Analysis
-
max time kernel
75s -
max time network
77s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2024 17:37
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
-
Mark of the Web detected: This indicates that the page was originally saved or cloned. 2 IoCs
flow ioc 54 https://ggn-achterstand.com/ 17 https://ggn-achterstand.com/ -
Detected phishing page
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3668 msedge.exe 3668 msedge.exe 3096 msedge.exe 3096 msedge.exe 1812 identity_helper.exe 1812 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe 3096 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3096 wrote to memory of 3760 3096 msedge.exe 84 PID 3096 wrote to memory of 3760 3096 msedge.exe 84 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 5000 3096 msedge.exe 85 PID 3096 wrote to memory of 3668 3096 msedge.exe 86 PID 3096 wrote to memory of 3668 3096 msedge.exe 86 PID 3096 wrote to memory of 4788 3096 msedge.exe 87 PID 3096 wrote to memory of 4788 3096 msedge.exe 87 PID 3096 wrote to memory of 4788 3096 msedge.exe 87 PID 3096 wrote to memory of 4788 3096 msedge.exe 87 PID 3096 wrote to memory of 4788 3096 msedge.exe 87 PID 3096 wrote to memory of 4788 3096 msedge.exe 87 PID 3096 wrote to memory of 4788 3096 msedge.exe 87 PID 3096 wrote to memory of 4788 3096 msedge.exe 87 PID 3096 wrote to memory of 4788 3096 msedge.exe 87 PID 3096 wrote to memory of 4788 3096 msedge.exe 87 PID 3096 wrote to memory of 4788 3096 msedge.exe 87 PID 3096 wrote to memory of 4788 3096 msedge.exe 87 PID 3096 wrote to memory of 4788 3096 msedge.exe 87 PID 3096 wrote to memory of 4788 3096 msedge.exe 87 PID 3096 wrote to memory of 4788 3096 msedge.exe 87 PID 3096 wrote to memory of 4788 3096 msedge.exe 87 PID 3096 wrote to memory of 4788 3096 msedge.exe 87 PID 3096 wrote to memory of 4788 3096 msedge.exe 87 PID 3096 wrote to memory of 4788 3096 msedge.exe 87 PID 3096 wrote to memory of 4788 3096 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://kenmerk738381-ggn.nl/t1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbbcb646f8,0x7ffbbcb64708,0x7ffbbcb647182⤵PID:3760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,6939215883434813375,8157870462664800516,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:22⤵PID:5000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,6939215883434813375,8157870462664800516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,6939215883434813375,8157870462664800516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:82⤵PID:4788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,6939215883434813375,8157870462664800516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:3132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,6939215883434813375,8157870462664800516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:2312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,6939215883434813375,8157870462664800516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:12⤵PID:4364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,6939215883434813375,8157870462664800516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:82⤵PID:3604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,6939215883434813375,8157870462664800516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,6939215883434813375,8157870462664800516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:12⤵PID:1264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,6939215883434813375,8157870462664800516,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:12⤵PID:3652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,6939215883434813375,8157870462664800516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:12⤵PID:4380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,6939215883434813375,8157870462664800516,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:12⤵PID:3464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,6939215883434813375,8157870462664800516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:1280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,6939215883434813375,8157870462664800516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:12⤵PID:3640
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2280
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4688
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dc058ebc0f8181946a312f0be99ed79c
SHA10c6f376ed8f2d4c275336048c7c9ef9edf18bff0
SHA256378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a
SHA51236e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa
-
Filesize
152B
MD5a0486d6f8406d852dd805b66ff467692
SHA177ba1f63142e86b21c951b808f4bc5d8ed89b571
SHA256c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be
SHA512065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a
-
Filesize
188B
MD559b2f17faac8e18504046a2aa772038c
SHA166b0acf4aae340ae94a8f0108f310d1ffd12e276
SHA2560e6d4bf679ee374a3307e832f2058efa39e6447631e800f0242b07e9e9f56acd
SHA51239b412d320c851371d71bdf4353c29fac48ae902388afd2bd94a45cc1555a764dd58663c78637ce1f50516637bf96f47607e829f5bdb6158f5cc16f9ba57e072
-
Filesize
6KB
MD52ffd15fc57df28d6f8508fdadf7f2736
SHA12ac00b545cd707f1205eeda472e9bac69a617673
SHA2569180c093cdb31af73ff1f00ed6a51fe75f74e62c0d0d42c937eba4ee67ed50d6
SHA5129534bf4a7dc2f1d9344709ff57510ea3f56b8afd71592a4ee5018a509ed49339414cf9688ebc7df91d904357dcd7fd88d43d7abf5f00eb272d1815096bc41507
-
Filesize
6KB
MD5cf0dfb41a1203e1d2c074230fe8c8e51
SHA1a10dba53eff3bfdfa2910bff32edea7aa152d56b
SHA256b1563885271a76fb640b5d94303064d2a7563ffe5fc82de998d84840ac15c60e
SHA512367f3b3778545cc65e293af0855d040befa6767814e2aacdbdd8fad5e44371d377e5f65c8f20fee5cdfa2900ae43504d64ca251178747a82c245ebf86affe5aa
-
Filesize
5KB
MD54f476ac3de8d2796f0c7c49411d30209
SHA18ace0bcabff18ced10bb1f36d1b200cbb5913aef
SHA256b9dae81ad9d0247fd1ccd274331b6772da4139ada1682cbfdfb69685c13e567b
SHA51207a239697c3ef6b522f149b30b6c128cacbc3dba90759a571c441134f27bfdb3b45a302d1e0489a24ed38ad69411775ef3f59f520aff15f96783cc45f0f24115
-
Filesize
6KB
MD5ce4e8b1f8cbe88a96d15f75df4ff72c0
SHA134e5807ffa2397962d8519e794170ef210d79d62
SHA25616f0964b7e5b98567afb65a9f50c115e2f003c1ec965cbfcbed797eba0bb9bbc
SHA51227d1e086cfe70af9deef7a0c52be3190bd0e7cdf9abdbe84aff7cb381b30e84c3611996da94b4f8d1d96fffa37a80fc572e172f42e3a247de09b7e6111a88721
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5e5ac9b43c4cfc2b27171d2a2c19a9a2c
SHA1a6c48109c452a2f8e1acd37d03b7bb7084e29cb4
SHA256bb90bc60411b00c1aced2a6c3f291dc440d4fad9897636d9c29017a7a60c2d2a
SHA512ca87634dac8a5e87c0171c88f05eacbafe7b7546b5096e642a6fcd071ec51b9ef3a143a451001e1b1ddec68a2a929140f16e8bd354fcf6ca6b2a5e3b629c0cde
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84