544 wrote to memory of 436	544	msedge.exe	84
PID 544 wrote to memory of 3880	544	msedge.exe	85
PID 544 wrote to memory of 3880	544	msedge.exe	85
PID 544 wrote to memory of 3880	544	msedge.exe	85
PID 544 wrote to memory of 3880	544	msedge.exe	85
PID 544 wrote to memory of 3880	544	msedge.exe	85
PID 544 wrote to memory of 3880	544	msedge.exe	85
PID 544 wrote to memory of 3880	544	msedge.exe	85
PID 544 wrote to memory of 3880	544	msedge.exe	85
PID 544 wrote to memory of 3880	544	msedge.exe	85
PID 544 wrote to memory of 3880	544	msedge.exe	85
PID 544 wrote to memory of 3880	544	msedge.exe	85
PID 544 wrote to memory of 3880	544	msedge.exe	85
PID 544 wrote to memory of 3880	544	msedge.exe	85
PID 544 wrote to memory of 3880	544	msedge.exe	85
PID 544 wrote to memory of 3880	544	msedge.exe	85
PID 544 wrote to memory of 3880	544	msedge.exe	85
PID 544 wrote to memory of 3880	544	msedge.exe	85
PID 544 wrote to memory of 3880	544	msedge.exe	85
PID 544 wrote to memory of 3880	544	msedge.exe	85
PID 544 wrote to memory of 3880	544	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://edf.cinasev.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdac1d46f8,0x7ffdac1d4708,0x7ffdac1d4718
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,6389905559868044215,12102158816283730673,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,6389905559868044215,12102158816283730673,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,6389905559868044215,12102158816283730673,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6389905559868044215,12102158816283730673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6389905559868044215,12102158816283730673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,6389905559868044215,12102158816283730673,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,6389905559868044215,12102158816283730673,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6389905559868044215,12102158816283730673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6389905559868044215,12102158816283730673,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6389905559868044215,12102158816283730673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6389905559868044215,12102158816283730673,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,6389905559868044215,12102158816283730673,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
473B

MD5
0804a9b0828d220cd9631b47822ece0c

SHA1
3316d93cb4ff7cb6275edef960f7ee0ae93a5ce5

SHA256
d979be44e2933f3b0ca884c0c2e52795d14b1b9e7a2c111834ad60368af6568c

SHA512
56da54a52212428fb5bc18e2cf69fc727984c3cdab176141118389151a4694bb4331e09e11baedffe822e361e9152ebfc1931d22272c8eba50e77a15fb5e5449

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9536d1f11d1c84ac5a99fde1c7aac20f

SHA1
ea0c4b56e8637fd73205f64a101d47215e84cd61

SHA256
ea147772904374e47ec9b1f8930c1d9f44847bddeb6481e11c4618c282d6f9b5

SHA512
2a67c3bfc113439f61d4337fcef0e0c007d1b6b2f01d53a932baef331ce6f19d32187b4e97312c4d4e3eaa172052dc477a2da7abef4f92c0b64f916a25e805d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1542298f2aa01a121a4161eec8eaf6fc

SHA1
48f3c10759d6d1a8ce8c1422fed9c3b41f5a01ac

SHA256
a24d90a0369057dd36997a73503c701d9d33963d421c2098f7ad12a689352f68

SHA512
b5ea1a06a6ab1eb0924d4d39876c4a2567e58a804c5eed1807921f5bf4f39c83c2f24c8d960736d71f85df260ca158f22b11f496a209b158557095d791592762

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c0597b97506ea7bf003191a34a055007

SHA1
d05cae1cdfbcc7c2c64e51003b01eb4d067158f3

SHA256
c550b72f4b9f5d8737440e57b5664323b8b8862e01019ea9e738e5542d73d86c

SHA512
c56b2da6a070277ce627d70552c62ea8190707dee4b7c1ae25f64bc6188c317ee78e16884bdca2197e17418e70f45770f97f4e33b912f56d909bdcaa0a321851

Download Submit