Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-12-2024 04:51
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
-
A potential corporate email address has been identified in the URL: [email protected]
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2060 msedge.exe 2060 msedge.exe 952 msedge.exe 952 msedge.exe 1104 identity_helper.exe 1104 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 952 wrote to memory of 4764 952 msedge.exe 82 PID 952 wrote to memory of 4764 952 msedge.exe 82 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 3256 952 msedge.exe 83 PID 952 wrote to memory of 2060 952 msedge.exe 84 PID 952 wrote to memory of 2060 952 msedge.exe 84 PID 952 wrote to memory of 4268 952 msedge.exe 85 PID 952 wrote to memory of 4268 952 msedge.exe 85 PID 952 wrote to memory of 4268 952 msedge.exe 85 PID 952 wrote to memory of 4268 952 msedge.exe 85 PID 952 wrote to memory of 4268 952 msedge.exe 85 PID 952 wrote to memory of 4268 952 msedge.exe 85 PID 952 wrote to memory of 4268 952 msedge.exe 85 PID 952 wrote to memory of 4268 952 msedge.exe 85 PID 952 wrote to memory of 4268 952 msedge.exe 85 PID 952 wrote to memory of 4268 952 msedge.exe 85 PID 952 wrote to memory of 4268 952 msedge.exe 85 PID 952 wrote to memory of 4268 952 msedge.exe 85 PID 952 wrote to memory of 4268 952 msedge.exe 85 PID 952 wrote to memory of 4268 952 msedge.exe 85 PID 952 wrote to memory of 4268 952 msedge.exe 85 PID 952 wrote to memory of 4268 952 msedge.exe 85 PID 952 wrote to memory of 4268 952 msedge.exe 85 PID 952 wrote to memory of 4268 952 msedge.exe 85 PID 952 wrote to memory of 4268 952 msedge.exe 85 PID 952 wrote to memory of 4268 952 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://bluemountcapital.com/ldk1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff874cb46f8,0x7ff874cb4708,0x7ff874cb47182⤵PID:4764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,9971751672202472203,8453270058059643386,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:22⤵PID:3256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,9971751672202472203,8453270058059643386,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,9971751672202472203,8453270058059643386,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:82⤵PID:4268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9971751672202472203,8453270058059643386,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:4152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9971751672202472203,8453270058059643386,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:3396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9971751672202472203,8453270058059643386,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:12⤵PID:4356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,9971751672202472203,8453270058059643386,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 /prefetch:82⤵PID:212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,9971751672202472203,8453270058059643386,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9971751672202472203,8453270058059643386,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:12⤵PID:3140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9971751672202472203,8453270058059643386,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:12⤵PID:368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9971751672202472203,8453270058059643386,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:12⤵PID:1896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9971751672202472203,8453270058059643386,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:12⤵PID:4420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9971751672202472203,8453270058059643386,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:12⤵PID:1528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9971751672202472203,8453270058059643386,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2068 /prefetch:12⤵PID:4336
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4572
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1512
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5b8880802fc2bb880a7a869faa01315b0
