Analysis
-
max time kernel
142s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2023 11:22
Static task
static1
URLScan task
urlscan1
General
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exepid process 4652 msedge.exe 4652 msedge.exe 952 msedge.exe 952 msedge.exe 4872 identity_helper.exe 4872 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
msedge.exepid process 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe 952 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 952 wrote to memory of 4800 952 msedge.exe msedge.exe PID 952 wrote to memory of 4800 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 3132 952 msedge.exe msedge.exe PID 952 wrote to memory of 4652 952 msedge.exe msedge.exe PID 952 wrote to memory of 4652 952 msedge.exe msedge.exe PID 952 wrote to memory of 4948 952 msedge.exe msedge.exe PID 952 wrote to memory of 4948 952 msedge.exe msedge.exe PID 952 wrote to memory of 4948 952 msedge.exe msedge.exe PID 952 wrote to memory of 4948 952 msedge.exe msedge.exe PID 952 wrote to memory of 4948 952 msedge.exe msedge.exe PID 952 wrote to memory of 4948 952 msedge.exe msedge.exe PID 952 wrote to memory of 4948 952 msedge.exe msedge.exe PID 952 wrote to memory of 4948 952 msedge.exe msedge.exe PID 952 wrote to memory of 4948 952 msedge.exe msedge.exe PID 952 wrote to memory of 4948 952 msedge.exe msedge.exe PID 952 wrote to memory of 4948 952 msedge.exe msedge.exe PID 952 wrote to memory of 4948 952 msedge.exe msedge.exe PID 952 wrote to memory of 4948 952 msedge.exe msedge.exe PID 952 wrote to memory of 4948 952 msedge.exe msedge.exe PID 952 wrote to memory of 4948 952 msedge.exe msedge.exe PID 952 wrote to memory of 4948 952 msedge.exe msedge.exe PID 952 wrote to memory of 4948 952 msedge.exe msedge.exe PID 952 wrote to memory of 4948 952 msedge.exe msedge.exe PID 952 wrote to memory of 4948 952 msedge.exe msedge.exe PID 952 wrote to memory of 4948 952 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://eu.docusign.net/Signing/EmailStart.aspx?a=fc2e6ed8-19c5-4a2e-b15b-b130345794be&acct=1bae4dca-d1dc-4f03-8fff-91b6b4c9ec71&er=a052fa95-5caf-4d03-bc2b-a0fc47574e081⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9994446f8,0x7ff999444708,0x7ff9994447182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,1876160558350616149,1631526578724389995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,1876160558350616149,1631526578724389995,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,1876160558350616149,1631526578724389995,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,1876160558350616149,1631526578724389995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,1876160558350616149,1631526578724389995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,1876160558350616149,1631526578724389995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,1876160558350616149,1631526578724389995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,1876160558350616149,1631526578724389995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,1876160558350616149,1631526578724389995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,1876160558350616149,1631526578724389995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,1876160558350616149,1631526578724389995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:12⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57c89e9212e22e92acc3d335fe9a44fe6
SHA1c43c7e1b5fb58a40a01a6d8dd947c41a48e0b41f
SHA25618c46c863404b31fcce434662806fa34daff0f9af0a9379d898f772b5c398b44
SHA512c6961c171af63ddc7a72aaba4c9d910cc6a424794c416cd1ce51206f7c7f1100ca51c9e41d07d68489105dccded2294c1d761a8dc6be80d22c661014efd6a9ab
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
1KB
MD5db7067b02c36fcf51e9b275ee12b1c98
