e21d58bd08e5380dbac2aa665c0371f126dab74a4420cc949fa1c1a16e860c92

Analysis

max time kernel
145s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
22/02/2024, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
doc/weka/Run.SchemeType.html
Size 21KB
Sample240222-stwlqsbf2y
SHA256 ae07f6850d306a8c8a85e777ab79daa4c1da4c702db548bcb0930a19ec90c8c1
MD5 14932852c0f0c4143b7ae9d5af39c3e6
SHA1 0ad28574156c29ea4c017bd4610d577706e9c252
SHA512 d78abbdece500aab63812f3a5257779e368688974d7e77e801ed67f90f22a83e3fcf1c14cdf2ba84d6a79cc396f10ec9f66e9969f7d84d206a5edf868f4f3569
SSDEEP 384:DwitPtyqB3PIkWxvId6c/TWMWk+XX+IdlDO9J5bBTXAqYsB6v4I:DwitPtPP+hMWkjIzTf
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3316	msedge.exe
3316	msedge.exe
4620	msedge.exe
4620	msedge.exe
4868	msedge.exe
4868	msedge.exe
1088	identity_helper.exe
1088	identity_helper.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 488	4620	msedge.exe	79
PID 4620 wrote to memory of 488	4620	msedge.exe	79
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 828	4620	msedge.exe	80
PID 4620 wrote to memory of 3316	4620	msedge.exe	81
PID 4620 wrote to memory of 3316	4620	msedge.exe	81
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82
PID 4620 wrote to memory of 3672	4620	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\doc\weka\Run.SchemeType.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb363c3cb8,0x7ffb363c3cc8,0x7ffb363c3cd8
  2⤵
  PID:488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,7491591735932179424,3150747915613897791,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,7491591735932179424,3150747915613897791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,7491591735932179424,3150747915613897791,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7491591735932179424,3150747915613897791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7491591735932179424,3150747915613897791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,7491591735932179424,3150747915613897791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,7491591735932179424,3150747915613897791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7491591735932179424,3150747915613897791,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7491591735932179424,3150747915613897791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7491591735932179424,3150747915613897791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,7491591735932179424,3150747915613897791,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,7491591735932179424,3150747915613897791,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5280 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 fa31bc49a2f9af06d325871104e36dd69bfe3847cd521059b62461a92912331a
MD5 d459a8c16562fb3f4b1d7cadaca620aa
SHA1 7810bf83e8c362e0c69298e8c16964ed48a90d3a
SHA512 35cb00c21908e1332c3439af1ec9867c81befcc4792248ee392080b455b1f5ce2b0c0c2415e344d91537469b5eb72f330b79feb7e8a86eeb6cf41ec5be5dfd2f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 770ed0fcd22783f60407cdc55b5998b08e37b3e06efb3d1168ffed8768751fab
MD5 656bb397c72d15efa159441f116440a6
SHA1 5b57747d6fdd99160af6d3e580114dbbd351921f
SHA512 5923db1d102f99d0b29d60916b183b92e6be12cc55733998d3da36d796d6158c76e385cef320ec0e9afa242a42bfb596f7233b60b548f719f7d41cb8f404e73c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e04dcf37e5e629e2887be206a25bb1ebf0880b180d087eafa5edfff273cbba7b
MD5 58c961a8ed6c6c5e22e32c905e6ddcd5
SHA1 97e7a3b2c53328a626b755c8bfa05ccbd6db8c3a
SHA512 0c598e69d8bc3e7d134d67c77e23a728c7de1178962d62ef17d5a4300101b9a994a6fcf28963eefa09363529df8676fc035119ba19b0472365ccbe1160956463
SSDEEP 96:neEk3DSxm/FQYmt2Mqk7fwSv0MoiVmdHIcJSvK0WQyV+VpziX3wI3:ntk3DPO43kDv0MAIKSCLx93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8413e105daea4c08ed935919d9a4a1343343b72b9c2a85bffe9a0cf3a2d097ce
MD5 990e46794e934c59000a3441d7f63a61
SHA1 3974f9c2ee59c7782aca642bfdb97bea3c7d68ab
SHA512 99128919e3f3463bab6d05e6c8d8f136f857982818dd75436e06d7667ed69f7904ca9be00c5cfef649248ae5b99aeae39206a8d063e4a5ef9a9ef7c3cffd2a52
SSDEEP 96:neEk3DSxm/Fnmt2Mqk7VwSv0MoiVmdHIcJSvK0YQyV+VpAiX3wI3:ntk3DP843kxv0MAIKSC1e93
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 2393d0afc6ad83add89a57d8380f925df2f2a787bd22464a428f88abdb4c1952
MD5 c614322fec5074779816464b1f81022b
SHA1 4b1438fefe289c7504ea521d64c367321d34c92e
SHA512 422f4e540f1970431ca36fb4d525eed91641e1ed0189f4e87d5edb1bc944487b8d980f8891c44527b62c26be5c7a6a53da932feaea31b60f8d5d86e08504c826
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGCTzY9We2RUipbRO2qPOE7EuZ:M9iIxuERzA83h09RZxASGnarIOE7ZPIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download