1122756d9e0a6ef6dc86ca200d6dd39c83af2361042d68dec0f3be4e0d1bedb4

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 08:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

boutique-floor/privacy-policy.html
Size

55KB
MD5

d4c8f077741099e2695f1e6b406eeda0
SHA1

1826bdc8f006559865c03405d6196021806542e2
SHA256

707ced13621033b275fe13e8969f569d799db1bcbf94e5b1378840d33e3ff047
SHA512

1adc610d09786dd46a262177ef79d75428bd3dd70222bb7ff61caa05a4922a50f4695aa4beee1c7fa94dcf6c0ac8f34c4517cf6ef170ed35b74e984abb3d6565
SSDEEP

768:IRh06x48agk0et44wSUXGKnFm0eCVI8ZbcuNco:Z8jk0e2pSJKnFmscuNco

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
772	msedge.exe
772	msedge.exe
2476	msedge.exe
2476	msedge.exe
3108	identity_helper.exe
3108	identity_helper.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe
2476	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 1852	2476	msedge.exe	55
PID 2476 wrote to memory of 1852	2476	msedge.exe	55
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 4192	2476	msedge.exe	88
PID 2476 wrote to memory of 772	2476	msedge.exe	87
PID 2476 wrote to memory of 772	2476	msedge.exe	87
PID 2476 wrote to memory of 1240	2476	msedge.exe	89
PID 2476 wrote to memory of 1240	2476	msedge.exe	89
PID 2476 wrote to memory of 1240	2476	msedge.exe	89
PID 2476 wrote to memory of 1240	2476	msedge.exe	89
PID 2476 wrote to memory of 1240	2476	msedge.exe	89
PID 2476 wrote to memory of 1240	2476	msedge.exe	89
PID 2476 wrote to memory of 1240	2476	msedge.exe	89
PID 2476 wrote to memory of 1240	2476	msedge.exe	89
PID 2476 wrote to memory of 1240	2476	msedge.exe	89
PID 2476 wrote to memory of 1240	2476	msedge.exe	89
PID 2476 wrote to memory of 1240	2476	msedge.exe	89
PID 2476 wrote to memory of 1240	2476	msedge.exe	89
PID 2476 wrote to memory of 1240	2476	msedge.exe	89
PID 2476 wrote to memory of 1240	2476	msedge.exe	89
PID 2476 wrote to memory of 1240	2476	msedge.exe	89
PID 2476 wrote to memory of 1240	2476	msedge.exe	89
PID 2476 wrote to memory of 1240	2476	msedge.exe	89
PID 2476 wrote to memory of 1240	2476	msedge.exe	89
PID 2476 wrote to memory of 1240	2476	msedge.exe	89
PID 2476 wrote to memory of 1240	2476	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\boutique-floor\privacy-policy.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9560446f8,0x7ff956044708,0x7ff956044718
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1488,10007371057101090915,13352336632214552118,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1488,10007371057101090915,13352336632214552118,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1488,10007371057101090915,13352336632214552118,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1488,10007371057101090915,13352336632214552118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1488,10007371057101090915,13352336632214552118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1488,10007371057101090915,13352336632214552118,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1488,10007371057101090915,13352336632214552118,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1488,10007371057101090915,13352336632214552118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1488,10007371057101090915,13352336632214552118,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1488,10007371057101090915,13352336632214552118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1488,10007371057101090915,13352336632214552118,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1488,10007371057101090915,13352336632214552118,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5204 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\784da1a4-6ada-4930-bb26-946d819bed95.tmp

Filesize
11KB

MD5
6c46f7fe9ed3a2f03014a5a848d960e2

SHA1
31f9c36de633d264de243ff7f81dfd1629dcd1cb

SHA256
ceaeb6a0a12437bef2eeb8388c190d17b05f1838f97daa8c2dc87f79f2c778da

SHA512
f1329af47179f96e3baad99c6c1d42077ad092745d56485c82f29f587b2494ceea54b1fc619b9e6ed70c23d02f254760119beb73e468c30cef017e9b01e6912c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
58670ac03d80eb4bd1cec7ac5672d2e8

SHA1
276295d2f9e58fb0b8ef03bd9567227fb94e03f7

SHA256
76e1645d9c4f363b34e554822cfe0d53ff1fce5e994acdf1edeff13ae8df30f8

SHA512
99fe23263de36ec0c8b6b3b0205df264250392cc9c0dd8fa28cf954ff39f9541f722f96a84fbc0b4e42cfd042f064525a6be4b220c0180109f8b1d51bbdef8ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3782686f747f4a85739b170a3898b645

SHA1
81ae1c4fd3d1fddb50b3773e66439367788c219c

SHA256
67ee813be3c6598a8ea02cd5bb5453fc0aa114606e3fc7ad216f205fe46dfc13

SHA512
54eb860107637a611150ff18ac57856257bf650f70dce822de234aee644423080b570632208d38e45e2f0d2bf60ca2684d3c3480f9637ea4ad81f2bcfb9f24d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
790B

MD5
d8fc0c0f8ebab44e0eea9fdbde538085

SHA1
464a5769418574787b8ff014dc025436f0f41e2c

SHA256
4d94996a6118ea22c7f9832fb2563e5915b31b1d031da0c636bb7b707d76aa50

SHA512
030e45214fd7aea05aebd4520892b25cc1d630bdd56cfbe56e9916f39ce7060bf5b45a3920982f8a0ec22b1d76d12a8a6ef10dd3a36784faa38bf2e5dadf0ff4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1bbfd08490a68cf957d8ae87e8b36fb4

SHA1
f41d3833affaa029ac525cb5043a56ed28ca05d1

SHA256
53875e4f3c8b77cadce695927f7f321da6e7ba094b556610210be36319095dc8

SHA512
c485c4b35b028e8a50efb14ffc90e8c64f15b2fdac1cc74870b9436386d5187e1bff7303533d863334f297bca1ca6acfb69a1f7920bc5b7c62b2ec2f441533cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0acedaa6fceda95de82c6f4712254699

SHA1
afb1f0e162d70e372f2d26c9956abe2d59da2292

SHA256
ac970365244af97fdc788d83055595cfbaf008affb32def85458d23dd5432b7d

SHA512
22ef55fd291fe42cc3fc2befd3c79629b1a837aab0a4d3c190027ff9b47fea3461782977b45086a004ba5c28c42ad9fb4aaa073fe4d96c52c5c9a662f9e0be28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit