hxxps://youtube[.]com/@boffy/

Resubmissions

31-12-2024 05:12

241231-fv24pawlhm 7

31-12-2024 04:49

241231-ffsxgaylaw 10

31-12-2024 04:46

241231-fd1jjaykby 7

31-12-2024 04:31

241231-e5vlxsxpd1 10

Analysis

max time kernel
145s
max time network
140s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
31-12-2024 04:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://youtube.com/@boffy/

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: httpswww.youtube.com@boffycbrd1
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2536	msedge.exe
2536	msedge.exe
5420	msedge.exe
5420	msedge.exe
1012	msedge.exe
1012	msedge.exe
744	identity_helper.exe
744	identity_helper.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe
5420	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5420 wrote to memory of 2740	5420	msedge.exe	77
PID 5420 wrote to memory of 2740	5420	msedge.exe	77
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 5228	5420	msedge.exe	78
PID 5420 wrote to memory of 2536	5420	msedge.exe	79
PID 5420 wrote to memory of 2536	5420	msedge.exe	79
PID 5420 wrote to memory of 5480	5420	msedge.exe	80
PID 5420 wrote to memory of 5480	5420	msedge.exe	80
PID 5420 wrote to memory of 5480	5420	msedge.exe	80
PID 5420 wrote to memory of 5480	5420	msedge.exe	80
PID 5420 wrote to memory of 5480	5420	msedge.exe	80
PID 5420 wrote to memory of 5480	5420	msedge.exe	80
PID 5420 wrote to memory of 5480	5420	msedge.exe	80
PID 5420 wrote to memory of 5480	5420	msedge.exe	80
PID 5420 wrote to memory of 5480	5420	msedge.exe	80
PID 5420 wrote to memory of 5480	5420	msedge.exe	80
PID 5420 wrote to memory of 5480	5420	msedge.exe	80
PID 5420 wrote to memory of 5480	5420	msedge.exe	80
PID 5420 wrote to memory of 5480	5420	msedge.exe	80
PID 5420 wrote to memory of 5480	5420	msedge.exe	80
PID 5420 wrote to memory of 5480	5420	msedge.exe	80
PID 5420 wrote to memory of 5480	5420	msedge.exe	80
PID 5420 wrote to memory of 5480	5420	msedge.exe	80
PID 5420 wrote to memory of 5480	5420	msedge.exe	80
PID 5420 wrote to memory of 5480	5420	msedge.exe	80
PID 5420 wrote to memory of 5480	5420	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://youtube.com/@boffy/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff994db3cb8,0x7ff994db3cc8,0x7ff994db3cd8
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,266532346694240148,7600984137110304365,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,266532346694240148,7600984137110304365,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,266532346694240148,7600984137110304365,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,266532346694240148,7600984137110304365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,266532346694240148,7600984137110304365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,266532346694240148,7600984137110304365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3752 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,266532346694240148,7600984137110304365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,266532346694240148,7600984137110304365,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,266532346694240148,7600984137110304365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,266532346694240148,7600984137110304365,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,266532346694240148,7600984137110304365,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,266532346694240148,7600984137110304365,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,266532346694240148,7600984137110304365,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2796 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
003b92b33b2eb97e6c1a0929121829b8

SHA1
6f18e96c7a2e07fb5a80acb3c9916748fd48827a

SHA256
8001f251d5932a62bfe17b0ba3686ce255ecf9adb95a06ecb954faa096be3e54

SHA512
18005c6c07475e6dd1ec310fe511353381cf0f15d086cf20dc6ed8825c872944185c767f80306e56fec9380804933aa37a8f12c720398b4b3b42cb216b41cf77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
051a939f60dced99602add88b5b71f58

SHA1
a71acd61be911ff6ff7e5a9e5965597c8c7c0765

SHA256
2cff121889a0a77f49cdc4564bdd1320cf588c9dcd36012dbc3669cf73015d10

SHA512
a9c72ed43b895089a9e036aba6da96213fedd2f05f0a69ae8d1fa07851ac8263e58af86c7103ce4b4f9cfe92f9c9d0a46085c066a54ce825ef53505fdb988d1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
eb08226c7ed769762875fa680b464122

SHA1
65679d939402be5a367cf6ec054c6d78399a8d2a

SHA256
69ad57eb2f7ef2f3ccb4dc810efed3446bd5789e8bed3497347809bde2f83146

SHA512
fb5eec5c10437faf7efb26fa5ca7d2b45316672b65a02e95c5bd973c1da225345dea2d31155937469dc946db1069443d9be40b8a4f902e6ed3ea425414e8570f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0f23a8befe01d982f987129893ed9678

SHA1
cc2358cbf6f85d684cda558b13cc6852a9747062

SHA256
a88564f8ac56b1ecab8fbe73127df5b13947a31c9ddbe3352f2058d915e24f17

SHA512
dfd130a221cfd55b8d0d4df9acee668eacfa141c62a149388783446b06a33e9cf7c8189a2e44a93d8a482fa3612a9c8fa632de64e677c9318ad98c13e2796d89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7d714f74575fd946938eeb2b262c340b

SHA1
b18cdd6ddbbbccecffc82268c90c3284da2bb06f

SHA256
3c76a5b42fee1fb84bd2c154f7391f5d220be2a2c2b7694882f1cd8c93aad70a

SHA512
af4be1fa4bdc0bb40e0588872f2c9dc57eae81915c0693c569a29812cb3dfd28ef838f347a7714d6c10d9688f30baa1f281cf48fff9bfad033d508684b3ba730

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
443a5575ae54067aec1382f3c946bd00

SHA1
5fd4cd3b41638ef56b34589fdaf8b66317d9e6d8

SHA256
b1c11e44d170125949b0a1a797bb9b4d2d6480e71be9119228587ec53a1276dc

SHA512
ce867e332ffe46490e039a27a4dafa206012e4e4b1b0a8efc4a735378323bc1a4b137f0865d4beb17c7555a9580bd19ad2cf0d90e6977f127affe669da7b24d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c11188f4b33e56475c1dd47b17b6056a

SHA1
09dbb84141dc903d4a437fd62b265acbafe1c0bc

SHA256
128d8ea7e87ae2e2269880cf475e4c99dd36f9acdf05f3bbb6942ccd38fb5069

SHA512
ccfbf6fcb58afdd62c29636970d5ad17283c063123cd7094cb58cb7d21daf91e919c05d32b53af2888a722eb640d9ded3aa08a6c60cb9d2bce5d81c3b9218dbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
998533d20be50c8ac395aa13e93a84df

SHA1
cb8f95f852c42965a7803bd29af2d2d2a74fb6c9

SHA256
c703397500a14125339c58569dd2e92959d6416ab122df75a0abb667ae36fdee

SHA512
e9de83f4c9c866393b56fd739b0d463f9221358a5dad060bb46d3528886145b2b963cbcad28c1ec198451b01c44e20e07561260e7a1c5aee2208f1b3ef3a5a92

Download Submit