8d8e61a7d0542b8ec257a1de4ee33db026d1e28a9ab28d9133c6592befe26d32

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2024, 08:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

watch.html
Size

17KB
MD5

55369f0ee551391c7f2b54cb9f2493c8
SHA1

222efee81b7cacbcc7cb4c4018927d76b1797863
SHA256

8d8e61a7d0542b8ec257a1de4ee33db026d1e28a9ab28d9133c6592befe26d32
SHA512

885f25d59e8d9dff64e15350a5225ae41df5568f39d20595d40e7efc9e33cea72da9f24b117cc4eb0709f02063723828e0d3211a94a814020512144f31fda330
SSDEEP

384:5Ssl9qYoJkN0dMQ6VNG7BoWw5F9SQOanJVDggk:BoJkmMZVNG7I5IWVDggk

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1916	msedge.exe
1916	msedge.exe
1584	msedge.exe
1584	msedge.exe
2372	identity_helper.exe
2372	identity_helper.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 2200	1584	msedge.exe	69
PID 1584 wrote to memory of 2200	1584	msedge.exe	69
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 4928	1584	msedge.exe	88
PID 1584 wrote to memory of 1916	1584	msedge.exe	89
PID 1584 wrote to memory of 1916	1584	msedge.exe	89
PID 1584 wrote to memory of 2828	1584	msedge.exe	90
PID 1584 wrote to memory of 2828	1584	msedge.exe	90
PID 1584 wrote to memory of 2828	1584	msedge.exe	90
PID 1584 wrote to memory of 2828	1584	msedge.exe	90
PID 1584 wrote to memory of 2828	1584	msedge.exe	90
PID 1584 wrote to memory of 2828	1584	msedge.exe	90
PID 1584 wrote to memory of 2828	1584	msedge.exe	90
PID 1584 wrote to memory of 2828	1584	msedge.exe	90
PID 1584 wrote to memory of 2828	1584	msedge.exe	90
PID 1584 wrote to memory of 2828	1584	msedge.exe	90
PID 1584 wrote to memory of 2828	1584	msedge.exe	90
PID 1584 wrote to memory of 2828	1584	msedge.exe	90
PID 1584 wrote to memory of 2828	1584	msedge.exe	90
PID 1584 wrote to memory of 2828	1584	msedge.exe	90
PID 1584 wrote to memory of 2828	1584	msedge.exe	90
PID 1584 wrote to memory of 2828	1584	msedge.exe	90
PID 1584 wrote to memory of 2828	1584	msedge.exe	90
PID 1584 wrote to memory of 2828	1584	msedge.exe	90
PID 1584 wrote to memory of 2828	1584	msedge.exe	90
PID 1584 wrote to memory of 2828	1584	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\watch.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9cf8d46f8,0x7ff9cf8d4708,0x7ff9cf8d4718
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,10816006200892551460,18435117600028853744,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,10816006200892551460,18435117600028853744,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,10816006200892551460,18435117600028853744,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2528 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10816006200892551460,18435117600028853744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10816006200892551460,18435117600028853744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,10816006200892551460,18435117600028853744,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,10816006200892551460,18435117600028853744,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10816006200892551460,18435117600028853744,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10816006200892551460,18435117600028853744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10816006200892551460,18435117600028853744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10816006200892551460,18435117600028853744,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,10816006200892551460,18435117600028853744,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5476 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f5b0bf4edca2187f7715ddd49777a1b2

SHA1
eb78099013d0894a11c48d496f48973585f0c7c0

SHA256
562016f9159ef363fcbe62ed13ee26052b31d4f67dc5ea6d60864a7d5dfa50a1

SHA512
1039b98cffd32ca4c9e37486b96e01b167d76b19dd8440a21da4932d677c463f4c5ce2260239e8337f59bd61ff3111905e23ab71d3ca5b20e7d2935fea7952c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
197B

MD5
35004b3819feeba12906aa973431aff4

SHA1
404821c1b4287b2dcfda395032924fb1e7790017

SHA256
c06b1977b2a2e8d2e3ed992c2c862a73e0a4f632c13cac6bbde78fd21d7bba74

SHA512
f8ae8fb779f11fee137e88ae8c9dabe830d7267c859551daf3810c247ecee45628d7fabb9b4d8bb4c49da11842df107119a71865c0faf6ccb64237f3ce2092b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3cd76647beaaefde357cd4bae0751333

SHA1
729862ba34ccb60659fa2f2f56fd2cdfff015051

SHA256
525a996e7bd5683cc232abf541bc1a10b133584fd6fba9aa4abefa9c0613b6d3

SHA512
284c6798c36260f9d17d78e4e3cfe6d1293ff93faeeb17051e3c3098947eb0db61592506cabc0146ff350c8009bcb26fdbe9895b85ff97250d12831c767f1524

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
258ec4c0562edacb834da2537ebf775d

SHA1
8f6efcb1b2594f2feb1fa3aed8d13f5799124ea0

SHA256
027cac4f28aee6eacbe882a2f5b63387b8d5ae0143f924469945022aa8867f12

SHA512
0a6b09ba3919c06f9fe722d3e5fc2472a739a9957efeb171dfe19bf590e4efb4b4f68183ec3a377e8bc3b86fde115a2ae14d724d59b9ee83c561a7d48402f34e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
eacd633f9314b00e4cb89879504916da

SHA1
d92ca973460150bd7f6c778f78b0566d923dd031

SHA256
b6c2ced152aec4f215b2cf0563a40b29ddf7208bf964ca6252714fed071a6dff

SHA512
3de16f645b6899867b51f6f12509def3196a4e9335eb5c007f14a6a73ffdba0b7d204e471444d82bc82da23f53ef5260d70ddebcbd89de6f2bd28522652ef668

Download Submit