4113ee678970bd438e135454ca93f5004b531ebeae76d29b49eb5c32620f5e29

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23-02-2024 13:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

8.7MB
MD5

1ca87d8ee3ce9e9682547c4d9c9cb581
SHA1

d25b5b82c0b225719cc4ee318f776169b7f9af7a
SHA256

000ae5775ffa701d57afe7ac3831b76799e8250a2d0c328d1785cba935aab38d
SHA512

ec07b958b4122f0776a6bded741df43f87ba0503b6a3b9cc9cbe6188756dcde740122314e0578175123aaa61381809b382e7e676815c20c3e671a098f0f39810
SSDEEP

24576:ZQQa6Ne6P5d2WSmwRFXe1vmfpV6k626D6b62vSuSpZ:ZMfTVQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
2836	msedge.exe
2836	msedge.exe
4640	identity_helper.exe
4640	identity_helper.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 232	2836	msedge.exe	15
PID 2836 wrote to memory of 232	2836	msedge.exe	15
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4200	2836	msedge.exe	88
PID 2836 wrote to memory of 4472	2836	msedge.exe	87
PID 2836 wrote to memory of 4472	2836	msedge.exe	87
PID 2836 wrote to memory of 868	2836	msedge.exe	89
PID 2836 wrote to memory of 868	2836	msedge.exe	89
PID 2836 wrote to memory of 868	2836	msedge.exe	89
PID 2836 wrote to memory of 868	2836	msedge.exe	89
PID 2836 wrote to memory of 868	2836	msedge.exe	89
PID 2836 wrote to memory of 868	2836	msedge.exe	89
PID 2836 wrote to memory of 868	2836	msedge.exe	89
PID 2836 wrote to memory of 868	2836	msedge.exe	89
PID 2836 wrote to memory of 868	2836	msedge.exe	89
PID 2836 wrote to memory of 868	2836	msedge.exe	89
PID 2836 wrote to memory of 868	2836	msedge.exe	89
PID 2836 wrote to memory of 868	2836	msedge.exe	89
PID 2836 wrote to memory of 868	2836	msedge.exe	89
PID 2836 wrote to memory of 868	2836	msedge.exe	89
PID 2836 wrote to memory of 868	2836	msedge.exe	89
PID 2836 wrote to memory of 868	2836	msedge.exe	89
PID 2836 wrote to memory of 868	2836	msedge.exe	89
PID 2836 wrote to memory of 868	2836	msedge.exe	89
PID 2836 wrote to memory of 868	2836	msedge.exe	89
PID 2836 wrote to memory of 868	2836	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8b5f46f8,0x7ffa8b5f4708,0x7ffa8b5f4718
1⤵
PID:232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,10087018174509720951,10334994023730937290,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,10087018174509720951,10334994023730937290,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,10087018174509720951,10334994023730937290,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:8
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10087018174509720951,10334994023730937290,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10087018174509720951,10334994023730937290,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,10087018174509720951,10334994023730937290,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,10087018174509720951,10334994023730937290,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10087018174509720951,10334994023730937290,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10087018174509720951,10334994023730937290,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10087018174509720951,10334994023730937290,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10087018174509720951,10334994023730937290,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,10087018174509720951,10334994023730937290,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4936 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a65ab4f620efd5ba6c5e3cba8713e711

SHA1
f79ff4397a980106300bb447ab9cd764af47db08

SHA256
3964e81a3b4b582e570836837b90a0539e820886a35281b416e428e9bf25fd76

SHA512
90330661b0f38ca44d6bd13a7ea2ab08a4065ec4801695e5e7e0dea154b13ac8d9b2737e36ebe9a314d2501b5ef498d03c5617c87e36986e294c701182db41b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
854f73d7b3f85bf181d2f2002afd17db

SHA1
53e5e04c78d1b81b5e6c400ce226e6be25e0dea8

SHA256
54c176976e1c56f13af90be9b8b678f17f36a943210a30274be6a777cf9a8dc4

SHA512
de14899cfaad4c312804a7fe4dcb3e9221f430088cb8bf5a9b941ac392a0bbad4e6ca974e258e34617bbffff3bf6490fa90d8c6921616f44186e267ddaa02971

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f23795d6beadab3ebbd566bd367c0e96

SHA1
5496b1cc156278ffe257df55edef86522f803c53

SHA256
2c3c11a075cd808243b82c379134f4557be6699a61b384c756972878e4acc569

SHA512
1be705ba79d399bbe8e11ddfdf9fbd2fd189893b149e04f4f1f115d5eead6b798f56ea76fd0e2e7e2f3071a5d62dd28affa91a4e420e8d1776334f202bb2dd1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
924e1f4c757e572285d89e4b606c4ab6

SHA1
e57e5e09d1faa8db02973608474646c614e4e37e

SHA256
20ff18c9fa1c93a2ed29abf33811a50d6972204e8bf9c001f5223edbd934596b

SHA512
441d4538075d34775144778ed69fa735d377eb0dc514a8c684077fa26489d6834c103e5c8bb12ba09d502dbe9decf287c8ab3e7fee7e04a37ca76f61d79f3b30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4a6e1c6bf71827e2f320580fee7f5d88

SHA1
5f8ff92ab5602dab51959f24e41544907efc02aa

SHA256
a5ce18bc5367ede7fcaf0a41cc2cf9663790110b4a65a64a8cff35c7bd0beebf

SHA512
a5f83d3896e801a2df57c16afc7e353a95b10c674983874ee114b69b902a4fd34775d68a8ca98717ce84d2d6172532ee5d2245e110330255bad78cfe7dd12bc3

Download Submit