hxxps://aupost[.]orderacceptform82054[.]com/20294088

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
submitted
20/02/2025, 02:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://aupost.orderacceptform82054.com/20294088

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe
3096	msedge.exe
3096	msedge.exe
1720	identity_helper.exe
1720	identity_helper.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 3916	3096	msedge.exe	84
PID 3096 wrote to memory of 3916	3096	msedge.exe	84
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 3276	3096	msedge.exe	85
PID 3096 wrote to memory of 4996	3096	msedge.exe	86
PID 3096 wrote to memory of 4996	3096	msedge.exe	86
PID 3096 wrote to memory of 4496	3096	msedge.exe	87
PID 3096 wrote to memory of 4496	3096	msedge.exe	87
PID 3096 wrote to memory of 4496	3096	msedge.exe	87
PID 3096 wrote to memory of 4496	3096	msedge.exe	87
PID 3096 wrote to memory of 4496	3096	msedge.exe	87
PID 3096 wrote to memory of 4496	3096	msedge.exe	87
PID 3096 wrote to memory of 4496	3096	msedge.exe	87
PID 3096 wrote to memory of 4496	3096	msedge.exe	87
PID 3096 wrote to memory of 4496	3096	msedge.exe	87
PID 3096 wrote to memory of 4496	3096	msedge.exe	87
PID 3096 wrote to memory of 4496	3096	msedge.exe	87
PID 3096 wrote to memory of 4496	3096	msedge.exe	87
PID 3096 wrote to memory of 4496	3096	msedge.exe	87
PID 3096 wrote to memory of 4496	3096	msedge.exe	87
PID 3096 wrote to memory of 4496	3096	msedge.exe	87
PID 3096 wrote to memory of 4496	3096	msedge.exe	87
PID 3096 wrote to memory of 4496	3096	msedge.exe	87
PID 3096 wrote to memory of 4496	3096	msedge.exe	87
PID 3096 wrote to memory of 4496	3096	msedge.exe	87
PID 3096 wrote to memory of 4496	3096	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://aupost.orderacceptform82054.com/20294088
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd5b2f46f8,0x7ffd5b2f4708,0x7ffd5b2f4718
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,17510729461438536480,4215070596694306895,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,17510729461438536480,4215070596694306895,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1992,17510729461438536480,4215070596694306895,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,17510729461438536480,4215070596694306895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,17510729461438536480,4215070596694306895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,17510729461438536480,4215070596694306895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,17510729461438536480,4215070596694306895,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,17510729461438536480,4215070596694306895,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,17510729461438536480,4215070596694306895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,17510729461438536480,4215070596694306895,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,17510729461438536480,4215070596694306895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,17510729461438536480,4215070596694306895,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,17510729461438536480,4215070596694306895,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1868 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
25f87986bcd72dd045d9b8618fb48592

SHA1
c2d9b4ec955b8840027ff6fd6c1f636578fef7b5

SHA256
d8b542281740c12609279f2549f85d3c94e6e49a3a2a4b9698c93cca2dce486c

SHA512
0c8a0d1a3b0d4b30773b8519a3d6e63d92973733da818ca9838599a9639e18df18ce31ebf56f46f6bbb7d89d10c726f4d73781e154d115a6068a3be7dd12b314

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
94bd9c36e88be77b106069e32ac8d934

SHA1
32bd157b84cde4eaf93360112d707056fc5b0b86

SHA256
8f49a43a08e2984636b172a777d5b3880e6e82ad25b427fef3f05b7b4f5c5b27

SHA512
7d4933fae6a279cc330fde4ae9425f66478c166684a30cec9c5c3f295289cf83cbdf604b8958f6db64b0a4b1566db102fbcbdcdb6eca008d86d9a9c8b252ff16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
489B

MD5
0b3211a154fd1499b6b22ed5c392303c

SHA1
caa154d66a3a82781574c0d5e027f7d0314fad45

SHA256
c929fd642dba4ab8fe87004fb30a1cf0e67d31ad480a1dbd1edf2d9970361657

SHA512
f7f6804c1ab8ef3b6798a7504827e3d59a6169836cd89d1077122e5bb7520fd0295263445d7db9a5eae80989d213c6a4f3f6b3c314cee92e7d2383dddf4a76a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
63f09a2d591fa2e2b5f14818a038de3b

SHA1
35a90547b69d359a2766cd8ffbdab3f1c59f4d76

SHA256
0c7dea59294de76554163630bd6b2af5d714770b7df83c96c2a837c1f81953a5

SHA512
e5ebded7831ea8ab23d15344cdfca68790aba075adc30d246da2cc694c4e6fd4368342267369703b9bd560caa626115a7ce8527c9e2b9c642770260e4deb2413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
71c9bad11fbfbe11f8bb4ee0cc05cf33

SHA1
8fe81d2b5ffeb2121532d0ac41d0bd95381c16d0

SHA256
cbe46da9d0f9d5e57af90f65d3a1eae3491b469037cc56f69db6bb5015b57788

SHA512
5f432d92a660ed0fdb2e394ec1b65248f3a3d404dc02d02c5f60f7b9e4a5a64fd337373cf5361e5d54fed226cf506c6b52f69738c659f556442f073bf84e350b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
24fd72ac55bc6361873538caa7408084

SHA1
00492e700c6b96d332ee67dc4b4efe68495cfe78

SHA256
930898a88d52c55bf9e655b2500c1e499888d231fbb312f2e5bd960ff74e3f54

SHA512
84326ebf70403a9875ac0a04c5e704782348bd40700940bb7feb3c135530f2dfb0dea614cc971b46156d67fceed4077a7f43c70b564f986ef208933b706f374a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a0db9d244f45e39c2dad40b074f7b18a

SHA1
83ba85af6825ffb9879670500a5ae5360e85c73a

SHA256
d428f502804605087e2b54043f42e9324f6a37a383c1a2c4e7d07dabd5bff59a

SHA512
822460c956f4f7fbd670d0832e7bc145f1b0b869d49312ecb7a2eeb942ef03c99e51d5a0df558273ff4b81bef4f74a509255f90c1bb495b895405185749b669d

Download Submit