1122756d9e0a6ef6dc86ca200d6dd39c83af2361042d68dec0f3be4e0d1bedb4

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 08:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

boutique-floor/assets/fonts/vjs.html
Size

1KB
MD5

4d2f3e41098f07d033c05e7fc09d7c21
SHA1

be0fb254f97500ebe2495acd554bcab4e2179070
SHA256

cfefc32bd41752a918310e929e1afde18ac73fd628ea8d7db2c61b476462e107
SHA512

28775d694c0de8d33f2c278f28c77cfd2ef00db353aa0ab654ea39df11c54b7a3630145ff8595e7b0cc60687b309349366875ed95a5a8ac4ba1cece023a48c5c

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2344	msedge.exe
2344	msedge.exe
4512	identity_helper.exe
4512	identity_helper.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe
2840	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 3916	2344	msedge.exe	85
PID 2344 wrote to memory of 3916	2344	msedge.exe	85
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 4968	2344	msedge.exe	87
PID 2344 wrote to memory of 2296	2344	msedge.exe	88
PID 2344 wrote to memory of 2296	2344	msedge.exe	88
PID 2344 wrote to memory of 1792	2344	msedge.exe	89
PID 2344 wrote to memory of 1792	2344	msedge.exe	89
PID 2344 wrote to memory of 1792	2344	msedge.exe	89
PID 2344 wrote to memory of 1792	2344	msedge.exe	89
PID 2344 wrote to memory of 1792	2344	msedge.exe	89
PID 2344 wrote to memory of 1792	2344	msedge.exe	89
PID 2344 wrote to memory of 1792	2344	msedge.exe	89
PID 2344 wrote to memory of 1792	2344	msedge.exe	89
PID 2344 wrote to memory of 1792	2344	msedge.exe	89
PID 2344 wrote to memory of 1792	2344	msedge.exe	89
PID 2344 wrote to memory of 1792	2344	msedge.exe	89
PID 2344 wrote to memory of 1792	2344	msedge.exe	89
PID 2344 wrote to memory of 1792	2344	msedge.exe	89
PID 2344 wrote to memory of 1792	2344	msedge.exe	89
PID 2344 wrote to memory of 1792	2344	msedge.exe	89
PID 2344 wrote to memory of 1792	2344	msedge.exe	89
PID 2344 wrote to memory of 1792	2344	msedge.exe	89
PID 2344 wrote to memory of 1792	2344	msedge.exe	89
PID 2344 wrote to memory of 1792	2344	msedge.exe	89
PID 2344 wrote to memory of 1792	2344	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\boutique-floor\assets\fonts\vjs.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1eaa46f8,0x7ffa1eaa4708,0x7ffa1eaa4718
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,11025674950396856136,3277973066871039397,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,11025674950396856136,3277973066871039397,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,11025674950396856136,3277973066871039397,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11025674950396856136,3277973066871039397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11025674950396856136,3277973066871039397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,11025674950396856136,3277973066871039397,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,11025674950396856136,3277973066871039397,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11025674950396856136,3277973066871039397,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11025674950396856136,3277973066871039397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11025674950396856136,3277973066871039397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,11025674950396856136,3277973066871039397,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,11025674950396856136,3277973066871039397,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5556 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1f6d41bf10dc1ec1ca4e14d350bbc0b1

SHA1
7a62b23dc3c19e16930b5108d209c4ec937d7dfb

SHA256
35947f71e9cd4bda79e78d028d025dff5fe99c07ea9c767e487ca45d33a5c770

SHA512
046d6c2193a89f4b1b7f932730a0fc72e9fc95fbdb5514435a3e2a73415a105e4f6fa7d536ae6b24638a6aa97beb5c8777e03f597bb4bc928fa8b364b7192a13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4254f7a8438af12de575e00b22651d6c

SHA1
a3c7bde09221129451a7bb42c1707f64b178e573

SHA256
7f55f63c6b77511999eee973415c1f313f81bc0533a36b041820dd4e84f9879b

SHA512
e6a3244139cd6e09cef7dab531bff674847c7ca77218bd1f971aa9bf733a253ac311571b8d6a3fe13e13da4f506fec413f3b345a3429e09d7ceb821a7017ec70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
191B

MD5
ce8bdecf326fdb1fc5b294aa072a659b

SHA1
dea241329bc61a59655804a5a8f84edf01150d84

SHA256
2c707c8713b9a30f5308cb3cc33cfb6efe7b0cd2026586a86cfea1d0515cdb34

SHA512
714fbd8c2d4a274d643606bcac13b34d1e1fc963f6db3db829bbbe83a2939a803525fc9aecb8da87dd0c192bcfc674fc2c2546f7d0ee2071f501d08ab7b0b387

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dc36cc61c08b13539cc3c222cceb65f6

SHA1
aa6a8fa0f092f1d954199042a1e6e80ddc79b3f2

SHA256
733ed9822cd23e6f95bc4cda2fe32e2123ea1949172936e4d87f41b0055e3754

SHA512
e070343f29146042677437b1f9e6d3f7eba2f171624cbfe3d1d1982a8fd08cb454c0bce667777385db3484782d1ed327cfde776efc2be1aa12efe04077048492

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6d236c16a5147b75ff8005b35b402c7d

SHA1
1e63de56e7cf481628bbca01d58a0fd8e197276a

SHA256
b3852d6d32d4256bb9daebd1f1081e702438f6dded08abfb07026f437c40c508

SHA512
f6b07dcef8440e21d9245e0952bbd6291aaa40eb2cd279e8ec6fd5baf37b6b754699f88533063407b1f15e80108d43ebb20c524cf6c21afc626d9a741b9f5c96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
190d131fc4a9f4d5ee70ebf746bf1913

SHA1
6ac43ac85f6e2a1d8a845167b0edfb9308bd1ed7

SHA256
cf6b1b0c8bcc0ddc155640c35289b8990b78c6151f68f6a763653a9ed9ebf3af

SHA512
328827eacfc4bb16fa85b37b4b9a2dd6e8ad984a330c2262a63a5345869ea20a0eee4952e8ac121c8d4981018532bf6a607e210058f03e439964ce754d235062

Download Submit