SHA151d1a3fa2c272f094515675d82150bfce08ee8d3
SHA256467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812
SHA512e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2
-
Filesize
152B
MD5ba6ef346187b40694d493da98d5da979
SHA1643c15bec043f8673943885199bb06cd1652ee37
SHA256d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73
SHA5122e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize336B
MD5b5e695231e689467026daf2c212f4820
SHA10bc626d59011fea87e02bd4331a322cc5932384b
SHA25666cf494e6c1149981eaee6077b01d8610584eb27e8f19b3afe24505357feccf2
SHA5122c82e808d94cb80e8d4b030173c84c0bf6b60a0e7c27cdd98588659b92dd341f3232c51bbd254a90116edff12199510282705699520d777986b47ae7c4ea517e
-
Filesize
1001B
MD55e97e2b31bd8e52170ace1edffb2b2c4
SHA1ba4ee24aaa73c1627d77fc5a6546168e491c8477
SHA2561e5a4d8439819413adb5aef57a753d9fc32ad251c4c7744decd70b72635bf889
SHA5121c5613c10abac8ae2a2236ec93c55567d663a8a7a8fb53e955088bbba7f793e4fda047c056e1f6fb01db7b5ce742b8f7576f4259a26955281df2128e8c641e71
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
7KB
MD5638ba386cfa2b203a511e4a707e26a33
SHA1bb126e32f85d046ac8d0f1176dabd06930d0af7d
SHA25614f22c6195aed23844a142cb02fa9b3b5aab7be6ce62107cb214b7a00479ef64
SHA512122d55cfdcb72911d05b2100b0ba613e66cb398dae49b0f561ebfc06a3c391a2f4d93608f0e748ad8bca53447e7f8b07eff5efb371423434c9b5e2864d80bf18
-
Filesize
5KB
MD540c79a69af1b1f9f0e44f9cc64a41a7e
SHA147b698e3b6f540a36d0a1ef39e1dc8866573a0af
SHA256b3a568a052fa5a0a87b5283629f2db2f28461225e69cf4738e2a30f95d0f3c2e
SHA512a72ed2248e5088184076cc45e34e5a47fb1d87e134b033dc028fe608adda3a31ea8626f1a911edc3330362ba44dd7516d9f88ef17352e6ee67d5dc4b35c7c31a
-
Filesize
6KB
MD53ec2e024218467b5a981955d0a2e798c
SHA1357f88235d43a9f7946e304b5cda62fb5078fd21
SHA25699a8b367174020f17da6fe3a4ebe92126c6593f0e32ff00920bf6180c2585554
SHA5128a8bee2b4d5cb20eee4b19bf783e7470b10c7b54bf2779a078ee7c267ee09a9e19c12832d94f021e7ed556d979c82b8c6752d3a7beacafa7317cad1f1015cac7
-
Filesize
7KB
MD55bf028204baf53ef9422be10f2149308
SHA1b3e307729c1d7caa2fdeb515156d809c4aa86841
SHA25659e387544f6087e73cb9359a88be438e45d20fdb24215b5750d6b1f12302b3d4
SHA5121f07e640cd946a6f84d3f3c49612126f469a9fe371dc346ea7ce3524c6b699d0e48c146d8b69c20ee196d58a23c2bfaace559f20f4b95ec66a912604363c9077
-
Filesize
7KB
MD5f9ad13c8cc7d2b7e86fd0617bff677df
SHA1c8d5351ad994f081e828ee442b611ff0fb07a652
SHA256eda64d362abcce9d52582a0c493080127c9888526286b11b12b253fb6a5d1c97
SHA512548d35ffe540e9c6e9241d2a714c8996807f57321e533a1b9efb7e7db44d960655c64f46d7dc257ba912d136b999b224ccf1c7fd255c92f7d092c3ccf99221d2
-
Filesize
538B
MD53155cdc8e566f6905e6a3b408c7abcb7
SHA1f5a727d29df083d14f3944b5404fd03726a73451
SHA2560e19a2b6f8965a5fb2db5ad79581454ff6cf3eb8374dd3ca23059f031d4b16b9
SHA512d6fc6706bc575c8fb980421afc6528b188ddc13f5542d3ac023cae767bab84478991c2f089173e7f7e3044b867ee035ea05387289dd1bb946051b5b2268d3c3a
-
Filesize
370B
MD5dc26bcacfbd225727e0772b2607b2906
SHA1317157ec0fb1545bf3443df1fd43843bc98f2e35
SHA256903f9929d15e7521d46a6758cefdd4cda9efc8b108b118e484608ac1b8e8f6c4
SHA512a68336363a1560df83be28dd3205b8e022ec1e9f8b8da565358f700195c4d31c787c1573cada6bef786393db7470d8b47e9adc2de55ec804c728d52bce509a2a
-
Filesize
538B
MD57ed78f0a3bf9ba129cfe666ea6e415eb
SHA16d4fbacc3b3aac4f42451848403b87d9672e0bee
SHA256af63474629f607570f0e5f564130cde355d85da318fc9aaf79455ce6bd63f1da
SHA5126e0e75a7bbc4eba85b614a7ca8ea97384d7dc6b31b1687099eb62c2a027be01272e7491b597e5fcc1eeeadd5077bc23965553cf37566c3649d7856cb8d8453b1
-
Filesize
202B
MD5be16f775100b01f38b58e8451b19f1bb
SHA14753268f227764c6a8dbcfc17e614125903d8086
SHA2569d682eb05e2d0555b2c9727d89f34abfb44fd4c23a9786c70af49fbe1d247754
SHA512fda3c322b6056d65cdc89b261e5c5b3d39948ac8651f544e5b969950756345b88271f39fd50d03d7a79f641b5a3c48605dbef125593548df7dced0915759f84a
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD56e3ca9d4bdf5b89b1fb9bffd9627bdc6
SHA1900f1a72ddbeb45714eece432b9c4cbc1741b4b1
SHA256f3264880482907281644ecc07fd7952d4a069db1a0cc3ead58f6e1e7fae76c36
SHA51270d756aa3ca8823cbd418cf40e1550303afc7f6c02ee5d35bc2ee46c92aff8be843c85cb808dfe193f87dedabc55502cb6dfd5f5bb7da7d3234e5715d6867fe2