hxxp://dddd | Triage

Resubmissions

17/12/2024, 19:15

241217-xylpjsvncv 3

17/12/2024, 19:13

241217-xw2b8avmgy 8

17/12/2024, 19:09

241217-xt41bsvmcy 10

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/12/2024, 19:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://dddd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1200	msedge.exe
1200	msedge.exe
4008	msedge.exe
4008	msedge.exe
2796	identity_helper.exe
2796	identity_helper.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe
6084	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 4840	4008	msedge.exe	84
PID 4008 wrote to memory of 4840	4008	msedge.exe	84
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 2220	4008	msedge.exe	85
PID 4008 wrote to memory of 1200	4008	msedge.exe	86
PID 4008 wrote to memory of 1200	4008	msedge.exe	86
PID 4008 wrote to memory of 2416	4008	msedge.exe	87
PID 4008 wrote to memory of 2416	4008	msedge.exe	87
PID 4008 wrote to memory of 2416	4008	msedge.exe	87
PID 4008 wrote to memory of 2416	4008	msedge.exe	87
PID 4008 wrote to memory of 2416	4008	msedge.exe	87
PID 4008 wrote to memory of 2416	4008	msedge.exe	87
PID 4008 wrote to memory of 2416	4008	msedge.exe	87
PID 4008 wrote to memory of 2416	4008	msedge.exe	87
PID 4008 wrote to memory of 2416	4008	msedge.exe	87
PID 4008 wrote to memory of 2416	4008	msedge.exe	87
PID 4008 wrote to memory of 2416	4008	msedge.exe	87
PID 4008 wrote to memory of 2416	4008	msedge.exe	87
PID 4008 wrote to memory of 2416	4008	msedge.exe	87
PID 4008 wrote to memory of 2416	4008	msedge.exe	87
PID 4008 wrote to memory of 2416	4008	msedge.exe	87
PID 4008 wrote to memory of 2416	4008	msedge.exe	87
PID 4008 wrote to memory of 2416	4008	msedge.exe	87
PID 4008 wrote to memory of 2416	4008	msedge.exe	87
PID 4008 wrote to memory of 2416	4008	msedge.exe	87
PID 4008 wrote to memory of 2416	4008	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://dddd
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc8adf46f8,0x7ffc8adf4708,0x7ffc8adf4718
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,13236348799840067966,12054743285845555609,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,13236348799840067966,12054743285845555609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,13236348799840067966,12054743285845555609,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13236348799840067966,12054743285845555609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13236348799840067966,12054743285845555609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13236348799840067966,12054743285845555609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13236348799840067966,12054743285845555609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,13236348799840067966,12054743285845555609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,13236348799840067966,12054743285845555609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13236348799840067966,12054743285845555609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13236348799840067966,12054743285845555609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13236348799840067966,12054743285845555609,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13236348799840067966,12054743285845555609,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13236348799840067966,12054743285845555609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2640 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13236348799840067966,12054743285845555609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1704 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,13236348799840067966,12054743285845555609,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1268 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dd436e0cbed403df61c53a005eb8a695

SHA1
1d99268215e2004e1c92675c5df6977aac5430f7

SHA256
509a88672da61e942188f724cb72e925c1fb0d5e7f0d64bd2c6bd7dec7685f99

SHA512
8fb95a990524e59c8a6a12ed7cd4ec38eb93942d8235025ada7992bed08a1dbe267abdbfa654002d34bfb7547347a6539ccdc2aadd6fee040d9f6ef70a6ec96a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1d74dd89397e2171771597fde31d7c4f

SHA1
d82029b27f9f75344f5f9fd36776730944f6da58

SHA256
48571bce1093194fde90e2776b03d26772a90141409917abeb4d22df2d93dcbe

SHA512
b0a60124fb82dcd4438fe479f0ec318bf678bfab259f97820eb6518a84085f61d0de197e63945d574be83607cbc12265375ddf3e2e27394c7ae44f66c122b8a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f8ee0dc9946a60e33e3d78fa6e0f516e

SHA1
0be234806934e521285f48d4f800e0a16f7f6d07

SHA256
f018aba9f9c11043c8d22afe891edff8069550a242cdc8c2bbec181cb9788f22

SHA512
d6aa68f3610b784ed474185a7d7a0e10446c6dcb723b382861980493c8a1ca59712632aa89a77df57725df56c8a22e0412eba9c0ff2a67e77f1548a80a083215

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f22a7325aaa3e1513bbf66fb1bd3eb5e

SHA1
0a7fcfe428e49f5cfa4daa4f1aac6cab0dca50a2

SHA256
7f6c153c4d13366b0bb1ee535659355660f7af80723aee463e932b2dbc6015c0

SHA512
de50ec8b33c543fa2afd9af336d4569de5822bfd61710c89028145343f5d75716ae10f8f94115090b7d8cc5a81f00d9fc7a1945c8bc29815846f70bfd9b74e28

Download Submit