Analysis
-
max time kernel
148s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-12-2024 15:50
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://free-mailchecking.freewebhostmost.com
Resource
win10v2004-20241007-en
General
-
Target
https://free-mailchecking.freewebhostmost.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3372 msedge.exe 3372 msedge.exe 2684 msedge.exe 2684 msedge.exe 1960 identity_helper.exe 1960 identity_helper.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
pid Process 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe 2684 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2684 wrote to memory of 4356 2684 msedge.exe 84 PID 2684 wrote to memory of 4356 2684 msedge.exe 84 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 4092 2684 msedge.exe 85 PID 2684 wrote to memory of 3372 2684 msedge.exe 86 PID 2684 wrote to memory of 3372 2684 msedge.exe 86 PID 2684 wrote to memory of 312 2684 msedge.exe 87 PID 2684 wrote to memory of 312 2684 msedge.exe 87 PID 2684 wrote to memory of 312 2684 msedge.exe 87 PID 2684 wrote to memory of 312 2684 msedge.exe 87 PID 2684 wrote to memory of 312 2684 msedge.exe 87 PID 2684 wrote to memory of 312 2684 msedge.exe 87 PID 2684 wrote to memory of 312 2684 msedge.exe 87 PID 2684 wrote to memory of 312 2684 msedge.exe 87 PID 2684 wrote to memory of 312 2684 msedge.exe 87 PID 2684 wrote to memory of 312 2684 msedge.exe 87 PID 2684 wrote to memory of 312 2684 msedge.exe 87 PID 2684 wrote to memory of 312 2684 msedge.exe 87 PID 2684 wrote to memory of 312 2684 msedge.exe 87 PID 2684 wrote to memory of 312 2684 msedge.exe 87 PID 2684 wrote to memory of 312 2684 msedge.exe 87 PID 2684 wrote to memory of 312 2684 msedge.exe 87 PID 2684 wrote to memory of 312 2684 msedge.exe 87 PID 2684 wrote to memory of 312 2684 msedge.exe 87 PID 2684 wrote to memory of 312 2684 msedge.exe 87 PID 2684 wrote to memory of 312 2684 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://free-mailchecking.freewebhostmost.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa57e046f8,0x7ffa57e04708,0x7ffa57e047182⤵PID:4356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,9239932117052166185,7651105022042827573,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵PID:4092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,9239932117052166185,7651105022042827573,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,9239932117052166185,7651105022042827573,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:82⤵PID:312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9239932117052166185,7651105022042827573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:1120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9239932117052166185,7651105022042827573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:4852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,9239932117052166185,7651105022042827573,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:82⤵PID:452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,9239932117052166185,7651105022042827573,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9239932117052166185,7651105022042827573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:12⤵PID:2052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9239932117052166185,7651105022042827573,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:12⤵PID:1380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9239932117052166185,7651105022042827573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:12⤵PID:3868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9239932117052166185,7651105022042827573,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:12⤵PID:1164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9239932117052166185,7651105022042827573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:12⤵PID:764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9239932117052166185,7651105022042827573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:12⤵PID:2036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9239932117052166185,7651105022042827573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:12⤵PID:2100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9239932117052166185,7651105022042827573,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1928 /prefetch:12⤵PID:1832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,9239932117052166185,7651105022042827573,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3904 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4724
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4348
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3592
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58749e21d9d0a17dac32d5aa2027f7a75
SHA1a5d555f8b035c7938a4a864e89218c0402ab7cde
SHA256915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304
SHA512c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a
-
Filesize
152B
MD534d2c4f40f47672ecdf6f66fea242f4a
SHA14bcad62542aeb44cae38a907d8b5a8604115ada2
SHA256b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33
SHA51250fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6
-
Filesize
5KB
MD50bfb8864164920819c7671c123922ca4
SHA128a1f69fc6c804fca9a6b62540669fe3c285d318
SHA256c07b1bb4948755acae04e4ace11b8e8f9ab57b019421adfb4d080ae61ce1e1b5
SHA5124f3a41056bbfed3f3abfb1737f402b98225035fdcc36e8921a9d6bcb41f1f8ecb57854453e82883485e17cbccb1851ec8aad7508740e63498e38db694d2706b5
-
Filesize
6KB
MD5ef5a059db0a4386793d88c7f824bb7f7
SHA19055044b1d07de2e74aacc8d67b8288e6e656e5b
SHA256d46da11e0064864c0c2ea6167c200391d0eb4d8835e0411b2b276d3031eb847b
SHA5129ec08849d7f7d69c881095c20307953bb2f0d6082b3d70974a463ba78f49f32adfdc2f355a83b717b0cd8fb7dd88cda78ef32e253e818820db044081bd91065e
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD5c33fbdb3960df8f39afe2d9434a12b6b
SHA112165ddb0a35d0f5ba2e4ace1a9062afeb9aabaf
SHA256ed2e932412b8c0c6d03e975d9c818d1b79bc46e110767ca76e61177fb5ddb73e
SHA512117c1ff9bc89aca6bac0c3b09401f1ed4c91a70cb9ed0628a0e1e09f9ce7f2f6c970b4c0f5e1576a739d94ea92e63f90eafb12dfe2a92d88f78c3e4964077e27