Analysis
-
max time kernel
269s -
max time network
282s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-12-2024 21:36
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
-
A potential corporate email address has been identified in the URL: [email protected]
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 540 msedge.exe 540 msedge.exe 3100 msedge.exe 3100 msedge.exe 2436 identity_helper.exe 2436 identity_helper.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3100 wrote to memory of 2296 3100 msedge.exe 83 PID 3100 wrote to memory of 2296 3100 msedge.exe 83 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 5076 3100 msedge.exe 84 PID 3100 wrote to memory of 540 3100 msedge.exe 85 PID 3100 wrote to memory of 540 3100 msedge.exe 85 PID 3100 wrote to memory of 1580 3100 msedge.exe 86 PID 3100 wrote to memory of 1580 3100 msedge.exe 86 PID 3100 wrote to memory of 1580 3100 msedge.exe 86 PID 3100 wrote to memory of 1580 3100 msedge.exe 86 PID 3100 wrote to memory of 1580 3100 msedge.exe 86 PID 3100 wrote to memory of 1580 3100 msedge.exe 86 PID 3100 wrote to memory of 1580 3100 msedge.exe 86 PID 3100 wrote to memory of 1580 3100 msedge.exe 86 PID 3100 wrote to memory of 1580 3100 msedge.exe 86 PID 3100 wrote to memory of 1580 3100 msedge.exe 86 PID 3100 wrote to memory of 1580 3100 msedge.exe 86 PID 3100 wrote to memory of 1580 3100 msedge.exe 86 PID 3100 wrote to memory of 1580 3100 msedge.exe 86 PID 3100 wrote to memory of 1580 3100 msedge.exe 86 PID 3100 wrote to memory of 1580 3100 msedge.exe 86 PID 3100 wrote to memory of 1580 3100 msedge.exe 86 PID 3100 wrote to memory of 1580 3100 msedge.exe 86 PID 3100 wrote to memory of 1580 3100 msedge.exe 86 PID 3100 wrote to memory of 1580 3100 msedge.exe 86 PID 3100 wrote to memory of 1580 3100 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://creditoscontinental.com/1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac05146f8,0x7ffac0514708,0x7ffac05147182⤵PID:2296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,14425927699432389291,7741474210485356392,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:22⤵PID:5076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,14425927699432389291,7741474210485356392,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,14425927699432389291,7741474210485356392,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:82⤵PID:1580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14425927699432389291,7741474210485356392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:12⤵PID:2768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14425927699432389291,7741474210485356392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:12⤵PID:1984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,14425927699432389291,7741474210485356392,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:82⤵PID:5012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,14425927699432389291,7741474210485356392,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14425927699432389291,7741474210485356392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:12⤵PID:2360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14425927699432389291,7741474210485356392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:12⤵PID:2840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14425927699432389291,7741474210485356392,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:12⤵PID:2200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14425927699432389291,7741474210485356392,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:12⤵PID:2648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14425927699432389291,7741474210485356392,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:12⤵PID:3552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,14425927699432389291,7741474210485356392,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5296 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2052
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4884
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3812
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e55832d7cd7e868a2c087c4c73678018
SHA1ed7a2f6d6437e907218ffba9128802eaf414a0eb
SHA256a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574
SHA512897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f
-
Filesize
152B
MD5c2d9eeb3fdd75834f0ac3f9767de8d6f
SHA14d16a7e82190f8490a00008bd53d85fb92e379b0
SHA2561e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66
SHA512d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize360B
MD5686577d9e724b9d29bbcecb5367f95e7
SHA14e8b5be7365cf65e3926ac31a900a729b647f605
SHA256c3fa9e82fb8dea50553ecb1df58d2311646c063722fa6225a1a46d12a793645b
SHA512c74cb833383b15b3a3daa9b62b0878ec8bc6f092e69b1552d31c3db8f475bf028b1198f362249f3072c8d61c884a22ace4e0366e83d51cd03d042edffb1fb362
-
Filesize
1011B
MD577ca7f789585448eeb76dfde41d59a2d
SHA1c6054188695dad937d7326dca42708de62bcce54
SHA256e7a4d7d29ba1e27e9686031aa55c2dbfa4b745fda5f08c41769ffa553806e6db
SHA512b115b9c142fb69a7fe428ebfa22193a7ffb14e8cfc3bfb7713990fbee82f708472f586e3a70f50a35c2af2eaf1e1e375bb39fe60e79fdd6286d3d43587583df9
-
Filesize
5KB
MD5903129cee82d341d436714051665e81c
SHA12b73f21ecd37e69238f4ecaab2658ab9488abfa7
SHA25606684ef6ddcc8d1cc1f69aa1003a3d59e8eb036bbe00a503ab2cec5d1972bc29
SHA5125a5a7687067de95bf941369a1f1818bde25e88684b29d4c07f01011239d26ee0ca686a1d85b25586d44ea6f7051344be9bd655dab063bf3350429496aaae0784
-
Filesize
6KB
MD5fd04dea43bb283e2fd2c208f7a2f44a6
SHA14eab7c9899cb758d98a45e5e7b2f088fab23ba3a
SHA2563d43121c535f9a360808ecba7c6d1aea853d29f04b0ae3fed7863ffcc6d63e47
SHA512937c69dee1fa4b52a62071f60301e825cfd8402bfb4ddf56ce1e779c26dce20419da3bb40a65d07d7a8aca3aa5cb740e922fe308353bdd931860042710cac3f7
-
Filesize
6KB
MD5f66d79707052d165235ef7edbd741d4e
SHA189c9e02f97e4b4a3b39ccf7d0294bd4e4d4fea12
SHA256216a10a3a766869ffd2345e60ae0b98e80d93e7c57a5891503175b61142801df
SHA512a188dd27f76d61df8f6b6d099824165bf24aac22b52e9184d17eb2f35e2e531eed21dbeab0b32773c016847054f7faa31537cb87f6db591dbfbc931055904c98
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5a09547f6f094d1e7af7d6bb975ecd9e7
SHA1fe916537adcb06317fb131ee82a4b9f3675c27a6
SHA2565c1ad40c4d316ece57d76de80fea4fd75f1bcb0cb1e2603b15600f0cc6f0519b
SHA5122058e1d6ff936a0ac19f816fdf26dd4f9cafe48df18c6d527ae48d56574fad42d1937bf83183e68a7d2fe7306085fc314fcb37882f48197f394cb6f518c8aee5