Analysis
-
max time kernel
50s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 19:05
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://pleasebux.com/
Resource
win10v2004-20241007-en
General
-
Target
https://pleasebux.com/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1136 msedge.exe 1136 msedge.exe 1564 msedge.exe 1564 msedge.exe 2032 identity_helper.exe 2032 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1564 wrote to memory of 4792 1564 msedge.exe 83 PID 1564 wrote to memory of 4792 1564 msedge.exe 83 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 2788 1564 msedge.exe 84 PID 1564 wrote to memory of 1136 1564 msedge.exe 85 PID 1564 wrote to memory of 1136 1564 msedge.exe 85 PID 1564 wrote to memory of 4076 1564 msedge.exe 86 PID 1564 wrote to memory of 4076 1564 msedge.exe 86 PID 1564 wrote to memory of 4076 1564 msedge.exe 86 PID 1564 wrote to memory of 4076 1564 msedge.exe 86 PID 1564 wrote to memory of 4076 1564 msedge.exe 86 PID 1564 wrote to memory of 4076 1564 msedge.exe 86 PID 1564 wrote to memory of 4076 1564 msedge.exe 86 PID 1564 wrote to memory of 4076 1564 msedge.exe 86 PID 1564 wrote to memory of 4076 1564 msedge.exe 86 PID 1564 wrote to memory of 4076 1564 msedge.exe 86 PID 1564 wrote to memory of 4076 1564 msedge.exe 86 PID 1564 wrote to memory of 4076 1564 msedge.exe 86 PID 1564 wrote to memory of 4076 1564 msedge.exe 86 PID 1564 wrote to memory of 4076 1564 msedge.exe 86 PID 1564 wrote to memory of 4076 1564 msedge.exe 86 PID 1564 wrote to memory of 4076 1564 msedge.exe 86 PID 1564 wrote to memory of 4076 1564 msedge.exe 86 PID 1564 wrote to memory of 4076 1564 msedge.exe 86 PID 1564 wrote to memory of 4076 1564 msedge.exe 86 PID 1564 wrote to memory of 4076 1564 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://pleasebux.com/1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb93d546f8,0x7ffb93d54708,0x7ffb93d547182⤵PID:4792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,9843746906566958412,8323325271014500829,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:22⤵PID:2788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,9843746906566958412,8323325271014500829,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,9843746906566958412,8323325271014500829,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:82⤵PID:4076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9843746906566958412,8323325271014500829,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:3996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9843746906566958412,8323325271014500829,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:2288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,9843746906566958412,8323325271014500829,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:82⤵PID:2304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,9843746906566958412,8323325271014500829,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9843746906566958412,8323325271014500829,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:12⤵PID:1228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9843746906566958412,8323325271014500829,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:12⤵PID:4416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9843746906566958412,8323325271014500829,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:12⤵PID:2968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9843746906566958412,8323325271014500829,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:12⤵PID:2644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9843746906566958412,8323325271014500829,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3668 /prefetch:12⤵PID:728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9843746906566958412,8323325271014500829,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:12⤵PID:3972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9843746906566958412,8323325271014500829,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:12⤵PID:3932
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3088
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4032
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD56960857d16aadfa79d36df8ebbf0e423
SHA1e1db43bd478274366621a8c6497e270d46c6ed4f
SHA256f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32
SHA5126deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe
-
Filesize
152B
MD5f426165d1e5f7df1b7a3758c306cd4ae
SHA159ef728fbbb5c4197600f61daec48556fec651c1
SHA256b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841
SHA5128d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize264B
MD51aedd23ed1cb5a309679b8ac17c5657f
SHA142b4a2d074362f905d64c0bc0aad2a6ff930b28f
SHA2569bbd80056fdde324dbd83498b419ab8f55a29117d25bb1db68fe4d8a5eb5c20f
SHA512b48a91d751882d69b5c0ffa14dcde81b7107156339278b950b0736cf0ec857b0978c9ac62b168d3b3fa98dacb3d0ff533779c5d54b580f3daba44200f70f70d5
-
Filesize
6KB
MD5cae10dfd18895c4f6ed4dd8f2c4299d8
SHA157d58f61c55bd014d4e7613cee8afbe1eeec3261
SHA256f2e8c285c692a9641ecd1c5c934650ca358120dd5754f9ac5fc933ea3570a5f8
SHA512b710326e7f0965e463fcc38677e3696af36d20ddd04eaf984976d74a9b2ed54221c286ab8275f8c9d4fddac154cbef07ae8226f56513d5242332e891df82bb72
-
Filesize
5KB
MD5ff1744e491009166c7c1f92f0f88a3f4
SHA10205810251100a13024043a3f51e875ac4a58f0f
SHA256d7e72bf3af7945b161ba94affae5c82cad14e49242cbdf02eea8a3da2235a5d8
SHA51286f103519c84639f6378135e24cb1a0a62d78881c90c54754546ca822006cd3abe59a011546c0529b44042ea8924a0903d45301980d195e661ba2eae1a217a72
-
Filesize
6KB
MD5c456b0ef1bea889c1d5ca37f68719b7d
SHA1245cd7396d0b396f122b430df4eed3f6cadcc42a
SHA256765a415098d27c25c2188c9f0c2893975076644e0f1b159ec0da24e63225e2f9
SHA5122e9b2a9b59d13629b6c15d921da0a7d7c47a09f1fc55836118e6df7d677f9fbaf478f7ae2abfb037f47bd2261bfa9899151e87f9c9c5d593c832a17af080733a
-
Filesize
6KB
MD5cb9e9c53ed73eb3f97b700bcd56c9193
SHA1e5044ba5206f977bd5e3bf0b4ea5d573b24e65d5
SHA2568bf35e0a19e3295c9e45c785bb34f9c41db4678a51f1cbf678a6702da6b05a70
SHA512e0cba3012af966ca0c37a506aea309a6a03da7d1ade8226206c7a64426224b40641b879fee64947c9684fc4464ae4d7eced261fa51ff7f1e532750ecd44840e9
-
Filesize
204B
MD5ea20d29020a14c54001962ca0346c4c2
SHA1f258bef0313fc1e6e8da13f0cd3205c03a001800
SHA25637225c88492191c8d314f89f34b2edbaeee090c647037dfca32cefdb47299781
SHA5121014107ec08053bcc861fe78b44e2db323d52df3faa14bc1f4458b209bc4465487d238dcd74446792b9cea9ea875ae7a123b7377a191ae87f9f0eb77d492906e
-
Filesize
204B
MD54a0dab2078a7b11371ac56c85162538f
SHA1641cc0f23ba9c9b9fe542c145f3ebc8fc2068e04
SHA256f5b8d9a4b27950bb75338a180eb0cbe5822763daf8d419eb4b9ee50f6ac5b9de
SHA51283bef5e95bb4d01242cfef1086ba00a0b6669c23d7f58236af8a46138e6b68e6dcfa48ee0d887aca340d5a538e57fe9a9408b5641d6cad0077726bb766078838
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5482fb7e644869f714ffa24a9f02c790e
SHA195a7479977c805ef0638e366bdb1099d3a65ab89
SHA25657a1de553792ee37404ae3ad0b220303687f0d7750e9abea1b2fa582b4dc79f3
SHA512edd0a414d6181c69bd07654cef0513461d4dfbe1dd6820afdf122b543716f5f8fca1ba86606f1d88e32c63c20a237b59850d33b97e7773664790d804ba990f1f
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84