e21d58bd08e5380dbac2aa665c0371f126dab74a4420cc949fa1c1a16e860c92

Analysis

max time kernel
145s
max time network
135s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
22/02/2024, 15:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

doc/weka/Run.html
Size

16KB
MD5

173fcd8192e23169d12a507fd8d519eb
SHA1

d7da02dcace7e1bd467553afaf7413b4828a31c3
SHA256

b8d9ad28aef2487f5444c673e827c4e77db849726e451b48f0e4dec687813d66
SHA512

6ad082444473f494e1d9d4bf77fb1ad265b0f7749c0ca2e6562bc9727ba70531aee4204ce4a05363c022218d4f8129e5e58710071dae1a634fa8ddd79de74922
SSDEEP

384:QwitPtyqB3PFzWxvodf7Sk+XxLWUQiqXcpwm:QwitPtPP447SkTCJ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4020	msedge.exe
4020	msedge.exe
1372	identity_helper.exe
1372	identity_helper.exe
952	msedge.exe
952	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 1316	4020	msedge.exe	77
PID 4020 wrote to memory of 1316	4020	msedge.exe	77
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 3100	4020	msedge.exe	78
PID 4020 wrote to memory of 4356	4020	msedge.exe	79
PID 4020 wrote to memory of 4356	4020	msedge.exe	79
PID 4020 wrote to memory of 4624	4020	msedge.exe	80
PID 4020 wrote to memory of 4624	4020	msedge.exe	80
PID 4020 wrote to memory of 4624	4020	msedge.exe	80
PID 4020 wrote to memory of 4624	4020	msedge.exe	80
PID 4020 wrote to memory of 4624	4020	msedge.exe	80
PID 4020 wrote to memory of 4624	4020	msedge.exe	80
PID 4020 wrote to memory of 4624	4020	msedge.exe	80
PID 4020 wrote to memory of 4624	4020	msedge.exe	80
PID 4020 wrote to memory of 4624	4020	msedge.exe	80
PID 4020 wrote to memory of 4624	4020	msedge.exe	80
PID 4020 wrote to memory of 4624	4020	msedge.exe	80
PID 4020 wrote to memory of 4624	4020	msedge.exe	80
PID 4020 wrote to memory of 4624	4020	msedge.exe	80
PID 4020 wrote to memory of 4624	4020	msedge.exe	80
PID 4020 wrote to memory of 4624	4020	msedge.exe	80
PID 4020 wrote to memory of 4624	4020	msedge.exe	80
PID 4020 wrote to memory of 4624	4020	msedge.exe	80
PID 4020 wrote to memory of 4624	4020	msedge.exe	80
PID 4020 wrote to memory of 4624	4020	msedge.exe	80
PID 4020 wrote to memory of 4624	4020	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\doc\weka\Run.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffce2eb3cb8,0x7ffce2eb3cc8,0x7ffce2eb3cd8
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1732,16701901860008382878,55588564470456046,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1732,16701901860008382878,55588564470456046,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1732,16701901860008382878,55588564470456046,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1732,16701901860008382878,55588564470456046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1732,16701901860008382878,55588564470456046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1732,16701901860008382878,55588564470456046,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1732,16701901860008382878,55588564470456046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1732,16701901860008382878,55588564470456046,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1732,16701901860008382878,55588564470456046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1732,16701901860008382878,55588564470456046,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1732,16701901860008382878,55588564470456046,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1732,16701901860008382878,55588564470456046,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5212 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
96899614360333c9904499393c6e3d75

SHA1
bbfa17cf8df01c266323965735f00f0e9e04cd34

SHA256
486e4b4bb11f664c91c675e73cfeabe53b5009ae719459813be17814cd97e43c

SHA512
974735b40a9f92b40a37a698f7f333590f32ff45633c6e619500e74ec274bc20bf7dbc830b1685777b714d37a3ca103d741ee056f4ff45ef08c07b38a7895df7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
19a8bcb40a17253313345edd2a0da1e7

SHA1
86fac74b5bbc59e910248caebd1176a48a46d72e

SHA256
b8024fbed11683ef4b53f5afac0ff691025b7eecca0f6a95737da1585558227e

SHA512
9f8780f49d30aad01b28189804329aeca6ad2b7ffb6be505d40bb1af7802bb62622f518cb1c43a5815bbbb46638f6c52aead3d68f14fa957d18157edb42e95c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1abd8fe14446500b42c2862c0524e2ff

SHA1
a07ad6eea93c905b127636c825625b481a1a6b04

SHA256
a2024f439951360186e2de9b949fe690c504c9a0f728902eee7f9d060b23e0a7

SHA512
bc74fb8aae28b0479f58d6102225a004cd6baef74b4ea93512ec0097ad95607bafd2f0f84c063816aa7e9df0a238f28ef23bf582e20379ac28701188de420299

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5aa35b624a472d5e15a081efe795c6cb

SHA1
9f10d9e625d16b4470ac3f2e54895421e223dc1f

SHA256
9eefcb5a8b7d502381c6c07d6b1cbe5ae380df35f8a987cb0ff194fdec2ffc66

SHA512
c83a027080e086b9d9ded47ab25ca8f8720b6e17ec0de561a298fc2778490530df184a32382d3b3bddff1caed71a44289e7332166819963d919f7e23dc5a69cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b84b42a015ad26a5d21b00c22055ae0a

SHA1
51e8ae0d978c537a885f05c97f7157931d3dc130

SHA256
a9e0cc2d3cb1cbb049ea52bf8709b1cc53efed582be81f7c67f69dae9df921f1

SHA512
ce8fa824d274551e4666f5acaccaaf044e7c6636bff89f90e903e5398315da8a6d25e993659b605699d202b7869159fddfedb75073d1cea1263be655c4727cfb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit