461a433676e1cf327192d9f3b69c7d0a5f688b42359f81339f5a61bed9e5fbcf

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240220-en
resource tags

arch:x64arch:x86image:win10v2004-20240220-enlocale:en-usos:windows10-2004-x64system
submitted
21/02/2024, 08:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Global Protect Desktop/jre/Welcome.html
Size

1KB
MD5

a0154e8b351df4372081d55752da1c61
SHA1

1c3dc9c2e45a2ff9c0c66db0f0212fae0cd8b0ab
SHA256

285517a831a095139ab3bb5b323c9f7cd989d7edb71e73c2b359fd01fee7f077
SHA512

f1608cd05039ba8264da965eff1ccfd77523f253acb25a529f110ba4d788bc64793f75a672cf11c5eb2e0ab23d95a7f91abcdeb1f5b5f709142b4e9d13b84178

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2764	msedge.exe
2764	msedge.exe
2492	msedge.exe
2492	msedge.exe
3008	identity_helper.exe
3008	identity_helper.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 4520	2492	msedge.exe	87
PID 2492 wrote to memory of 4520	2492	msedge.exe	87
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2292	2492	msedge.exe	89
PID 2492 wrote to memory of 2764	2492	msedge.exe	90
PID 2492 wrote to memory of 2764	2492	msedge.exe	90
PID 2492 wrote to memory of 1424	2492	msedge.exe	91
PID 2492 wrote to memory of 1424	2492	msedge.exe	91
PID 2492 wrote to memory of 1424	2492	msedge.exe	91
PID 2492 wrote to memory of 1424	2492	msedge.exe	91
PID 2492 wrote to memory of 1424	2492	msedge.exe	91
PID 2492 wrote to memory of 1424	2492	msedge.exe	91
PID 2492 wrote to memory of 1424	2492	msedge.exe	91
PID 2492 wrote to memory of 1424	2492	msedge.exe	91
PID 2492 wrote to memory of 1424	2492	msedge.exe	91
PID 2492 wrote to memory of 1424	2492	msedge.exe	91
PID 2492 wrote to memory of 1424	2492	msedge.exe	91
PID 2492 wrote to memory of 1424	2492	msedge.exe	91
PID 2492 wrote to memory of 1424	2492	msedge.exe	91
PID 2492 wrote to memory of 1424	2492	msedge.exe	91
PID 2492 wrote to memory of 1424	2492	msedge.exe	91
PID 2492 wrote to memory of 1424	2492	msedge.exe	91
PID 2492 wrote to memory of 1424	2492	msedge.exe	91
PID 2492 wrote to memory of 1424	2492	msedge.exe	91
PID 2492 wrote to memory of 1424	2492	msedge.exe	91
PID 2492 wrote to memory of 1424	2492	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Global Protect Desktop\jre\Welcome.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef80c46f8,0x7ffef80c4708,0x7ffef80c4718
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,3293594774952847377,1657186076607746224,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,3293594774952847377,1657186076607746224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,3293594774952847377,1657186076607746224,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3293594774952847377,1657186076607746224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3293594774952847377,1657186076607746224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,3293594774952847377,1657186076607746224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,3293594774952847377,1657186076607746224,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3293594774952847377,1657186076607746224,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3293594774952847377,1657186076607746224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3293594774952847377,1657186076607746224,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3293594774952847377,1657186076607746224,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,3293594774952847377,1657186076607746224,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3308 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b1f40e0d6ceaf161dfc1dfdddcfc44af

SHA1
b6557a6331b4c54efb30597ad4da0be03013a23e

SHA256
065557e5cddcc8022528dc82c5fd618ca28c153d6e34978d2ba84d33227eed48

SHA512
0d7fd3eabf2d2b426c627531b29e433cab175232c169a77623213b7b9935458b3067a2860137b030235526e49ca4df6867534135cf9da60697d6fa43441e7818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
18bc1d880e1a43364e572a20540c025b

SHA1
93b7043da91e7697d7268a52ca9a434a55ddbb75

SHA256
11fcaea6cf095ba038a344829e699198e7c981149f15e30a51229b8dbca6937f

SHA512
3e8ca38dbd4d9aa865fdfa359033fb47f581b93842f1ccb667f243cc630bfabf8390cbf8ed1de6110b18819f0d831312304806667bc68fdd13ea1bb09b44742e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fd6c063ad3bdf19792f047c375cc5b85

SHA1
54d732211242566cf570f3a87730bf2807c8ea01

SHA256
db84dee6beb1aeb5bf0b826240ffeff277826bf8c5385767dfa27aa63cd3ed6a

SHA512
2ba9e7b2c8ba49c6e9e68f4dc05b95fd8f1f2d9f02394837f3e65531b1758437179742d22318b02a14c6fd5602a4cb162fb3b068b300b7d198703a75c8665e57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
61288f8010a2ea0fe8816d4518af556e

SHA1
41ec829c82e11bc478fd2f05ef1196ddc8688ae0

SHA256
1f008c25e36e923ae9efa0822d9e6cd6af767deb84296055f590b9b811118745

SHA512
30b79b198a2cc354011f1f0f99b1f3204d7bbd3761b9cd47c8344eec7752269d1bdbedca32596553720c78a3809094ec7db932d64071bcee9218d4632eb73048

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
14f5c1fe8714f80e813c6bae1e5f55a2

SHA1
7fd52e5ee6264758ae56163d4a6e80cfe9cbeb2b

SHA256
c0b2f1ec21a64b51764315630514720aefcca9fbdcafd0eec095d78cfd73400c

SHA512
42dda486e32c5aef3d92f34598cb45e8c94a5b9a6ba08d41e19cdbd95c3f0214d4675166c19c4af0d81cd05a8998b8594d2b2546307a0a39e4eec35b6e14ccda

Download Submit