hxxp://microsoft[.]com

Analysis

max time kernel
145s
max time network
142s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
19/02/2024, 14:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://microsoft.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2932	msedge.exe
2932	msedge.exe
2784	msedge.exe
2784	msedge.exe
2280	msedge.exe
2280	msedge.exe
4364	identity_helper.exe
4364	identity_helper.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2816	2784	msedge.exe	26
PID 2784 wrote to memory of 2816	2784	msedge.exe	26
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 948	2784	msedge.exe	79
PID 2784 wrote to memory of 2932	2784	msedge.exe	80
PID 2784 wrote to memory of 2932	2784	msedge.exe	80
PID 2784 wrote to memory of 4944	2784	msedge.exe	81
PID 2784 wrote to memory of 4944	2784	msedge.exe	81
PID 2784 wrote to memory of 4944	2784	msedge.exe	81
PID 2784 wrote to memory of 4944	2784	msedge.exe	81
PID 2784 wrote to memory of 4944	2784	msedge.exe	81
PID 2784 wrote to memory of 4944	2784	msedge.exe	81
PID 2784 wrote to memory of 4944	2784	msedge.exe	81
PID 2784 wrote to memory of 4944	2784	msedge.exe	81
PID 2784 wrote to memory of 4944	2784	msedge.exe	81
PID 2784 wrote to memory of 4944	2784	msedge.exe	81
PID 2784 wrote to memory of 4944	2784	msedge.exe	81
PID 2784 wrote to memory of 4944	2784	msedge.exe	81
PID 2784 wrote to memory of 4944	2784	msedge.exe	81
PID 2784 wrote to memory of 4944	2784	msedge.exe	81
PID 2784 wrote to memory of 4944	2784	msedge.exe	81
PID 2784 wrote to memory of 4944	2784	msedge.exe	81
PID 2784 wrote to memory of 4944	2784	msedge.exe	81
PID 2784 wrote to memory of 4944	2784	msedge.exe	81
PID 2784 wrote to memory of 4944	2784	msedge.exe	81
PID 2784 wrote to memory of 4944	2784	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://microsoft.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8fc1f3cb8,0x7ff8fc1f3cc8,0x7ff8fc1f3cd8
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,17742705486019401162,8617358037800215071,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,17742705486019401162,8617358037800215071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,17742705486019401162,8617358037800215071,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,17742705486019401162,8617358037800215071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,17742705486019401162,8617358037800215071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,17742705486019401162,8617358037800215071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,17742705486019401162,8617358037800215071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,17742705486019401162,8617358037800215071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,17742705486019401162,8617358037800215071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,17742705486019401162,8617358037800215071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,17742705486019401162,8617358037800215071,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,17742705486019401162,8617358037800215071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:1
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,17742705486019401162,8617358037800215071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,17742705486019401162,8617358037800215071,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,17742705486019401162,8617358037800215071,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7d4bdd41d7150644a9fecac756bd5298

SHA1
cc6bd77ecef146f18a526ab6a1167649b2bf526d

SHA256
ae1f95fd0cac26454941f0578d73b695849ce52ab2ef95eccbb63853cf9103ce

SHA512
ba873b94e850c6fa0de096961380265ec833778854612e938ace2c4c1772423793d0d22a585533180328478cc23aef6971be56eee2256405636f80076ed2c796

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
552B

MD5
d1689861af0a7585aa7bca7d7f746799

SHA1
5542657f28e3d3bf1dde593c2946032c739f4dae

SHA256
13b8f322ae462f5d036737f6a4556ba4fb463cbe3fcbc9edce46c1f6758cc6d9

SHA512
648f6db2cdbb8dd2c786d1d4a05e0eea2ebc9878ff61bbae782eb9b4659776b89a706b94a5fd507619628af219069523b98a39ddf8e0b7101cde2ba087b56178

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2254841ac185d4e9fbbdb164f9adb818

SHA1
38649eec9c41857b506c7b14a2d431beb063fc3c

SHA256
ea2246717902e6384266f5fa7809d81da96196e10d5ef8a5687585ffa90521d5

SHA512
5e9ed9826df52c18a7be93895b5f3adf6bd3185edd15ab0fabbef18b89875e64ac6188dd5e89d0d9fc975db51883de0b695fda7d6427ea4ea32af1e9022ad22b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6daed9e5c153be780e7eed464211e4d3

SHA1
008162fae0ea0d5d9227f4d5cffc4007bacdd718

SHA256
6552c20d5db60f7f82e61b38dffaa3e85ce5b1055cfd7231779133cbb996502f

SHA512
3fe7a55896b42016d23a11033683bb4a8abca9653f8ecce03724daca07e9bbc43adebc1f26cd2fd3fbc0346be913d7ad48a3d0f263964379469300b06cba8ae5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a340c6b331a2cd9843dc0b2df2fff490

SHA1
269b9a04d13d187da9830cf6f2176cf27865c0b8

SHA256
b2512cc675319f2b329fb9a2c03fe3dd8c1bbc2be392c265c2fe2d03286c02f1

SHA512
169044eb866835e68b1437eddb1608cdd0e5e6aebb61783ec657b2a54a6fdc13b25e759bad6b963d0a16487c0d635e170500f886edf3e2b162eb060c834aa1db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
00042df6368289238bc60caef1baa46d

SHA1
981c49ac7b10bd2a9d159daf00844110629837a9

SHA256
3ca68414527ece019ac110954726207b8a46bebe6180c2615158f7aebf6e6b1b

SHA512
8f549ecc6a1ac0cc153fe39759b8fe093af520dd94e37b8c32e7fc7e87263cc5b2bf404bff31a5960ad9fcf82dabb5a534fa07cc441ce646de2a8b532c28ff51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
b33a1287edc78c54e61307458281d23c

SHA1
da6d49d82e327cf7f6dbb87fc6a9ad5b26c80467

SHA256
ee81dbad6be88d18f9a95ab0cc3d6d1b91a648a9cec06d12de397c31d73ad2cb

SHA512
d7f1999662efab1c36c04afd6dbfe6b7181fa3ba2226588d8bbd48196c85c735686bb7c2b06a2b6771e48c1cf9375358aca919b3da53a382d0fe7f5c03a82f28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
df3662374d67a469931014caeb966515

SHA1
151282315fd6769433bf4a4a84e6305ab79d7b7e

SHA256
c3564c4aef369ce40347bf6a07f5c2aa87c91e3231ded00dc073bfbd3bf0f87d

SHA512
64a894b1ebc89ce94d353cf2c1ed95df93ebb521ea48935939eeca21e962139a9099af281a5b16b91a6106cf09c20508835c776e14f06cdea9de52cd8339ab00

Download Submit