e21d58bd08e5380dbac2aa665c0371f126dab74a4420cc949fa1c1a16e860c92

Analysis

max time kernel
147s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
22/02/2024, 15:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

doc/weka/associations/Associator.html
Size

8KB
MD5

f14a6f3783d2fd14cd7ed934b31988e6
SHA1

2f7e21d7132b48a02739c4d26ce3aee8196c9146
SHA256

2cea1cc21a240a9cebf4fc3b567ca532fe3164532e936216c70f7da5060fe87d
SHA512

de1adad90d17cf88aa1889f92050c0b9332fc396bf5fa573fd904c16c900ac8e22a85307d27d5e0e87757150cd5e63ddf87b9b1ade7b4190a7e36603ee7df4a6
SSDEEP

192:pciYPYyqES23PdvRkxvMdVZ2Cq/RIFGwOBPziXLzeW:pciYPYyq23PdvWxvMd72Cq2Fx1X7

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4340	msedge.exe
4340	msedge.exe
2832	msedge.exe
2832	msedge.exe
3672	msedge.exe
3672	msedge.exe
1960	identity_helper.exe
1960	identity_helper.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 1416	2832	msedge.exe	78
PID 2832 wrote to memory of 1416	2832	msedge.exe	78
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4460	2832	msedge.exe	79
PID 2832 wrote to memory of 4340	2832	msedge.exe	80
PID 2832 wrote to memory of 4340	2832	msedge.exe	80
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81
PID 2832 wrote to memory of 2572	2832	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\doc\weka\associations\Associator.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff9dae3cb8,0x7fff9dae3cc8,0x7fff9dae3cd8
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,4127618173238739497,10587966678270233568,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1856 /prefetch:2
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,4127618173238739497,10587966678270233568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,4127618173238739497,10587966678270233568,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4127618173238739497,10587966678270233568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4127618173238739497,10587966678270233568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4127618173238739497,10587966678270233568,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4127618173238739497,10587966678270233568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4127618173238739497,10587966678270233568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,4127618173238739497,10587966678270233568,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,4127618173238739497,10587966678270233568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,4127618173238739497,10587966678270233568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,4127618173238739497,10587966678270233568,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5144 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c48e8b68231fb5b2d7f1188b930bc0e

SHA1
1822aef5da8fdd47626fb91afcf79a2be175a325

SHA256
c3b287c29eaa57166b2ab1ba9bd0aaced13cc2f946a04b8d708ac429187fe944

SHA512
2bd09b83e44e0104fbe080a8573690217dc9fbf7fd59ff25a1a9e9ebd2d87ac533f9b99350773d081a7e748b39657115a13e94538b153bceb13ecdfc4672a0f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f2dc80f5403feb8461b7ffa09890d6a0

SHA1
d5b61e6d672e7e71571e0132e21cead181da8805

SHA256
eadeadba37eed18e5acba408d7e076270b00403fed372b77164577232232428a

SHA512
5e2119529b99b76be105c43714e4b9977ee2147172c1c44e92bd9b41fa7a66f55d4073c864aac668a912aff2898bd216fb38f2fe34ef65de69ad12965218caf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2943ec1281d1f6b8b79c9a72f7f844a9

SHA1
a96a27eede4e18beed0993f98a4e01f814d13953

SHA256
c9c5233f31e90d49b5c9674af164513ffe48dbdb350139a3224cd86fb719449e

SHA512
701b80fa9f7815a9dc12aff117e0d4ce7a9587fe00c66de460e696dd697b292bf1a44737df1f04c105b2550e986a4b2db8947a88f327a91bf21564b2ce694001

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fea86bad24852031dd05ea01fbb602c7

SHA1
7b643249064611e6a3a8e1672b6155b109dabdda

SHA256
c05ad4d0d799586cb2ae65dd5ee4327f0aa9a21b6ca4e04ed3069aad5dbfab28

SHA512
addaac8dfdcaf2766eace48ae12d37875eca09c2c1370374aa57f2ef296577d594b5022c4557f385c5dce84c870db530fd3c6c74935cbac868c106c70d64e29d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0a9d821c9b5700efa1bdc4e4c47fb6f9

SHA1
5a60096094705db2cd9b57d609cfb5f760cf8d06

SHA256
0df82ab19152a2494a03fccedbe5540761d098154fbb96dbf2e79f1d27b64d9d

SHA512
fccd1cf3b9699477869272982771de07f6a7866f70b4510d5a8c3e368bf9eebb13d8dfc9b27d3dbded7737764b10a3d4902e9f4cbd11e45b89d1d69f929a6b74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4b349828ed0d431d186d62ba9832962e

SHA1
546692319347d0c1968a6ab71a1f61e1d1108299

SHA256
40c9c56c4244e93ce8123fa8d16a09d0e9cf72495221af6a8f449abd2f8a476d

SHA512
a7e648282265018c6bf62be0187fa8d5afab571953971724285b361ab9cdca11a5db65672836a3ec84744980f4e729b595f60d8eaeb5bd000099621e633e9a61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit