e21d58bd08e5380dbac2aa665c0371f126dab74a4420cc949fa1c1a16e860c92

Analysis

max time kernel
147s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
22/02/2024, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
doc/weka/associations/Associator.html
Size 8KB
Sample240222-stwlqsbf2y
SHA256 2cea1cc21a240a9cebf4fc3b567ca532fe3164532e936216c70f7da5060fe87d
MD5 f14a6f3783d2fd14cd7ed934b31988e6
SHA1 2f7e21d7132b48a02739c4d26ce3aee8196c9146
SHA512 de1adad90d17cf88aa1889f92050c0b9332fc396bf5fa573fd904c16c900ac8e22a85307d27d5e0e87757150cd5e63ddf87b9b1ade7b4190a7e36603ee7df4a6
SSDEEP 192:pciYPYyqES23PdvRkxvMdVZ2Cq/RIFGwOBPziXLzeW:pciYPYyq23PdvWxvMd72Cq2Fx1X7
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4340	msedge.exe
4340	msedge.exe
2832	msedge.exe
2832	msedge.exe
3672	msedge.exe
3672	msedge.exe
1960	identity_helper.exe
1960	identity_helper.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 1416	2832	msedge.exe	78
PID 2832 wrote to memory of 1416	2832	msedge.exe	78
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4340	2832	msedge.exe	80
PID 2832 wrote to memory of 4340	2832	msedge.exe	80
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\doc\weka\associations\Associator.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff9dae3cb8,0x7fff9dae3cc8,0x7fff9dae3cd8
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,4127618173238739497,10587966678270233568,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1856 /prefetch:2
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,4127618173238739497,10587966678270233568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,4127618173238739497,10587966678270233568,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4127618173238739497,10587966678270233568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4127618173238739497,10587966678270233568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4127618173238739497,10587966678270233568,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4127618173238739497,10587966678270233568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4127618173238739497,10587966678270233568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4127618173238739497,10587966678270233568,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,4127618173238739497,10587966678270233568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,4127618173238739497,10587966678270233568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,4127618173238739497,10587966678270233568,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5144 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c3b287c29eaa57166b2ab1ba9bd0aaced13cc2f946a04b8d708ac429187fe944
MD5 5c48e8b68231fb5b2d7f1188b930bc0e
SHA1 1822aef5da8fdd47626fb91afcf79a2be175a325
SHA512 2bd09b83e44e0104fbe080a8573690217dc9fbf7fd59ff25a1a9e9ebd2d87ac533f9b99350773d081a7e748b39657115a13e94538b153bceb13ecdfc4672a0f8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 eadeadba37eed18e5acba408d7e076270b00403fed372b77164577232232428a
MD5 f2dc80f5403feb8461b7ffa09890d6a0
SHA1 d5b61e6d672e7e71571e0132e21cead181da8805
SHA512 5e2119529b99b76be105c43714e4b9977ee2147172c1c44e92bd9b41fa7a66f55d4073c864aac668a912aff2898bd216fb38f2fe34ef65de69ad12965218caf5
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 c9c5233f31e90d49b5c9674af164513ffe48dbdb350139a3224cd86fb719449e
MD5 2943ec1281d1f6b8b79c9a72f7f844a9
SHA1 a96a27eede4e18beed0993f98a4e01f814d13953
SHA512 701b80fa9f7815a9dc12aff117e0d4ce7a9587fe00c66de460e696dd697b292bf1a44737df1f04c105b2550e986a4b2db8947a88f327a91bf21564b2ce694001
SSDEEP 96:n6k3nrSxm/FQYmtofEkCwSv0MoiVmdHIkJRl0WQyV+VuziX3wI3:n6k3rPO6fEkCv0MAIijLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c05ad4d0d799586cb2ae65dd5ee4327f0aa9a21b6ca4e04ed3069aad5dbfab28
MD5 fea86bad24852031dd05ea01fbb602c7
SHA1 7b643249064611e6a3a8e1672b6155b109dabdda
SHA512 addaac8dfdcaf2766eace48ae12d37875eca09c2c1370374aa57f2ef296577d594b5022c4557f385c5dce84c870db530fd3c6c74935cbac868c106c70d64e29d
SSDEEP 96:n6k3jSxm/FnmtofEkSwSv0MoiVmdHIkJRl0YQyV+VpAiX3wI3:n6k3jP86fEkSv0MAIij1e93
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 0df82ab19152a2494a03fccedbe5540761d098154fbb96dbf2e79f1d27b64d9d
MD5 0a9d821c9b5700efa1bdc4e4c47fb6f9
SHA1 5a60096094705db2cd9b57d609cfb5f760cf8d06
SHA512 fccd1cf3b9699477869272982771de07f6a7866f70b4510d5a8c3e368bf9eebb13d8dfc9b27d3dbded7737764b10a3d4902e9f4cbd11e45b89d1d69f929a6b74
SSDEEP 192:yoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGHhe2RUKZR7zPZE7Eu/PgQyMc:G9iIxuERzA83h09RZxASGVr3jZE7ZPIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 40c9c56c4244e93ce8123fa8d16a09d0e9cf72495221af6a8f449abd2f8a476d
MD5 4b349828ed0d431d186d62ba9832962e
SHA1 546692319347d0c1968a6ab71a1f61e1d1108299
SHA512 a7e648282265018c6bf62be0187fa8d5afab571953971724285b361ab9cdca11a5db65672836a3ec84744980f4e729b595f60d8eaeb5bd000099621e633e9a61
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGHhe2RUKZR7zP2E7Eu/PgQyMc:M9iIxuERzA83h09RZxASGVr3j2E7ZPIr
MD5 SHA1 SHA512 SSDEEP

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download