hxxps://ste50-card[.]com/50

Analysis

max time kernel
147s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
05-07-2024 07:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://ste50-card.com/50

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid process

4560 msedge.exe
4560 msedge.exe
2368 msedge.exe
2368 msedge.exe
3880 identity_helper.exe
3880 identity_helper.exe
72 msedge.exe
72 msedge.exe
1460 msedge.exe
1460 msedge.exe
1460 msedge.exe
1460 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

2368 msedge.exe
2368 msedge.exe
2368 msedge.exe
2368 msedge.exe
2368 msedge.exe
2368 msedge.exe

pid	process
4560	msedge.exe
4560	msedge.exe
2368	msedge.exe
2368	msedge.exe
3880	identity_helper.exe
3880	identity_helper.exe
72	msedge.exe
72	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe
2368	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid process

2368 msedge.exe
2368 msedge.exe
2368 msedge.exe
2368 msedge.exe
2368 msedge.exe
2368 msedge.exe
2368 msedge.exe
2368 msedge.exe
2368 msedge.exe
2368 msedge.exe
2368 msedge.exe
2368 msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2368 wrote to memory of 4908	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4908	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4452	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4560	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4560	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4616	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4616	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4616	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4616	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4616	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4616	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4616	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4616	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4616	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4616	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4616	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4616	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4616	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4616	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4616	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4616	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4616	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4616	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4616	2368	msedge.exe	msedge.exe
PID 2368 wrote to memory of 4616	2368	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ste50-card.com/50
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffb0e43cb8,0x7fffb0e43cc8,0x7fffb0e43cd8
2⤵
PID:4908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,15922701879937810932,1791339539799273265,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2016 /prefetch:2
2⤵
PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1976,15922701879937810932,1791339539799273265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1976,15922701879937810932,1791339539799273265,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2504 /prefetch:8
2⤵
PID:4616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,15922701879937810932,1791339539799273265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
2⤵
PID:2824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,15922701879937810932,1791339539799273265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
2⤵
PID:1416

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1976,15922701879937810932,1791339539799273265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,15922701879937810932,1791339539799273265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
2⤵
PID:2528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,15922701879937810932,1791339539799273265,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
2⤵
PID:1196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,15922701879937810932,1791339539799273265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
2⤵
PID:4092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,15922701879937810932,1791339539799273265,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
2⤵
PID:2456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1976,15922701879937810932,1791339539799273265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3940 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:72

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,15922701879937810932,1791339539799273265,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4808 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:808

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
c00182578404b4b6fcfde21669962dd4

SHA1
25e096b73941797b77cfb40dfc84e5d38102b1ee

SHA256
6b4b411180d903dcee076619b1b6af71d0e35569e68f0d330f8050a94e5c521e

SHA512
06a13324b95603357abbc051ec4fd083148bb28da731f8b83d4066bd47d73a7383a58d4dba52ecd63f28ff46070669dee07ce8e8f87fa07207af122264e95e9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b8739e9507ed3529c450eb5b6ac83e21

SHA1
0f933f32c39a0af112fbe0a58e5d7a9edc617965

SHA256
2b35918fecd0a80628088d9069436558b2dde8eb14de4162abf9c2e4538eaa13

SHA512
e852a75b3505554fc690faa3720b2889c884602b724210533c608649e1a1a58ebb33975ee0acfe9767ab09ddac120e934bc9662a9949750665a3a350ba9acb67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
471B

MD5
60f0d12e6e02a17ac6afd959dc5f9525

SHA1
b89c8504330fa8672aff449dfdbc2ab5d0c8787d

SHA256
e9b8a121b1ed3d2d8b0a728b56da47c15605921e676ec37b7cdd47b42d0a01c6

SHA512
217f65311b2d7791a45faa46b78f5c5b970a207cc94a09fd7e27e79999e49e99400f336880f150a89bc005cc607931b5e9d12e8482eadeb807eec37ce75362e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
aa83fef7d64a19d2d2255b2ef3be1717

SHA1
23cda1c6233dd797856695e067bcf23a1d13266c

SHA256
5d4b31674ad99b827cdd1885542a3685744252cdad297c952c0ae52e0dfe0085

SHA512
f46cbb017c984d4225a943cf99c5b8071e142d5e18f0984983539642428094b70ed1f36c92802b064828b9ebae8e7f6f65f18d56aa1110aa3f359e9cae192a0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
c423f09f4a54604d718462b4624d345c

SHA1
12d65a36577649b5974b8fc1507ec25340e740ca

SHA256
039cbe936a3ab4af2deb13c124b3bf79dfd7a62f8dffd6dfb5d7de9cc98d4fa0

SHA512
093a577d71361bf9b624044c41adf998617020c5d26ccf2243d56aab8aaff91e43d154655f192b41dd6cd02e8dc9f09d9e3990cbea9e0d71e20f049f29f11a6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
46caa6571ca757c778aa2c0230e192a3

SHA1
9280722e872981f304c19abe629ad1f9236a1935

SHA256
706888f8212a8c705f445e2875fac1fd3102912ad77665d6838ec85cb3d831a2

SHA512
3d1b2a2f331f0294aea9d087d5c361c609177e660af032cc861721fc693e1d15c12f561352d92c1f558c7a3df6187561c9f1b1d98472204510c391fe642278a0

Download Submit
\??\pipe\LOCAL\crashpad_2368_NAGFZYSZCYBXSJEZ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit