Analysis
-
max time kernel
269s -
max time network
278s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12-12-2024 16:28
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
-
A potential corporate email address has been identified in the URL: [email protected]
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 5032 msedge.exe 5032 msedge.exe 3760 msedge.exe 3760 msedge.exe 1352 identity_helper.exe 1352 identity_helper.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe 3760 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3760 wrote to memory of 3432 3760 msedge.exe 84 PID 3760 wrote to memory of 3432 3760 msedge.exe 84 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 3276 3760 msedge.exe 85 PID 3760 wrote to memory of 5032 3760 msedge.exe 86 PID 3760 wrote to memory of 5032 3760 msedge.exe 86 PID 3760 wrote to memory of 4984 3760 msedge.exe 87 PID 3760 wrote to memory of 4984 3760 msedge.exe 87 PID 3760 wrote to memory of 4984 3760 msedge.exe 87 PID 3760 wrote to memory of 4984 3760 msedge.exe 87 PID 3760 wrote to memory of 4984 3760 msedge.exe 87 PID 3760 wrote to memory of 4984 3760 msedge.exe 87 PID 3760 wrote to memory of 4984 3760 msedge.exe 87 PID 3760 wrote to memory of 4984 3760 msedge.exe 87 PID 3760 wrote to memory of 4984 3760 msedge.exe 87 PID 3760 wrote to memory of 4984 3760 msedge.exe 87 PID 3760 wrote to memory of 4984 3760 msedge.exe 87 PID 3760 wrote to memory of 4984 3760 msedge.exe 87 PID 3760 wrote to memory of 4984 3760 msedge.exe 87 PID 3760 wrote to memory of 4984 3760 msedge.exe 87 PID 3760 wrote to memory of 4984 3760 msedge.exe 87 PID 3760 wrote to memory of 4984 3760 msedge.exe 87 PID 3760 wrote to memory of 4984 3760 msedge.exe 87 PID 3760 wrote to memory of 4984 3760 msedge.exe 87 PID 3760 wrote to memory of 4984 3760 msedge.exe 87 PID 3760 wrote to memory of 4984 3760 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://creditoscontinental.com/1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbbcb646f8,0x7ffbbcb64708,0x7ffbbcb647182⤵PID:3432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,16374461648621040403,9518294808474502370,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:22⤵PID:3276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1976,16374461648621040403,9518294808474502370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1976,16374461648621040403,9518294808474502370,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:82⤵PID:4984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,16374461648621040403,9518294808474502370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:3908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,16374461648621040403,9518294808474502370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:3132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1976,16374461648621040403,9518294808474502370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 /prefetch:82⤵PID:3124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1976,16374461648621040403,9518294808474502370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,16374461648621040403,9518294808474502370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:12⤵PID:3468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,16374461648621040403,9518294808474502370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:12⤵PID:4964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,16374461648621040403,9518294808474502370,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:12⤵PID:2348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,16374461648621040403,9518294808474502370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:12⤵PID:2928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,16374461648621040403,9518294808474502370,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:12⤵PID:4500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,16374461648621040403,9518294808474502370,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3916 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4868
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3436
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2084
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dc058ebc0f8181946a312f0be99ed79c
SHA10c6f376ed8f2d4c275336048c7c9ef9edf18bff0
SHA256378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a
SHA51236e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa
-
Filesize
152B
MD5a0486d6f8406d852dd805b66ff467692
SHA177ba1f63142e86b21c951b808f4bc5d8ed89b571
SHA256c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be
SHA512065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize360B
MD5e1ad1670032c31aaffa69cf51170f6bf
SHA1fc458e5bfdd774d1944a04921e6df5deaacc4138
SHA256226d0e6634837d354f31af5856a2ce194f7ddb8e8a5c25ba8fb868fcf941becc
SHA5129306bee3aa38f9ed528d71e1394b503644a89c4bb4ef3d71a3aea5a1143064d94330349dde5e6a83e655fccc594867a00604e40ac34f22b7fdcdf754ab0b952d
-
Filesize
1010B
MD59100653c4d3765d638aef04f08808ea7
SHA1ca9cb3dd3a016058ab40b9ceafbf67af8dddbb65
SHA256e80765f897938fcf3db46a012b020fcb8a7e914224c66998b31f5d6c1023acd4
SHA512ad3aaaf32f2818884fc0af97cff13bcc39ec398b28952558ca6ad98f1b6cda905a2ef2faf720a166beaf8ff608c43f498447572b45a0510145b619b7d994834c
-
Filesize
5KB
MD51e49f546f2baadc5b563b56657738215
SHA161d596846f72b7a994b3f0b97408177d26a96f60
SHA256b2d642809bd01f576e22ec1da14b0ed06a69220c0fe286e385653e56afc57a71
SHA51246ceb96c518b0e7e12b0400221cd84b7aea4caa9e8a088855c12b206698d842dd1faf1264ccb814226709521ab5d33a64365d5acfedff6754815c713b6c0a0f6
-
Filesize
6KB
MD57a58ddbff35f64f70bbc5e7c1e5a6063
SHA1524a3de90f8b9ffa932abd1fbf2793557d4d4db5
SHA2560f626747585b0c6dcc209f03cd7ce3604b4023ff62055c02740200cee17b8d57
SHA512c8c1d06076bd531f50d8582f6a1f0dff6bda438f143bbfcfaf54bb7578803f7dd8d2160fdab35d4c3d4df4347e1219ea1997319da9bdf6497a861c9e3778154c
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD56667ffdfd2bc3e39be41eead03fdd59e
SHA12ec3c098fb5935b646545c6ee5d30a5e76751de6
SHA256a27b215e95f74846bd8a26d4d2dded32afbbf1606641a0bb91f3e9cb4b06c203
SHA5126d75dbcd50b4c4e75fbe87206bbf326a1eaeeaaf91499ef38564477f293fce450045cb1d3756f52634fda79f1c538adf75eef6198ce484969913cb693d58263d