hxxps://indd[.]adobe[.]com/view/99694266-9cef-4b38-8120-7bf856a8f463

Analysis

max time kernel
11s
max time network
31s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05/01/2024, 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://indd.adobe.com/view/99694266-9cef-4b38-8120-7bf856a8f463

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
2408	identity_helper.exe
2408	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4876	msedge.exe
4876	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 3988	4876	msedge.exe	50
PID 4876 wrote to memory of 3988	4876	msedge.exe	50
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4348	4876	msedge.exe	94
PID 4876 wrote to memory of 4708	4876	msedge.exe	95
PID 4876 wrote to memory of 4708	4876	msedge.exe	95
PID 4876 wrote to memory of 3928	4876	msedge.exe	98
PID 4876 wrote to memory of 3928	4876	msedge.exe	98
PID 4876 wrote to memory of 3928	4876	msedge.exe	98
PID 4876 wrote to memory of 3928	4876	msedge.exe	98
PID 4876 wrote to memory of 3928	4876	msedge.exe	98
PID 4876 wrote to memory of 3928	4876	msedge.exe	98
PID 4876 wrote to memory of 3928	4876	msedge.exe	98
PID 4876 wrote to memory of 3928	4876	msedge.exe	98
PID 4876 wrote to memory of 3928	4876	msedge.exe	98
PID 4876 wrote to memory of 3928	4876	msedge.exe	98
PID 4876 wrote to memory of 3928	4876	msedge.exe	98
PID 4876 wrote to memory of 3928	4876	msedge.exe	98
PID 4876 wrote to memory of 3928	4876	msedge.exe	98
PID 4876 wrote to memory of 3928	4876	msedge.exe	98
PID 4876 wrote to memory of 3928	4876	msedge.exe	98
PID 4876 wrote to memory of 3928	4876	msedge.exe	98
PID 4876 wrote to memory of 3928	4876	msedge.exe	98
PID 4876 wrote to memory of 3928	4876	msedge.exe	98
PID 4876 wrote to memory of 3928	4876	msedge.exe	98
PID 4876 wrote to memory of 3928	4876	msedge.exe	98

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://indd.adobe.com/view/99694266-9cef-4b38-8120-7bf856a8f463
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbbed46f8,0x7ffdbbed4708,0x7ffdbbed4718
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,8875915933515716966,3813842702511410109,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,8875915933515716966,3813842702511410109,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8875915933515716966,3813842702511410109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8875915933515716966,3813842702511410109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,8875915933515716966,3813842702511410109,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3000 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,8875915933515716966,3813842702511410109,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,8875915933515716966,3813842702511410109,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8875915933515716966,3813842702511410109,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8875915933515716966,3813842702511410109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8875915933515716966,3813842702511410109,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8875915933515716966,3813842702511410109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:5612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bcaf436ee5fed204f08c14d7517436eb

SHA1
637817252f1e2ab00275cd5b5a285a22980295ff

SHA256
de776d807ae7f2e809af69746f85ea99e0771bbdaaed78a764a6035dabe7f120

SHA512
7e6cf2fdffdcf444f6ef4a50a6f9ef1dfb853301467e3f4784c9ee905c3bf159dc3ee9145d77dbf72637d5b99242525eb951b91c020e5f4e5cfcfd965443258c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e1a6bf1c3700f752fba8bbf40234da47

SHA1
acaf9ccc37d5cadc0a27d1e0569df9f280585699

SHA256
0250ecd680c1d0a2f128ae6293a14d399556dd5e5144c6d0352e657da4f38422

SHA512
b53aeb5371caf029e0363831eb656f95a3af195e2ec396f3becb84118b74cca7530b392523bdc9ec16c87e451150bf6cf6461f35e49292dc9663118a79e6a777

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a40cb046b06871e46c8b96ccd69f0754

SHA1
74efd0bd3c503b9dbfd01da9a81dafa7d34294cf

SHA256
c668da9127502ce2579bbedf851948eeeed0658d2a9987bfbf08c716b954897f

SHA512
d6b7544143bedbf03019f216dc2a12273b240705d235cd2d57125aaebf7f39f9f0c761f804a2b383c46f6cb48bb296f7e112d61c896aa58133ccf8ec14cee325

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0dcc7b60244c58fad2a4e0c8eed3fce6

SHA1
70b0d48fcd6e26a97592bc4e8ca01991d6ca540e

SHA256
036b97276f919a1eabb8bf9139b3f766beb79b637a816dc7b1bf3707d50a8c8e

SHA512
7c5cae847fa3c4d477aee95b5715f959015c9ab8e7762073444f349d7f2a99952f319ec48c258117a88ebae729598a13c81158a2dd2b59a0cab79ae42a33f125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
b0ba6f0eee8f998b4d78bc4934f5fd17

SHA1
589653d624de363d3e8869c169441b143c1f39ad

SHA256
4b5ee509e727accbd11493dda2c1d512e7dbfaff66c4f5f7ea9c2d2ccd06151f

SHA512
e9a165da246c6b80fc38431538203cf03f95794184ff63f00c9500f8919a2028b803f64b670e685185eed72df0509e3185c9b434fdbf2bc7af36021d46bd08d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c39874e1530218f0ee54a0c1ebd4b364

SHA1
c6718d6b10a721c92c05ec71e869fc4f79c37d97

SHA256
1712b822fafe827cc599c4159f70564fc4fcb002b5d67aa171938e882c19af0a

SHA512
661d78f746f2431da898947eeb19c167d7f272c3991666d4a47c46872285019dc3b9b3b76dea5604a67eeeff86ea29c2dc95384708b24c0384f77cbceeac6b7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579ba4.TMP

Filesize
1KB

MD5
bf5ef9ab6b1670e3e07d55541714385c

SHA1
4e878fcde3ced787f644b2a4a5b05968040f78b4

SHA256
2a74abf536b2dcd1b49be0297598952aa80a85e2e771fd346b05c6c28482011c

SHA512
8ac5845ed350339fc2b912ffde3fb2f54190d8db265f21f3646b283a80178c5962059e9ded892f452f23df248e918186ec7b17cc00a6b65c15d48c7f1a49de9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bddf247dd50c9eb9052c644f5245e563

SHA1
2f40cd35b99309c8fc2c26da07fb98d6e506e53a

SHA256
8411c017579e85c0c449ece02f1567a5f21efdb8d21fff47eb5d68f06c8e7f3e

SHA512
a18757b6e4dc4e578db8e806a9b3c64a283e65dd60546eadd798c67eb3ec4bea0d684bcd4c37d206dde5e5c211e8c89917e7bc520bef7c36fdc8626482b6c385

Download Submit