hxxps://xinyuetech[.]en[.]alibaba[.]com/index[.]html?spm=a2700[.]shop_co[.]88[.]10[.]3eba7ae4zYThy3

Analysis

max time kernel
28s
max time network
30s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2024 04:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://xinyuetech.en.alibaba.com/index.html?spm=a2700.shop_co.88.10.3eba7ae4zYThy3

Score

10^/10

alibaba discovery phishing

Malware Config

Signatures

Detected alibaba phishing page
phishing alibaba
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3227495264-2217614367-4027411560-1000\{39A9A981-D390-4AE5-9CB5-B5C5134CA4CF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid	Process
2972	msedge.exe
2972	msedge.exe
1728	msedge.exe
1728	msedge.exe
1232	msedge.exe
1232	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

msedge.exe

pid	Process
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	Process
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	Process
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 1728 wrote to memory of 4840	1728	msedge.exe	81
PID 1728 wrote to memory of 4840	1728	msedge.exe	81
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2984	1728	msedge.exe	82
PID 1728 wrote to memory of 2972	1728	msedge.exe	83
PID 1728 wrote to memory of 2972	1728	msedge.exe	83
PID 1728 wrote to memory of 2544	1728	msedge.exe	84
PID 1728 wrote to memory of 2544	1728	msedge.exe	84
PID 1728 wrote to memory of 2544	1728	msedge.exe	84
PID 1728 wrote to memory of 2544	1728	msedge.exe	84
PID 1728 wrote to memory of 2544	1728	msedge.exe	84
PID 1728 wrote to memory of 2544	1728	msedge.exe	84
PID 1728 wrote to memory of 2544	1728	msedge.exe	84
PID 1728 wrote to memory of 2544	1728	msedge.exe	84
PID 1728 wrote to memory of 2544	1728	msedge.exe	84
PID 1728 wrote to memory of 2544	1728	msedge.exe	84
PID 1728 wrote to memory of 2544	1728	msedge.exe	84
PID 1728 wrote to memory of 2544	1728	msedge.exe	84
PID 1728 wrote to memory of 2544	1728	msedge.exe	84
PID 1728 wrote to memory of 2544	1728	msedge.exe	84
PID 1728 wrote to memory of 2544	1728	msedge.exe	84
PID 1728 wrote to memory of 2544	1728	msedge.exe	84
PID 1728 wrote to memory of 2544	1728	msedge.exe	84
PID 1728 wrote to memory of 2544	1728	msedge.exe	84
PID 1728 wrote to memory of 2544	1728	msedge.exe	84
PID 1728 wrote to memory of 2544	1728	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://xinyuetech.en.alibaba.com/index.html?spm=a2700.shop_co.88.10.3eba7ae4zYThy3
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5c5846f8,0x7ffe5c584708,0x7ffe5c584718
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,10283544234659289278,4221208650151486866,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,10283544234659289278,4221208650151486866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,10283544234659289278,4221208650151486866,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:8
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10283544234659289278,4221208650151486866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10283544234659289278,4221208650151486866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10283544234659289278,4221208650151486866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10283544234659289278,4221208650151486866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10283544234659289278,4221208650151486866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2128,10283544234659289278,4221208650151486866,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2128,10283544234659289278,4221208650151486866,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4004

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x478 0x474
1⤵
PID:4852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dfcc7693612b90196b31b9d3d1f44cf9

SHA1
72887df9e80220f67b8140faab830b7129215648

SHA256
00d632cdf23462a79d53c713f3bf132aa60c1ed454eb08ce89cbc129cc36bd0c

SHA512
907f0456f03f311ea645c2c5ead6cf9b0bebe059781df31f39bba02db5c85a96f34c08d4022d53becec3d5b1a97485a7fee2f9d9e4fce609aa1b73c22361ce1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
696099c986e45df3e0b6b0b5bdc4de50

SHA1
a7287916f1efcbe38dfb838efc5e194dd7e6aac3

SHA256
043609aa4a29267c0fe4a7799fc2c9ed0cf5700e7dc5d060331b26bf750ffc5b

SHA512
a7a564ee186e080b2411a91a1825f3a84ace3941c8e6a160849a2946fd035564d1de92b20debd8acbcd7a243ca66577559d520aa02b6f1503e2db38ad246c96f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d22d37e718cd9324c65664ffa16cdaad

SHA1
e3e342c652158f7dae32b89af6600bee3c96d781

SHA256
e858d7cc01d506be29b5f0b9e945d664f355e470c08d30becfd603f9370f6275

SHA512
2b89586bb67db181b774a289667937870a74766c7ad666c32555189bc0c414a21e2b0d5ff9d60abe3c59c16f7cf90614c2f63c4322717fd121c9407128dbe5d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5bbcb5.TMP

Filesize
1KB

MD5
c417fbb70658ace388db4417db92f3b9

SHA1
4558e32e892747a4a03535df90b16917bbbe3894

SHA256
86fb6cd5341da8af4d4da48d6e811b2a757ee4b4587bbcb16a6bb6861afe5265

SHA512
f8696305fcab07efdc35e2c577c7709e04c1f9ce97c06086c54ce7f835900f9086ca995f6d03a1e65660a9b56858768f2f5242899d01e74d7be2fb7109dbf5ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
62fa646e6336008dab3145722f087f51

SHA1
c8ff7cf04414e1a71e8369b3b50f81a22c688647

SHA256
350c38087dc5d852fb2c3a1ee33496ef3dd21444e091b6dbebfc3f05b25629c1

SHA512
824e0b06af0cbe9ef2dad99a0e6a2c26e99915a6fd7f2f837cbf43c1b37b830bcf30aaa39ef08009388b4e67979850d2648c685d6ee1afb5dd06e43893f49e7a

Download Submit
\??\pipe\LOCAL\crashpad_1728_PLHVNDPRYXITRHBJ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit