hxxps://myaccess[.]microsoft[.]com/bcgov[.]onmicrosoft[.]com#/access-reviews/955be4b2-6b47-4951-9104-7efd62b2cae2

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2024 17:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://myaccess.microsoft.com/bcgov.onmicrosoft.com#/access-reviews/955be4b2-6b47-4951-9104-7efd62b2cae2

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4676	msedge.exe
4676	msedge.exe
608	msedge.exe
608	msedge.exe
4220	identity_helper.exe
4220	identity_helper.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe
608	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 608 wrote to memory of 4448	608	msedge.exe	82
PID 608 wrote to memory of 4448	608	msedge.exe	82
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4564	608	msedge.exe	83
PID 608 wrote to memory of 4676	608	msedge.exe	84
PID 608 wrote to memory of 4676	608	msedge.exe	84
PID 608 wrote to memory of 2588	608	msedge.exe	85
PID 608 wrote to memory of 2588	608	msedge.exe	85
PID 608 wrote to memory of 2588	608	msedge.exe	85
PID 608 wrote to memory of 2588	608	msedge.exe	85
PID 608 wrote to memory of 2588	608	msedge.exe	85
PID 608 wrote to memory of 2588	608	msedge.exe	85
PID 608 wrote to memory of 2588	608	msedge.exe	85
PID 608 wrote to memory of 2588	608	msedge.exe	85
PID 608 wrote to memory of 2588	608	msedge.exe	85
PID 608 wrote to memory of 2588	608	msedge.exe	85
PID 608 wrote to memory of 2588	608	msedge.exe	85
PID 608 wrote to memory of 2588	608	msedge.exe	85
PID 608 wrote to memory of 2588	608	msedge.exe	85
PID 608 wrote to memory of 2588	608	msedge.exe	85
PID 608 wrote to memory of 2588	608	msedge.exe	85
PID 608 wrote to memory of 2588	608	msedge.exe	85
PID 608 wrote to memory of 2588	608	msedge.exe	85
PID 608 wrote to memory of 2588	608	msedge.exe	85
PID 608 wrote to memory of 2588	608	msedge.exe	85
PID 608 wrote to memory of 2588	608	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://myaccess.microsoft.com/bcgov.onmicrosoft.com#/access-reviews/955be4b2-6b47-4951-9104-7efd62b2cae2
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd774046f8,0x7ffd77404708,0x7ffd77404718
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,16742292021319267902,3973883136008720535,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,16742292021319267902,3973883136008720535,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,16742292021319267902,3973883136008720535,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,16742292021319267902,3973883136008720535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,16742292021319267902,3973883136008720535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,16742292021319267902,3973883136008720535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,16742292021319267902,3973883136008720535,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,16742292021319267902,3973883136008720535,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,16742292021319267902,3973883136008720535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,16742292021319267902,3973883136008720535,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,16742292021319267902,3973883136008720535,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,16742292021319267902,3973883136008720535,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,16742292021319267902,3973883136008720535,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
98a7464be05defef73b7906654dbad39

SHA1
69b13540f2c51caaf01e7c26a151346403ffceb2

SHA256
a3d9f3e91a9f29f5fdec4045af1b8883eef760cfcd6307e593f7b2adff0b034b

SHA512
cb53209f7b59f748edc9433cb55fc0e8b6549c6934414d545d4c4f08bb2a47b72ab6819900141c8ffe54e680b8f6a1f2eed1e4d30cc44ab4ce00b502bf9ed1f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
535B

MD5
eba5e1e2618914bcb0c6580e2bdae631

SHA1
52a5666d39ad2a2fa487fa9bd868d1f5d4a09875

SHA256
45d5b3eb74d78c4d167ae57620624c9346a994fb39386f7d0958216144c7802f

SHA512
06359b5f463829527c56da356bd179587b7cadec18b07b3f6cb78cafc1188f5d8d532b487173625434ea2d8dc28a3cd31ef7ce5d41f2015539233bd852c660d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b2b2a132e2d259d3c2b96cc1d6d0183d

SHA1
aedd3a6be6cc1fb51aeccacbb62309a8f208abd4

SHA256
e55b8a3ea7311c34ee859b00b6ff99c788b9d51c1b665fe15e728994d662d71c

SHA512
606f35004194f80a24a1b57038b77f725d02d0fced5ecf22a8689324c3b5a12e887f62e2c1e881d4270dcd86eb9729fd653674d255749f2cac376008a5fbeaf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\eef3b0ec-2ecc-4e2a-ba74-7bad383acaa3.tmp

Filesize
5KB

MD5
f7b4d92ec3fc6d09d9d4f744efb9c73a

SHA1
0d90ee3d492f04013a2fedb8e7bed87aac38631a

SHA256
e5767c76c59a0d867fefffd0070959e1f86238776be05c5b042388e4c4d51ebc

SHA512
af5a724f5871be972e27c48bd2d8fbef0fcd728ab5fb60f72b3d12af1387b2fef23d29a5c1ee228c8dff12858fd42e2885e4cd84e930b7ab3e0bc3dd1ae49497

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f7a533c57c5efd160b8e0fea3624ade8

SHA1
d649f51b9e681cd3374b010360e0852edeaefc29

SHA256
265324ded9a2eb6332cafb77a0d5dd3742cc1c826e02f08d9c102e21f8742b89

SHA512
41a820feb6cc54c301aada32be10b13f8433c85f4dec3c754735558e81cd1d92f2e139eccde50665697ce53af375615d7645f50d11813e51d18b27708d4518df

Download Submit