Analysis
-
max time kernel
50s -
max time network
47s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 16:03
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exepid process 1080 msedge.exe 1080 msedge.exe 1476 msedge.exe 1476 msedge.exe 3680 identity_helper.exe 3680 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe 1476 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1476 wrote to memory of 2768 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 2768 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 4300 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 1080 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 1080 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 1504 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 1504 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 1504 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 1504 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 1504 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 1504 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 1504 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 1504 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 1504 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 1504 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 1504 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 1504 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 1504 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 1504 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 1504 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 1504 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 1504 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 1504 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 1504 1476 msedge.exe msedge.exe PID 1476 wrote to memory of 1504 1476 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffed2eb46f8,0x7ffed2eb4708,0x7ffed2eb47181⤵PID:2768
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://i32he0w9dipn.ancillarycheese.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,15344717476277770006,18179590760288444184,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:4300
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,15344717476277770006,18179590760288444184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1080 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,15344717476277770006,18179590760288444184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:82⤵PID:1504
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15344717476277770006,18179590760288444184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:12⤵PID:5076
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15344717476277770006,18179590760288444184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:12⤵PID:3852
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,15344717476277770006,18179590760288444184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:82⤵PID:1576
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,15344717476277770006,18179590760288444184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3680 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15344717476277770006,18179590760288444184,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:12⤵PID:3188
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15344717476277770006,18179590760288444184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3000 /prefetch:12⤵PID:4904
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15344717476277770006,18179590760288444184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:12⤵PID:4424
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15344717476277770006,18179590760288444184,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:12⤵PID:1976
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:456
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4392
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD54d6e17218d9a99976d1a14c6f6944c96
SHA19e54a19d6c61d99ac8759c5f07b2f0d5faab447f
SHA25632e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93
SHA5123fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5fe46c9cc565d5ce88245fda0d34c854d
SHA11a8ae51950f9d5bbab85aa58b8bb2ff4e23060c9
SHA25604f32881312d28ec08a4f7cfe4863e7ed361dc8800e383a69bf50ae81eed3233
SHA512eaa79eb607affdad09bac25e9253f4a8ff03960f605082b1fa8f48913b03d589c21bb69347ee651ba8024130732f688aeeeb208a0f8a4e4806ffd9d5067d6853
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5e374c92e24c88325b48c3871f8e2787d
SHA1ac9a9fd0aeead59e2048c6cfd7f7509d2695c27b
SHA256a885ddcd7f0a312e6ef252a56b6b03cb155ecc24eb3bf5f773627eefeec0cb72
SHA51294173343b4a98fc2b00ee6a8f4a157a85f30c3be78d7bba482d30b3c05f859fa9cbaf906abff9ef06752afa2ee0854d7e82a4ab2449377a2a9a0e7f26e6aff83
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD56a75eb5cf33e8950b2fdf5de91adadb7
SHA18f233292de99763e1d737d43ab67971fbbbeefaf
SHA256f66982ea1b220ab63311e2299f80306e8eae3edf71798f9e58728c5c9af2e7cf
SHA51223430092aa8a9c53bb740b7f4003dd7bf80b94fbb1d9693f4e4f9042e87e89b398a66eec0c88aae7a9737870e86e3a487271fc6ab41c738801e3273dd0be5053
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD5c2ef1d773c3f6f230cedf469f7e34059
SHA1e410764405adcfead3338c8d0b29371fd1a3f292
SHA256185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521
SHA5122ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
371B
MD56e7abbb1a7af31ad4ba8fb50dd351c6d
SHA13c1dc6b641f9d9307f88bee91d88460229722122
SHA25633e5061ccee1a9807639bf1e9b5b2f8a356e2e3eca77ef6cb409790ef28811e7
SHA512a8d1c7e5043a8777c2216d0982269d2fa36e111ef28db14971ce1dcd833a13100af0f01b2e0d58d2df175009d4786f77d8601ea201d37dd875c3d7222a0e68fc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579961.TMPFilesize
371B
MD5f4243e5043c876878bc4025d45bade9e
SHA12e3f08adf0ecfbffabf7962411d2fcfeeab728fc
SHA25606955fd98edb5e7b462c9d77a171cd41f8e630a769e8105639eec78e652c4559
SHA512cebc23b33ef0a599ae5ef64b03fbc4dd212cbbe2d2e79f34b95479d2c3d48d9fd6d6c5286039ff5461324f25303b6a195fb1d58d024c85aa00e12a16a3e10ccf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD5a2c6a0b4ae3feda3791a1472c9029dbe
SHA1d98c25bd5152451e6d51a145a2c620207058ca9c
SHA256171ecf03ff8c8a996fa6aa137eb87942ea06e2bed3843f08c9e218cf103eb35e
SHA512080a04f3fefe4f549a701133bb891418167f015576eb8c67d9007aa6efa17dd68339be69fb85334d1123b8cb72317bcc1e41c939673f055d7d85e8d0b247d220
-
\??\pipe\LOCAL\crashpad_1476_FHHVALLLIGTOFMPNMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e