hxxps://toxicspins[.]com

Resubmissions

26-12-2024 16:00

241226-tftewszkgv 3

26-12-2024 15:59

241226-tfbvvazkfs 3

26-12-2024 15:43

241226-s5xm6syrgl 5

26-12-2024 15:26

241226-svcj9aypdl 5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2024 15:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://toxicspins.com

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
896	msedge.exe
896	msedge.exe
3352	msedge.exe
3352	msedge.exe
4332	identity_helper.exe
4332	identity_helper.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 3304	3352	msedge.exe	83
PID 3352 wrote to memory of 3304	3352	msedge.exe	83
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 4768	3352	msedge.exe	84
PID 3352 wrote to memory of 896	3352	msedge.exe	85
PID 3352 wrote to memory of 896	3352	msedge.exe	85
PID 3352 wrote to memory of 1564	3352	msedge.exe	86
PID 3352 wrote to memory of 1564	3352	msedge.exe	86
PID 3352 wrote to memory of 1564	3352	msedge.exe	86
PID 3352 wrote to memory of 1564	3352	msedge.exe	86
PID 3352 wrote to memory of 1564	3352	msedge.exe	86
PID 3352 wrote to memory of 1564	3352	msedge.exe	86
PID 3352 wrote to memory of 1564	3352	msedge.exe	86
PID 3352 wrote to memory of 1564	3352	msedge.exe	86
PID 3352 wrote to memory of 1564	3352	msedge.exe	86
PID 3352 wrote to memory of 1564	3352	msedge.exe	86
PID 3352 wrote to memory of 1564	3352	msedge.exe	86
PID 3352 wrote to memory of 1564	3352	msedge.exe	86
PID 3352 wrote to memory of 1564	3352	msedge.exe	86
PID 3352 wrote to memory of 1564	3352	msedge.exe	86
PID 3352 wrote to memory of 1564	3352	msedge.exe	86
PID 3352 wrote to memory of 1564	3352	msedge.exe	86
PID 3352 wrote to memory of 1564	3352	msedge.exe	86
PID 3352 wrote to memory of 1564	3352	msedge.exe	86
PID 3352 wrote to memory of 1564	3352	msedge.exe	86
PID 3352 wrote to memory of 1564	3352	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://toxicspins.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff96a2446f8,0x7ff96a244708,0x7ff96a244718
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,13938992356193084220,17058117184841781824,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,13938992356193084220,17058117184841781824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,13938992356193084220,17058117184841781824,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13938992356193084220,17058117184841781824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13938992356193084220,17058117184841781824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,13938992356193084220,17058117184841781824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,13938992356193084220,17058117184841781824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13938992356193084220,17058117184841781824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13938992356193084220,17058117184841781824,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13938992356193084220,17058117184841781824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,13938992356193084220,17058117184841781824,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,13938992356193084220,17058117184841781824,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3220 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
ecb1eb95f2dbd9b43ef9087bf68cc2b9

SHA1
5b88f2b85ec1f4062b9637b543cc9feb7968537b

SHA256
e4825d3d1d2c163edaa372ae532cce58c98190a1ff0e525e8db22cfaf18e5e59

SHA512
05ef0981a07cb87ce6f7ef4007940d86076ba9ce933034d8d79c41efc9b7215fe557655ae4568b95a3fd5c46b900949991abe72645f5e2c2bc85a750300bfe43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
19042d2758e651ab439d178f71ed64c2

SHA1
9996b26f9023f63cb67888922954c7ad66bb8644

SHA256
0d15823f352c2bc5cfc609b8e2cd63daf2c57f054e53de45fa50e84acf9aeee1

SHA512
e25ae69ab280d4029a74975518d4c57182886e5ad40cf59da8c9a5ac40b262fcaf8f885ec220a4916202d7e2263c1334f1af06efbaae19c4fcdecd54f3aead67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
38e09d1cab821079bae267230ad5863e

SHA1
12d8db335d37cf875e8bf74dc0820696132a7e93

SHA256
0b7098f439c4764d61d42526312955d73dd8b2262ef0e3eb4196564ac132d26f

SHA512
df749bc8765149ec89298f4e93d92638fb8706a00051a05ca65603f9a530998ee2e6e84460750b933cf141c33acc49faba27a020efb873534d616ec78607e028

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
52473a3cfbc734e5be5deef2e9bd53ef

SHA1
e179daaf33d6ab58b7cde95dd42afb381701ce5d

SHA256
02b7a99eaf0953f6454ca48cfd3a58a70247dacdd7652233f01870ad414e7317

SHA512
f7794427488905f0aba6c3051994d87cbbd2986844a1d3ac61bc56b9c71d43fdfd19c00638c262902321a00d3cad1a529948949f373efc7e178083d094928e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\eb365132-a41f-43d4-8881-667b2b1f28c6.tmp

Filesize
10KB

MD5
c32ce59f70ec30d3e181f1081fc3a1e0

SHA1
67e7a97439635c4196fe2344de3ce62387538941

SHA256
61f88150f300e962a1f10e4419d1353db2ae63e877dbfb330459ec7ffafc074d

SHA512
eecc8efd67119cce2d6bd02a9e80cd0190eb803808f7daa438c74e229aad4a6a3bd8a348287a2264d289d556131af386f14a4d8c6dfaf792b7ffa9819108690e

Download Submit