ea8e830aee3ca762fa8d37597994acf261430d0ec3f393b1861e6e9d7ac3c552

Analysis

max time kernel
164s
max time network
217s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
21/02/2024, 21:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

4.9MB
MD5

8ac6bfdf42c0699b2ce9b3aadfc5a233
SHA1

dd09db85821db4827d1a491993cb0311855d5d86
SHA256

a6692be8af33d0673504a5d2bd519f4738aa872595eccc0434f5921185c0d56d
SHA512

3868911062f5e19e570538c0104e54ce2bdce9b06185baa3ca5657724be1def9e56fecfe1e532fd504117cc1c8636b8058c0a5fa5d5c60c3d253e5d57cbfe08f
SSDEEP

24576:bTUTBOmnLiLQrz62BrErzKm8bkUVQYwM/Q1OuS:/GOmLAOfNC+1C1M

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3416	msedge.exe
3416	msedge.exe
2056	msedge.exe
2056	msedge.exe
1316	identity_helper.exe
1316	identity_helper.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 3452	2056	msedge.exe	86
PID 2056 wrote to memory of 3452	2056	msedge.exe	86
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 888	2056	msedge.exe	88
PID 2056 wrote to memory of 3416	2056	msedge.exe	87
PID 2056 wrote to memory of 3416	2056	msedge.exe	87
PID 2056 wrote to memory of 3412	2056	msedge.exe	89
PID 2056 wrote to memory of 3412	2056	msedge.exe	89
PID 2056 wrote to memory of 3412	2056	msedge.exe	89
PID 2056 wrote to memory of 3412	2056	msedge.exe	89
PID 2056 wrote to memory of 3412	2056	msedge.exe	89
PID 2056 wrote to memory of 3412	2056	msedge.exe	89
PID 2056 wrote to memory of 3412	2056	msedge.exe	89
PID 2056 wrote to memory of 3412	2056	msedge.exe	89
PID 2056 wrote to memory of 3412	2056	msedge.exe	89
PID 2056 wrote to memory of 3412	2056	msedge.exe	89
PID 2056 wrote to memory of 3412	2056	msedge.exe	89
PID 2056 wrote to memory of 3412	2056	msedge.exe	89
PID 2056 wrote to memory of 3412	2056	msedge.exe	89
PID 2056 wrote to memory of 3412	2056	msedge.exe	89
PID 2056 wrote to memory of 3412	2056	msedge.exe	89
PID 2056 wrote to memory of 3412	2056	msedge.exe	89
PID 2056 wrote to memory of 3412	2056	msedge.exe	89
PID 2056 wrote to memory of 3412	2056	msedge.exe	89
PID 2056 wrote to memory of 3412	2056	msedge.exe	89
PID 2056 wrote to memory of 3412	2056	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbc77646f8,0x7ffbc7764708,0x7ffbc7764718
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,13188161109161675693,5492121407135199215,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,13188161109161675693,5492121407135199215,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,13188161109161675693,5492121407135199215,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13188161109161675693,5492121407135199215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13188161109161675693,5492121407135199215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,13188161109161675693,5492121407135199215,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,13188161109161675693,5492121407135199215,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13188161109161675693,5492121407135199215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13188161109161675693,5492121407135199215,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13188161109161675693,5492121407135199215,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13188161109161675693,5492121407135199215,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,13188161109161675693,5492121407135199215,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4756 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f4db60c9bb06ea5452df26771fa873ac

SHA1
c118183a1315a285606f81da05fc19367a2cdfe1

SHA256
f168242e74bfde18bacb9e18945a39bb447188eba916c7adf0f342ed8d82281e

SHA512
180ed98f9d5a14a22687a099c4a0ba6b586610f7b8b4c8de89f3b91713b07a2ef3726fcd318cb4e270b1745213b898037d29cca4b490d0c91833b797d69ac406

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f5b0bf4edca2187f7715ddd49777a1b2

SHA1
eb78099013d0894a11c48d496f48973585f0c7c0

SHA256
562016f9159ef363fcbe62ed13ee26052b31d4f67dc5ea6d60864a7d5dfa50a1

SHA512
1039b98cffd32ca4c9e37486b96e01b167d76b19dd8440a21da4932d677c463f4c5ce2260239e8337f59bd61ff3111905e23ab71d3ca5b20e7d2935fea7952c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a80367d8c2457c325e23725e7218b278

SHA1
7ee00019a5872ff8a3ca2a1f8ff91b39adc85acb

SHA256
43ba0c560ea529cf225232c0d459a47ffe6ef8d92978822f3b0840fbbeba8286

SHA512
c35eecac759c12310202ab1eb1e41332906cd619b455579df93c82327ee7b1724d98327db31746d902036b19bc67736f02aafc7ff2cd3ca5b88ec0ab1dda3841

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3ea2c244892604337edb209ecfe45ff8

SHA1
2782f2784b452ffa3a9b2700413a8d44735f4e4f

SHA256
4d447d9d4103252df5be0a75d5873eed1c4c13df0c7f8faa79004846e77f4058

SHA512
5a2df1b0af3c2416aa09ab816be972f54852f4c3ff298c775eb15479665417789e2a8f4cacf86d217930ca615207d052e4e4782cd4ff8237b72b9d65cab0d255

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
83425c31c88688ece1e7a9a864340e3a

SHA1
3fc6fdae24022e4ad2ba00209cf9bc9e435e0373

SHA256
756f911e264e4e2da763ba86862dad0762e5d46c639c3fc8f8a9ca83cf4eec0a

SHA512
e89cdcf91517d465c36ea164be7f69703f73fe81ef0f81e5f06c84c99b3f689cf16b979fc1d328c96e5c52281f24984cc19cacc83146d24f1706277bf20b4108

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
199868c3770d42a87738827b95d8f079

SHA1
791191bbb753f6e912ec073813d5b0c37ae8bc3b

SHA256
63964c2ab6a54e7c5fc3402d19c9e7b7b569f52d4126efba5ecf3d65438ef607

SHA512
2046924fa37e481b43b5177144406e3385cd08d8a7d0911e42701fbbb048ab097f031abca71e6af40e91522884cf4616790d8c112dcfd417f4ad6bd128cf976f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b47c09d025cb252e3e27c14ea94e4320

SHA1
b9bd584d0295bb0ae55c78f108f2552a32deb0b8

SHA256
6728999f8ed7744fefd568d5f8f6ddc512e97a404e0317e1ad691923dc3ac629

SHA512
e05d715b23c24a02c362f63ba25caffbb0b50965059e4136c37d03fbb2409e94599474c7327ab10127a3c5c1c761a454e93bdbeb37c4bb8f0802be584e037732

Download Submit