Analysis
-
max time kernel
33s -
max time network
34s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19-02-2024 12:15
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exepid process 4048 msedge.exe 4048 msedge.exe 4388 msedge.exe 4388 msedge.exe 3800 identity_helper.exe 3800 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
Processes:
msedge.exepid process 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe 4388 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4388 wrote to memory of 1972 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 1972 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4064 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4048 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 4048 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 5068 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 5068 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 5068 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 5068 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 5068 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 5068 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 5068 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 5068 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 5068 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 5068 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 5068 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 5068 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 5068 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 5068 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 5068 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 5068 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 5068 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 5068 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 5068 4388 msedge.exe msedge.exe PID 4388 wrote to memory of 5068 4388 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://psbh-yn.com/1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff930e946f8,0x7ff930e94708,0x7ff930e947182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,10798284539004584328,13023661341123164322,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,10798284539004584328,13023661341123164322,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,10798284539004584328,13023661341123164322,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,10798284539004584328,13023661341123164322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,10798284539004584328,13023661341123164322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,10798284539004584328,13023661341123164322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,10798284539004584328,13023661341123164322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,10798284539004584328,13023661341123164322,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,10798284539004584328,13023661341123164322,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,10798284539004584328,13023661341123164322,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,10798284539004584328,13023661341123164322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,10798284539004584328,13023661341123164322,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,10798284539004584328,13023661341123164322,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:12⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5f246cc2c0e84109806d24fcf52bd0672
SHA18725d2b2477efe4f66c60e0f2028bf79d8b88e4e
SHA2560c1014ae07c2077dd55d7386cc9cf9e0551be1d67fe05a6006957427ae09fec5
SHA512dcf31357eb39a05213550a879941e2c039ec0ba41e4867d5d630807420f070289552d56d9f16c6d11edcdb0f9448bf51e7d2e460e88aa9c55a5bfe5d8d331640
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
192B
MD58ca10fcfb6c63ea521c879b9910b5147
SHA1cec2b95b744811b064323aee55dc67456785da66
SHA256d2a4a8ca307b6f74beed24ff78eb7d5a547700f060cc1657a2e46b84f2c5f4f5
SHA512a0cff0fc402ca7ad3d923dbf1f04724d9c63cf47132ef886520b2d8f3a1e64e804f899314ae02ccb24f5b1c87841b280b8ed567d34628b839a402d66a82adb8f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD517dbb6187fb3e20d413cc6e40a8ebd8b
SHA13408fffdc2decb2fd1f0cbd7e9bf5d338ced2349
SHA25664740f411566b56ac37447d9921c97f980d4e75de9c71dcd7a24583dc0103983
SHA512d6f7b649b4f1a46edc33a111618c30d069014570fbefacef17a69b019486fc246c600f39182df6757c3cae5790ef4d5bee3f9eaab85a3fe07269088b120d5a41
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5db61513678a8aec3fdd2e9de5c5a36d3
SHA184d93187b637c5ed25e2be8e631cf69ec620c69f
SHA2569a2e0f11ad04a5cf29fcaec6e056c691266dfc888f3016b0cae2bfbc8b7517b5
SHA512096d30cde4b98e4ac08fe027fd7e411da63de33182f6dabbba268dcbd9d422ad542b42e58e4c62abbea0d507633e235084da2756c45bb6ebb95b61546092f6d9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD593c191184b98642de2555946fb2bcfff
SHA16c471cfac2fd810546a0f39a0b64bf9c740870c6
SHA2560308222851ab6a59d0d213e35869231f373de7f0729ed7bba092b3aff4f89a8b
SHA5127ab653291626bc2ce09bf9e35b1234f9762a46a1552c9d0c2b0c10b5ec05b1445e871637664b99a72f09d0d916f24affa71db79383bacfe78d42a613d05b9220
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD55e62a6848f50c5ca5f19380c1ea38156
SHA11f5e7db8c292a93ae4a94a912dd93fe899f1ea6a
SHA25623b683118f90c909ce86f9be9123ff6ac1355adb098ffbb09b9e5ec18fc2b488
SHA512ce00590890ed908c18c3ec56df5f79c6c800e3bea2ad4629b9788b19bd1d9e94215fb991275e6ec5a58ac31b193e1c0b9cbaa52ff534319a5e76ec4fc8d3ba54
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD5a024bfb2d51b3b81007d3ba08bde8e11
SHA120145ad179a7aece787ef3370480a93c4f5bce93
SHA256e2d8125a423dab15c38ba50cec06502b3c8721922168f4391a390171c38b1d41
SHA512fe2ac33120754c1b8d6d8107bd8bc2ffb921fbddd517f24e3428fa12f70f1abb32b69d0f2b269b96c8cd63b3f162dcff9474fb3d885a6c18388fb410fe33a523
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a95f.TMPFilesize
871B
MD5ff5bfc4e752c48a54fcaad8e6eaf3b2e
SHA15dd0b199de8ca5b44a724743b9ece54b9c02bfac
SHA256b1910b26b1d04244e5fdef2692790e55b2562f1ee0958c53978b71acf95166a0
SHA51230790155c85d8e5fe7d991b3d80d4d873760ada1a140cda2872d4a99c96c667e3e6ac70f233e81774be64a78bed31310651f84920f9992a72ab281e51b04bf9c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD539ec0f534af8af3f624f8c1daac08446
SHA16d603e1f366474e0f72834e932d9e5fdf2553b23
SHA2568dc754414b2f84baa9e4c212ecb245c8f6b111dbe18c05e1d140d2227c7debe3
SHA512ad534b444001b3af069f770a3d650fbf35a6b596f1e28e9b3c95de2bc4603bb252cc69d7fcf09fece81e3c187b78d35ec9e873c6fd4bad08814e5d4b8fa1e861