Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system -
submitted
25-01-2024 16:57
Static task
static1
URLScan task
urlscan1
General
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exepid process 4544 msedge.exe 4544 msedge.exe 4892 msedge.exe 4892 msedge.exe 4756 msedge.exe 4756 msedge.exe 1676 identity_helper.exe 1676 identity_helper.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe 560 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
msedge.exepid process 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4892 wrote to memory of 412 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 412 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4576 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4544 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 4544 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2872 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2872 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2872 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2872 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2872 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2872 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2872 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2872 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2872 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2872 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2872 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2872 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2872 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2872 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2872 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2872 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2872 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2872 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2872 4892 msedge.exe msedge.exe PID 4892 wrote to memory of 2872 4892 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://coloradosupremecourt.us7.list-manage.com/track/click?u=9430f150c8155b9eb7231b49a&id=1ef0f6c1ef&e=93a2b9e8711⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff803ff3cb8,0x7ff803ff3cc8,0x7ff803ff3cd82⤵PID:412
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,15888036163970938545,12118178550858435629,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1892 /prefetch:22⤵PID:4576
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,15888036163970938545,12118178550858435629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4544 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,15888036163970938545,12118178550858435629,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:82⤵PID:2872
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,15888036163970938545,12118178550858435629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:2864
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,15888036163970938545,12118178550858435629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:3800
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,15888036163970938545,12118178550858435629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:12⤵PID:3120
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1884,15888036163970938545,12118178550858435629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4756 -
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,15888036163970938545,12118178550858435629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1676 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,15888036163970938545,12118178550858435629,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:2404
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,15888036163970938545,12118178550858435629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:12⤵PID:456
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,15888036163970938545,12118178550858435629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:12⤵PID:4148
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,15888036163970938545,12118178550858435629,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:12⤵PID:3916
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,15888036163970938545,12118178550858435629,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1692 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:560
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3728
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:132
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD55cabc17286e25c0ade7a7f050b6e92a6
SHA1c25ab09177ad0da9ee6caf78310236bdc2cba319
SHA2560e75f9140c154297d8f741aea07b90fc1be1b8deb79c3f204148471800e322b6
SHA5120cc35eda0168f51e5e719ba0bfb226c9f5293a6056d47190a23377deb98244f42c62b8416696cdd13b2db6228c1c8a2513cdf6dbb1d4b59f0c1c889d1acee6e8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
192B
MD5f5698456331a9df92d2787e3377b1b7c
SHA13ce78e8c365658f98054bb039115f35efd91253c
SHA256a15949de57b6145b69446b9b6b992cbebd29ad571f567437212ae5b30d4428ec
SHA51290d5d07d12010bae1e8a746dca7f852295044b353eb089c51f7acfc333976f8a6942553b9478bd8682b2c7945d5552c8dabd8af5867756717cf19c8e72ef7108
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
1KB
MD5d46ce183b85eebc7676c10ac62c57670
SHA1d9ff0bc979f54a3ba43e3deaca9e303bb47f39ad
SHA2560e38954be82786dc35c093d596683a947882b9a8232b65619263014eabfdd7cd
SHA5126ef11d200d806f26a9b0833e2df583e208153bfbc75dcd9a86edbb8e30c05dc95605333c4736bacbe573e4f9b79e069c3602575207cccb165629d5a5e3945c4b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
4KB
MD54f5f04432971d17d59dc38b8c919f3d9
SHA1e70610b5c0b78c4a4357fa97fe15cc3787bf3cc7
SHA256565f7f93c1cc95e5066ccae06954e728cb9ccf5e027737f2bf615dda2fa525c5
SHA51243083146462124ea7ea1bc64187b892937bdb7561c2289b28ecab2d2cfe6cbb13bf7c4e9c4533e49a49fdf41169f7f77d4829b32111763c6286227e366beb3eb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5c063a5e28de34eb0ed31257ec0e6c838
SHA11883120f25091016f30f07ce9ac9698e30134c0f
SHA256d07d6b755f52fa7caf7a8db2583b25c6337f31a4fccafca9393d18d0b07eee73
SHA5125e1f7cff70fe05ee9f38ffcebfe81e9d9ddf5cf94391ae9859947da7ad52b0a9c582a6510ad8d6fe6288865c5bf00ff08735f361719f04959eceb04de75fcdd8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
25KB
MD568fe6f34e7d6603a3d2f4c95919f8408
SHA1c7be30582f94d46f05338cc39726f72c9e2fa4cf
SHA2568cba909149b2d3fc45315cf63cdb8fbe42a4b7c614347171ba00aaf859639c1a
SHA51248eac2f55675b01ebeb28680ed9af6dcb9c558f76fd647cf05f8a7e1fa04ee57f7a8c70bc0ea882bdbca48b29d62ea7af74b76a03b09c19762e4c93118929be1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD5d8e6c2c2af4b357eddd76d21f9d20a4b
SHA103f60cffd59317fb5bff26d42f3fa83d4555ee89
SHA256cf09096072730294aaa462fdb3f8671265ad1254944245d0b9475366313271ee
SHA512acb50a72c77c45a08ede67255e11030fbb82f199f44a7cadf2d3255c04ab4b3ee3b4038c2143f3f1d991c6d4f7dd88c89cd4cf0525ecb7aca1bd5bb13abfb704
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD545450f0a27ec33ed9acdcd4e6768c5e9
SHA1247c7eca8e7bc4cba25221730bf4f58b3a554549
SHA256a05a8000df1fa670ac299cf7dea2a129d05e1ee842086cf1d416a2d1770276d1
SHA5127425eb8fabe765a99e58a60e3f6bdb8f8f127443c1b287aad3c66af493e555ba9877db3d8717d852e703c1243e74266cbfd922417d93ffd153bc36e8e607a75b
-
\??\pipe\LOCAL\crashpad_4892_FPGFIWDCLMFOSLMZMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e