e21d58bd08e5380dbac2aa665c0371f126dab74a4420cc949fa1c1a16e860c92

Analysis

max time kernel
145s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
22/02/2024, 15:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

doc/weka/Run.SchemeType.html
Size

21KB
MD5

14932852c0f0c4143b7ae9d5af39c3e6
SHA1

0ad28574156c29ea4c017bd4610d577706e9c252
SHA256

ae07f6850d306a8c8a85e777ab79daa4c1da4c702db548bcb0930a19ec90c8c1
SHA512

d78abbdece500aab63812f3a5257779e368688974d7e77e801ed67f90f22a83e3fcf1c14cdf2ba84d6a79cc396f10ec9f66e9969f7d84d206a5edf868f4f3569
SSDEEP

384:DwitPtyqB3PIkWxvId6c/TWMWk+XX+IdlDO9J5bBTXAqYsB6v4I:DwitPtPP+hMWkjIzTf

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3316	msedge.exe
3316	msedge.exe
4620	msedge.exe
4620	msedge.exe
4868	msedge.exe
4868	msedge.exe
1088	identity_helper.exe
1088	identity_helper.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 488	4620	msedge.exe	79
PID 4620 wrote to memory of 488	4620	msedge.exe	79
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 3316	4620	msedge.exe	81
PID 4620 wrote to memory of 3316	4620	msedge.exe	81
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\doc\weka\Run.SchemeType.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb363c3cb8,0x7ffb363c3cc8,0x7ffb363c3cd8
  2⤵
  PID:488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,7491591735932179424,3150747915613897791,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,7491591735932179424,3150747915613897791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,7491591735932179424,3150747915613897791,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7491591735932179424,3150747915613897791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7491591735932179424,3150747915613897791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,7491591735932179424,3150747915613897791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,7491591735932179424,3150747915613897791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7491591735932179424,3150747915613897791,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7491591735932179424,3150747915613897791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7491591735932179424,3150747915613897791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7491591735932179424,3150747915613897791,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,7491591735932179424,3150747915613897791,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5280 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d459a8c16562fb3f4b1d7cadaca620aa

SHA1
7810bf83e8c362e0c69298e8c16964ed48a90d3a

SHA256
fa31bc49a2f9af06d325871104e36dd69bfe3847cd521059b62461a92912331a

SHA512
35cb00c21908e1332c3439af1ec9867c81befcc4792248ee392080b455b1f5ce2b0c0c2415e344d91537469b5eb72f330b79feb7e8a86eeb6cf41ec5be5dfd2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
656bb397c72d15efa159441f116440a6

SHA1
5b57747d6fdd99160af6d3e580114dbbd351921f

SHA256
770ed0fcd22783f60407cdc55b5998b08e37b3e06efb3d1168ffed8768751fab

SHA512
5923db1d102f99d0b29d60916b183b92e6be12cc55733998d3da36d796d6158c76e385cef320ec0e9afa242a42bfb596f7233b60b548f719f7d41cb8f404e73c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
58c961a8ed6c6c5e22e32c905e6ddcd5

SHA1
97e7a3b2c53328a626b755c8bfa05ccbd6db8c3a

SHA256
e04dcf37e5e629e2887be206a25bb1ebf0880b180d087eafa5edfff273cbba7b

SHA512
0c598e69d8bc3e7d134d67c77e23a728c7de1178962d62ef17d5a4300101b9a994a6fcf28963eefa09363529df8676fc035119ba19b0472365ccbe1160956463

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
990e46794e934c59000a3441d7f63a61

SHA1
3974f9c2ee59c7782aca642bfdb97bea3c7d68ab

SHA256
8413e105daea4c08ed935919d9a4a1343343b72b9c2a85bffe9a0cf3a2d097ce

SHA512
99128919e3f3463bab6d05e6c8d8f136f857982818dd75436e06d7667ed69f7904ca9be00c5cfef649248ae5b99aeae39206a8d063e4a5ef9a9ef7c3cffd2a52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c614322fec5074779816464b1f81022b

SHA1
4b1438fefe289c7504ea521d64c367321d34c92e

SHA256
2393d0afc6ad83add89a57d8380f925df2f2a787bd22464a428f88abdb4c1952

SHA512
422f4e540f1970431ca36fb4d525eed91641e1ed0189f4e87d5edb1bc944487b8d980f8891c44527b62c26be5c7a6a53da932feaea31b60f8d5d86e08504c826

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit