hxxp://i | Triage

Analysis

max time kernel
146s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
19/02/2024, 11:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://i

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4520	msedge.exe
4520	msedge.exe
72	msedge.exe
72	msedge.exe
4760	identity_helper.exe
4760	identity_helper.exe
2120	msedge.exe
2120	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe
72	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 72 wrote to memory of 3100	72	msedge.exe	56
PID 72 wrote to memory of 3100	72	msedge.exe	56
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 328	72	msedge.exe	78
PID 72 wrote to memory of 4520	72	msedge.exe	79
PID 72 wrote to memory of 4520	72	msedge.exe	79
PID 72 wrote to memory of 2988	72	msedge.exe	80
PID 72 wrote to memory of 2988	72	msedge.exe	80
PID 72 wrote to memory of 2988	72	msedge.exe	80
PID 72 wrote to memory of 2988	72	msedge.exe	80
PID 72 wrote to memory of 2988	72	msedge.exe	80
PID 72 wrote to memory of 2988	72	msedge.exe	80
PID 72 wrote to memory of 2988	72	msedge.exe	80
PID 72 wrote to memory of 2988	72	msedge.exe	80
PID 72 wrote to memory of 2988	72	msedge.exe	80
PID 72 wrote to memory of 2988	72	msedge.exe	80
PID 72 wrote to memory of 2988	72	msedge.exe	80
PID 72 wrote to memory of 2988	72	msedge.exe	80
PID 72 wrote to memory of 2988	72	msedge.exe	80
PID 72 wrote to memory of 2988	72	msedge.exe	80
PID 72 wrote to memory of 2988	72	msedge.exe	80
PID 72 wrote to memory of 2988	72	msedge.exe	80
PID 72 wrote to memory of 2988	72	msedge.exe	80
PID 72 wrote to memory of 2988	72	msedge.exe	80
PID 72 wrote to memory of 2988	72	msedge.exe	80
PID 72 wrote to memory of 2988	72	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://i
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:72
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbc7003cb8,0x7ffbc7003cc8,0x7ffbc7003cd8
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,1144909462001018866,2981611068679121274,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1836 /prefetch:2
  2⤵
  PID:328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,1144909462001018866,2981611068679121274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,1144909462001018866,2981611068679121274,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1144909462001018866,2981611068679121274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1144909462001018866,2981611068679121274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1144909462001018866,2981611068679121274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1144909462001018866,2981611068679121274,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1144909462001018866,2981611068679121274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1144909462001018866,2981611068679121274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1144909462001018866,2981611068679121274,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,1144909462001018866,2981611068679121274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,1144909462001018866,2981611068679121274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1144909462001018866,2981611068679121274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1144909462001018866,2981611068679121274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1144909462001018866,2981611068679121274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,1144909462001018866,2981611068679121274,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4788 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a17cdb1d2f99f0e60f6799abdba3997a

SHA1
751e5502111c4060357d4b0b57b9d7eb547960a1

SHA256
6db0baff3080611c62322ccbbb900cfa200dcf53d81455d411724f21746def25

SHA512
66e12a82d4715e7fcbf9256fcd3b8782713f2d5447c849815e4f123e9a1fd2571d6a2d3fd7ceef0e3b0e06ae9d21ec2f7168de4d7866bfb76db45d8f555da940

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b0603c64bea8f691241ba7685d6199ad

SHA1
44260e5d147dfc573649d97b45336e6e6cfa827e

SHA256
dcda7f6d5a423b7434d25f57ea39ab1bcc8e0b57e623b3573b8a61044ca321d6

SHA512
b14abc16decc22686d98f1ba9a2a8136decd95239c71f71ce2b462df003841452a2bb971514fbc47bfca26d2ebff4859b693e8b10606bd3bc4ba6e719cd25429

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
76df9b19871b7731836c3b9345585662

SHA1
ea52fc25683f93d8dcc8f85550015f5f440c6f74

SHA256
c33b38609144554bfe90c92b8b764f2cf43f2bd5bc2a723e2cd780b38e785146

SHA512
4b01bbe843dbd76b6c0bdcfabfd2a6a857f902bf079f8939df6af556be1bade377eecb51856adfbbede6f9e7eee7745b2e90319324297edfc02b4bad982249ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
610c8dad800012d2adab618d9fb91766

SHA1
ddbf829b68599e1c2b28aca0ae01ffea2f19715f

SHA256
b6474c5cfaf600fecb86416980be66fbe37afecce2504789a2fa0ae6daadea0a

SHA512
1173d8784b53885c2b7e17a38cdfd0ed05a5f97beb9c13ec768c74715e733f011f50e108a7123a667cdbda487418863c2be24f2dc2caa104651da0db37074e2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4b18bd5f3c27f4ba54bbcf50063227cb

SHA1
0f0e73643afbf799a1e99d6117f3aeac7d6626ef

SHA256
ec9521d8cd6d19454b1b6deef78cb9907a39ff1f7cac018424ff0aa87b8352fc

SHA512
2a6d360d435b331442f236504a87fc20c0c8bb860f772279c058605198bd89fde4b2cf07c7f0910a57af4425ce1e9d9cb2101d2802d7888a1cb2592b376baea7

Download Submit