hxxps://www[.]hybrid-analysis[.]com/feed?json

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
12/11/2023, 23:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://www.hybrid-analysis.com/feed?json

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1000	msedge.exe
1000	msedge.exe
1056	msedge.exe
1056	msedge.exe
4912	identity_helper.exe
4912	identity_helper.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 4292	1056	msedge.exe	50
PID 1056 wrote to memory of 4292	1056	msedge.exe	50
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 4420	1056	msedge.exe	87
PID 1056 wrote to memory of 1000	1056	msedge.exe	88
PID 1056 wrote to memory of 1000	1056	msedge.exe	88
PID 1056 wrote to memory of 4020	1056	msedge.exe	89
PID 1056 wrote to memory of 4020	1056	msedge.exe	89
PID 1056 wrote to memory of 4020	1056	msedge.exe	89
PID 1056 wrote to memory of 4020	1056	msedge.exe	89
PID 1056 wrote to memory of 4020	1056	msedge.exe	89
PID 1056 wrote to memory of 4020	1056	msedge.exe	89
PID 1056 wrote to memory of 4020	1056	msedge.exe	89
PID 1056 wrote to memory of 4020	1056	msedge.exe	89
PID 1056 wrote to memory of 4020	1056	msedge.exe	89
PID 1056 wrote to memory of 4020	1056	msedge.exe	89
PID 1056 wrote to memory of 4020	1056	msedge.exe	89
PID 1056 wrote to memory of 4020	1056	msedge.exe	89
PID 1056 wrote to memory of 4020	1056	msedge.exe	89
PID 1056 wrote to memory of 4020	1056	msedge.exe	89
PID 1056 wrote to memory of 4020	1056	msedge.exe	89
PID 1056 wrote to memory of 4020	1056	msedge.exe	89
PID 1056 wrote to memory of 4020	1056	msedge.exe	89
PID 1056 wrote to memory of 4020	1056	msedge.exe	89
PID 1056 wrote to memory of 4020	1056	msedge.exe	89
PID 1056 wrote to memory of 4020	1056	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.hybrid-analysis.com/feed?json
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe031846f8,0x7ffe03184708,0x7ffe03184718
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4198043945020907337,630862121299316859,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,4198043945020907337,630862121299316859,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,4198043945020907337,630862121299316859,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4198043945020907337,630862121299316859,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4198043945020907337,630862121299316859,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4198043945020907337,630862121299316859,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4198043945020907337,630862121299316859,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4198043945020907337,630862121299316859,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3376 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4198043945020907337,630862121299316859,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3376 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4198043945020907337,630862121299316859,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4198043945020907337,630862121299316859,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4198043945020907337,630862121299316859,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4204 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\19414810-7313-4d37-b429-09425e4dad5a.tmp

Filesize
10KB

MD5
749cff04c86a92d61903e2b8288d25a5

SHA1
b5140d4fa977e200bb7e2747fb73b46da8e82ed8

SHA256
3be31490b4f58c2300608ef9d8b08acb73c3d96615f25cf51869e285db6cbe38

SHA512
b5e41d22f7183b9a06bf654ddd6f760ca4fc1a4a7075449d3e0a009e894994925400fd5e146b74383f0ed0c79291b805d3944fc9195bdcbb4c6465768daf4970

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
84df16093540d8d88a327b849dd35f8c

SHA1
c6207d32a8e44863142213697984de5e238ce644

SHA256
220f89151a0f978b8bbe338b937af90417ae8c17b72a53f2acea7be2ac171a8c

SHA512
3077ccda8f86f47c41978d6cbb1dcad344e36f236251c8fd8c58d1c48a59106aecfdbe306357b7ebcfe3300bec8ea10ee0e59434c799e8c40e40e6c3c1bd4098

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
191B

MD5
8e9788a644e235e1a76f40bc09a77667

SHA1
7d4d46972b3c3b4612bc8d04c52a3e11cc16dfdf

SHA256
98c6978ad381f77905100ff332f77b917d10d0afc8dd968be83a695ecf2ccf45

SHA512
a7584319177327b8a8b650be442697a2121328d56a0bf6a74b0751540dc80176d8d6bd2cbe380f89d345fe2e38e98dcb5195de480e106979ed19c94cf25269d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
232112d6f2c21a18a20077838008938c

SHA1
9226dab2b28618a321322a69003b156fe6b94065

SHA256
e3f9ee7c2c2fb612ace9e94c48972bf6dc881820c168bcd8db8c60f141221f11

SHA512
377e1a869e3a34414fb0096ce150433005710e7c40b0a92b6f08c4c3c0054b76817dd282416279a1418bb7c51a66838bf68348b44f84ec8ef7e6875d05be54e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
322e8a066940b089cf43c7903265c73e

SHA1
6c3de06ffed72b80579e433e3b6c22b28256febc

SHA256
4cafbb9769bec20289ed8232864e78bad9081e2f66cd820d594b2f060384ab80

SHA512
71ee8ee80f8399f3ff0e4468abe2545ccd9b384ea50c205f3d13512401dde0f4c1f27f754d2bf216349e71ba29256aa042a87479a7636248f4c3338c5af24c25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e5c5915ea31c64936bfa755940b94072

SHA1
f9b272271a8cbef6b1c2c449b5435e400b0c6436

SHA256
c24b6eedba2d28dc0cddf34d592a64a3f6ff149e8983c2c3ee70f6a90d426245

SHA512
7beda4f5e894cefe054443bd048dbd9f6f7932661bfe7c545575426848a74caf34c3fb9f2b292e5170dd9888e8b810631644078e855839df0841ec780e3beec9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
918ecd7940dcab6b9f4b8bdd4d3772b2

SHA1
7c0c6962a6cd37d91c2ebf3ad542b3876dc466e4

SHA256
3123072fba0ea8e8f960dd213659a0c96ce2b58683593b8ea84efac772b25175

SHA512
c96044501a0a6a65140bc7710a81d29dac35fc6a6fd18fbb4fa5d584e9dc79a059e51cbe063ca496d72558e459ffa6c2913f3893f0a3c0f8002bbca1d1b98ea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
9848bc1f4e5b81c10b0cd1379ef133db

SHA1
9aa16dd4c20814f4301066a24fd1bf69a5c4672b

SHA256
8e9bc10c0e89e6b09e4ff522bb7fb0dfcedffa2f3a8976ceea92117bc0efa5a9

SHA512
ad89a4dc74ac19035bc012c37df6ee91505438d9c28a9026c051a8d24c13ad56ba7518f04985046c4fdeaea3a1d83beba5fb8c425f72f35912c112480704ea6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581940.TMP

Filesize
203B

MD5
d8e88ae6a69fea5e3e73b5e209955b70

SHA1
ad3cd90d1b3911eabd017dd155fb69f37dffc91f

SHA256
814803e9c131eb370c5e33e75ce21a6370f0d8b998519ab28010e22cd5e5bcd9

SHA512
a241a4cdac8e9405e4fdabdaf6f6badaf8a69fabb9d3ba11e2d73d07052f6bd85aea54b16fa3f1a462b651c06851f302ba664ad2a6a9affd45408c80a4f37eef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit