hxxp://tools[.]ietf[.]org/html/rfc6591

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2023, 16:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://tools.ietf.org/html/rfc6591

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2712	msedge.exe
2712	msedge.exe
216	msedge.exe
216	msedge.exe
1244	identity_helper.exe
1244	identity_helper.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 3564	216	msedge.exe	34
PID 216 wrote to memory of 3564	216	msedge.exe	34
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 1316	216	msedge.exe	87
PID 216 wrote to memory of 2712	216	msedge.exe	89
PID 216 wrote to memory of 2712	216	msedge.exe	89
PID 216 wrote to memory of 4868	216	msedge.exe	88
PID 216 wrote to memory of 4868	216	msedge.exe	88
PID 216 wrote to memory of 4868	216	msedge.exe	88
PID 216 wrote to memory of 4868	216	msedge.exe	88
PID 216 wrote to memory of 4868	216	msedge.exe	88
PID 216 wrote to memory of 4868	216	msedge.exe	88
PID 216 wrote to memory of 4868	216	msedge.exe	88
PID 216 wrote to memory of 4868	216	msedge.exe	88
PID 216 wrote to memory of 4868	216	msedge.exe	88
PID 216 wrote to memory of 4868	216	msedge.exe	88
PID 216 wrote to memory of 4868	216	msedge.exe	88
PID 216 wrote to memory of 4868	216	msedge.exe	88
PID 216 wrote to memory of 4868	216	msedge.exe	88
PID 216 wrote to memory of 4868	216	msedge.exe	88
PID 216 wrote to memory of 4868	216	msedge.exe	88
PID 216 wrote to memory of 4868	216	msedge.exe	88
PID 216 wrote to memory of 4868	216	msedge.exe	88
PID 216 wrote to memory of 4868	216	msedge.exe	88
PID 216 wrote to memory of 4868	216	msedge.exe	88
PID 216 wrote to memory of 4868	216	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://tools.ietf.org/html/rfc6591
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb060546f8,0x7ffb06054708,0x7ffb06054718
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,16782227329709459155,4179054019110997295,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,16782227329709459155,4179054019110997295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,16782227329709459155,4179054019110997295,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16782227329709459155,4179054019110997295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16782227329709459155,4179054019110997295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16782227329709459155,4179054019110997295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16782227329709459155,4179054019110997295,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,16782227329709459155,4179054019110997295,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,16782227329709459155,4179054019110997295,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16782227329709459155,4179054019110997295,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16782227329709459155,4179054019110997295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,16782227329709459155,4179054019110997295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,16782227329709459155,4179054019110997295,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1288 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
483924abaaa7ce1345acd8547cfe77f4

SHA1
4190d880b95d9506385087d6c2f5434f0e9f63e8

SHA256
9a111c2b76c1b5f6d4f702502b9ff4326b7b5682921c2760286dd073824cb684

SHA512
e4ac0a0d5f06e056901c68488e34358a32a5bc7aeffcd82af7eba6043d0fa35eaa67a67c3716dcb661aaca441677819bcba7d35bc4efc6103f3ce32f78e32310

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
89e2c95bcc75ac8d72a20f7ce5f445ef

SHA1
cd80b2cad87de0d202a8ea70dd3d6ff6afede300

SHA256
8d7140f8e86373efa8904d0dec0caf9df0b33e31b38dbb9b77489e71b7414576

SHA512
d21c97fbcedd3145f43e4e38e41552b1fb5714182ead1356fdf8b9c66b184ce013b851bc49ff0fae16a00711f8faf2d13490ae5c8524c7e3a31a68c929c46c49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
331B

MD5
90c67b3a2fc704a6b739e077961bcad0

SHA1
48e873cb4477321d200c76f8e4b859371c23e093

SHA256
2f6688159ecbaac3b7299e6d644fc2c5a97f3f3dfacc1477274876d6811cec25

SHA512
ead967756dd82369729989410309eb41b892dfbfdb0666f5d05a487318b5653a73d239771db25c71deb972d9e35b41b4ede596c28ed250738554bb5464dc7ecd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a610d7ae5d3a4f9dc2e73ff84d14c72d

SHA1
e368f61a0da41822b9da98561d67328c86e61cc2

SHA256
197c6af26f6b78e78a4d1e3b4fb713abd255780ed43c85fe47769be09643c86a

SHA512
525aa47e0525be1a8f8270985e2976cfba4f1ee42391cb0f32b59f7c44fb75def0b798aafebf4213ea4010c4145194c10c2f27605fe735ea1b73902407fbb12f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
eeaf27e0897d2f0576f460ef96c6f17f

SHA1
48708f8c7e0dbd8fbac6510e92285641a005ed7d

SHA256
bd2fbcc93f2ebd0f889294fa48b2b88ab9c248cb7f364afcbdeb283472aec826

SHA512
547a9b0b2805ef4185ec52fb5e89667e1d6d56ffcef35e06a6e7badd8d1040492180908e5dd30c3228beaac1ce38a15057366a53f64edd0ae3ea0f2775d8ec52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f13fa3d33ca1a9840f3ed051356ad0e9

SHA1
78d6c9a9b48dfc729dd404123c1cc73f696bfa73

SHA256
3ac9238513b8a5430d579289f8ab5bbed699ec616f9a9639f10cad3c167a1010

SHA512
b18d3b8fed46812a85786888fbb2726f78d018361ef56bb60162ae7cec2b2ba48379cc9a567d74968a77e2de8f2032d6141a4b6b09eb5b81874aba7a550d841c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1c706d53e85fb5321a8396d197051531

SHA1
0d92aa8524fb1d47e7ee5d614e58a398c06141a4

SHA256
80c44553381f37e930f1c82a1dc2e77acd7b955ec0dc99d090d5bd6b32c3c932

SHA512
d43867392c553d4afffa45a1b87a74e819964011fb1226ee54e23a98fc63ca80e266730cec6796a2afa435b1ea28aed72c55eae1ae5d31ec778f53be3e2162fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8ef67013360fcc43d852cec4ab9f1b5e

SHA1
8a6d9e19b302d69d160609404e04a437b1e6a650

SHA256
6502e5245e7e86a6919f0bee56103adc4ac665dd21811eaa5d9189ecf3860099

SHA512
fd7fd075e7fbca4cc409a8c21de7841f3a9174bfc13b2f88bcd72bfb630c8accbb990ffc449cb9681c031fe8784fa7f54fe05e11f07bb19e98fc95f34a278ab8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3468ba0eaa5fc71d29fad10a94e26445

SHA1
e3c7edd17697b7efd8249dfe4204635c6f3e7b40

SHA256
3acd8fa1cb6c895711f96d0b82ebc4fa83f1e1bc584826e540bb699cfed2ef50

SHA512
5735e91c3bab27e219a8323840636633fe329c800a711472f5d9504d62560439fe1c73817b188cd0ed04859f7a71060d2a5852b66fd59af2c69c2d9d85c0a760

Download Submit