SHA1163852c60ea687b4a7350b929fc69d06cf85974e
SHA25633e24bfe021122fa91818c1cc1381496ff744a8c085209b975cdc8ff044b0d83
SHA51273ca142f4e87c5c94efc793e810f5cae40a9aa7467636ef3fdd36f465ad20699bc78e8a1c1aae8affa8f9d68275c3209b84d77b48def5afe352c34e903f36bfd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
336B
MD5b43a2ae65422d84ffb1b593e21c06005
SHA1077e791236744c05469b823ea36164ed8a2f7819
SHA2566c01b84fdea6a75b4fcce3fa09959e55dfebbdc5120bc064e4862aa4f5f3cdb5
SHA512145665addd010919cf9aa275e03bda3d12deaec53ed9b5a5367e93e421f51b3c60f7ef7b0c517a4c4d2c18610e4d32678930aa8cbae4d4c9d5d398b452b4812c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD518f8f2269c3cbe35e2a6879551214f4f
SHA1fc9a3a0c2eb85d0e24d57d00b862822bc4ec3fc8
SHA25697fce03f207f05dd245873df0d1516f30ebc91dee6882c3f2f2f0678a153b37a
SHA512970c611de24c7416a852db9acc0f5f477fa8128d97df6712b7cc0afc1165d6d674fd94a2dba71bae5a64a7a3d8766c74494afb4b83b209555ff53731aa7396a5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5c8c699cec10ecffa9c8108e26740a15c
SHA1e3db55e5b5382707a1e8284faec0b6e8f3158e59
SHA256b9fc2c49ce8ebb457897e694f3129530449122a5b178641a0120eefa583c1bff
SHA512132845c27e551df69e5f75a903c549ee25f11ad646f608338e4f4224ab81bfcf5aa48018fca896d77362595f48cf057b870135942f42ee86885dbc6afa62bd00
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD570c2b09157c7452d38aedf20f3447bda
SHA163bc3cfaf2049958ddb335f59eec633b76b76afe
SHA256adcfbf4c085e3046acf53579a18faa20711e5dae8c3af42e3d0b1f5bda68b285
SHA512f7766773ac916f0924e7023e0df32590f56a508bf17778a412c3a3d6076ef7e93621f67be4bd17674d7253fad32508369e4e69ce5d2036201b3810ea4daa1213
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD5d7b2b29ef1d9a33e61e1167984c8ca3e
SHA19a0da1a3cf9003ecf6aba220a8a00ca34a7ebd34
SHA2567d4bbec0e8bf4e62f352750240a0bc0f7844d58fea590bc6a9fc972c3b752dc2
SHA5123cc40b7e35c0749e419b035a73768c8f76bace77ed44be6a59469a032b643da15162733e5aaa94064494b055858a24e4f79326a863f31f1c28eab44cec35cbec
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
370B
MD52ebf7606e8dd3ae79080cfc0ba8a929f
SHA16d2a7a65785ded76e17f266333d4c3ff943be321
SHA256d307542e5168ef50fdef5c3db6b4abb9faf95a4918baab003f8f0b4f00ba5f74
SHA512e1658bd87eac994e10f49213de365253317c21b5448be05ce4e6f99b072375076feb1682fabfaccbd3d191898061afa96a4c9101d79cab993fc0d6cf2ad81c78
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
370B
MD503befd323299a11cb183e7082b001b1e
SHA153babd762b3f6a7cdfb9f7f2468a90ba2e706e43
SHA256463885025f6572a8fe11764286d0b4741ddebbb8ad04f7dfa702c966c1bf16da
SHA5125b9de13b227f49e43f10755bd06137968a064d55510ed98d5ec35e515cca81287e00105716c4f76f8423ffa78f74ac667598935c7055bcd2fcb6ba43a80d628a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD55fef7ecd998df9c926fec7d490c9764d
SHA1586820baaa831e8c335e666f33a35e4de115ebd1
SHA256a90d6ff7befd3c6115727f7bc0c61d69b3c23846f939b4461a46b9011f69d1ab
SHA512a3b67663d1d8d2fa33f3d69d3f55252fbed2df6c2e51ca1857c8f028e8b96dc176ae15aee435c29d7aef369a8ea32db907b3ff027ab8331846beb6f550df3455
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5fd0e3446add6e789e7b1c1c40a623f77
SHA13d4be12799776ecca80164e236eb3a5e538f3589
SHA2567d9826b6ae29852ae137de811089e9a720f3d584f59650b12bed44f9c030f1d5
SHA51248fdfd449ced1fd89c508f44ff7d609bdfe78c00c27e63ac556d739f23dd1e15d9eaa080a69a7985228f01cd8888332616be648557a4e03bdc56570481442676
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD5d0d5a9dc92f7d5502f017b8759139155
SHA1a437cb1712cae19e8c2aef4e97bd474f2dd90d89
SHA25668cabd22c3a4c4ae201980a5126390c6bbea38f2b342d1a1ad84eadeacbae583
SHA512e5d7ee41cc8c87b7fca632aeb13f183e946ff8f40b36c950e4758a2b06152cced8490ca3d77bd24ef4e69ae8d5e8a56e32cbd933b874d086e0e97e012e22be2c
-
\??\pipe\LOCAL\crashpad_952_TSKENFYJGJLXFQJTMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e