hxxps://www-receipt-docu-share-confirmation[.]s3[.]ap-south-1[.]amazonaws[.]com/index[.]html

Analysis

max time kernel
97s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-01-2025 18:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www-receipt-docu-share-confirmation.s3.ap-south-1.amazonaws.com/index.html

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1600	msedge.exe
1600	msedge.exe
4656	msedge.exe
4656	msedge.exe
2820	identity_helper.exe
2820	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 1540	4656	msedge.exe	83
PID 4656 wrote to memory of 1540	4656	msedge.exe	83
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1780	4656	msedge.exe	84
PID 4656 wrote to memory of 1600	4656	msedge.exe	85
PID 4656 wrote to memory of 1600	4656	msedge.exe	85
PID 4656 wrote to memory of 4224	4656	msedge.exe	86
PID 4656 wrote to memory of 4224	4656	msedge.exe	86
PID 4656 wrote to memory of 4224	4656	msedge.exe	86
PID 4656 wrote to memory of 4224	4656	msedge.exe	86
PID 4656 wrote to memory of 4224	4656	msedge.exe	86
PID 4656 wrote to memory of 4224	4656	msedge.exe	86
PID 4656 wrote to memory of 4224	4656	msedge.exe	86
PID 4656 wrote to memory of 4224	4656	msedge.exe	86
PID 4656 wrote to memory of 4224	4656	msedge.exe	86
PID 4656 wrote to memory of 4224	4656	msedge.exe	86
PID 4656 wrote to memory of 4224	4656	msedge.exe	86
PID 4656 wrote to memory of 4224	4656	msedge.exe	86
PID 4656 wrote to memory of 4224	4656	msedge.exe	86
PID 4656 wrote to memory of 4224	4656	msedge.exe	86
PID 4656 wrote to memory of 4224	4656	msedge.exe	86
PID 4656 wrote to memory of 4224	4656	msedge.exe	86
PID 4656 wrote to memory of 4224	4656	msedge.exe	86
PID 4656 wrote to memory of 4224	4656	msedge.exe	86
PID 4656 wrote to memory of 4224	4656	msedge.exe	86
PID 4656 wrote to memory of 4224	4656	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www-receipt-docu-share-confirmation.s3.ap-south-1.amazonaws.com/index.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd450c46f8,0x7ffd450c4708,0x7ffd450c4718
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,17898308675322203863,18162956041056727487,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,17898308675322203863,18162956041056727487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,17898308675322203863,18162956041056727487,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17898308675322203863,18162956041056727487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17898308675322203863,18162956041056727487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17898308675322203863,18162956041056727487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17898308675322203863,18162956041056727487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17898308675322203863,18162956041056727487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,17898308675322203863,18162956041056727487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,17898308675322203863,18162956041056727487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17898308675322203863,18162956041056727487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17898308675322203863,18162956041056727487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17898308675322203863,18162956041056727487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17898308675322203863,18162956041056727487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
601B

MD5
5679bdaf9f720bdf1ad1a2006d2d2621

SHA1
b10f4879aaa82aab0c18cb424d7a8b6c0ec0a717

SHA256
fd42887f98ff217eb18d60921f0079448a7da427ac40c35761b8aa2b4d143d7e

SHA512
441557722788a9c8a1dd5f42e30ed25ec1d74966346880e0da66774a170dd07116b78747a02ddce0dd185e2ea4532a10a2369d5a8f05efd3a09dee9cfd7facf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3770dccdc2e3fb07442a6234fa64d9c5

SHA1
cfecb684a09860cd79f8d2b2475ebcfa0dc64ff8

SHA256
edee5f75aa3a6b707f7a3b8df6f08def8a6d0fe3d8a96d9b0b2e5747133a7bf2

SHA512
93c57329af3c7cef0ae4c10007f2b1dcc495a79b76400846bee8c703b53a34d5e008c72dc417a34e36fc337f952b13f7266ceecda74ea225cd2a3b2ebb627410

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a99188f1a4b835612f12792e09535399

SHA1
c59c2bd65bd97a872f852c47dfb278e2793864c6

SHA256
e224a37facebae5fa587cfc71487fbbe37aebd25b7dce1f871fd81e33a9afea1

SHA512
45eca7b76750eae1530de963e415d3bed451649310c41ade9bc4d7c16013d09c64a4a7db7255eeb91a8133c4da5b747b33515c929f491c787af6e31ae5b0c73c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c39b97aff0305de162f010bea5cb1481

SHA1
7a0797f32b3d078a4677ff1071f763a20953dd7a

SHA256
2ae02a3fef7a5a16333986315e33c48e3d0c96c6421b422e2226871fbfda6956

SHA512
0a9f72ee80d979ff720df2669f84914cdb5a6d8b9b0bf4252251b8d28d66a9211e96bd5b24378374c184fba3ce3e519dbaf9533a996cdcb1cb7503313814f973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1c62fbe7390bc700f788bf043da0ebbb

SHA1
267e8dbeaab153d633c3cd3ceeb84ac770f305d9

SHA256
bdfaa759281d69beebaf1a3e766d186a65db3cf0fab3834a9ebcf22c383c1213

SHA512
1e608adcb88648357088e2f19e5b257bdb6764676f72c0b01174fc6693faa67fbcc11581f8ccce5be59d3120637c56e7941880b58624a3855840770a9e731147

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e75a597165e06d579bb96aaebad71ad2

SHA1
8037412f6231faa39ac1958bf0f787647b200e46

SHA256
52c32c408c3785f8b25035dd4109257ac8a35b7625cb26e1476828a3e7d78a0b

SHA512
b92ea0856d8caa0b59a63557d6f103c8a269c0f7432c95d97b374aa5cc7c8fa1863ff56e151f0f2c05b6f77886cbfbbaf2a678f357c96cc25b4ef35fde9b21ef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit