2e8edf52b2571991106e0e3108a9e4099cbbe4b700fae923f8d6b948ee13aaa9

Analysis

max time kernel
148s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-02-2024 10:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

8.7MB
MD5

1ca87d8ee3ce9e9682547c4d9c9cb581
SHA1

d25b5b82c0b225719cc4ee318f776169b7f9af7a
SHA256

000ae5775ffa701d57afe7ac3831b76799e8250a2d0c328d1785cba935aab38d
SHA512

ec07b958b4122f0776a6bded741df43f87ba0503b6a3b9cc9cbe6188756dcde740122314e0578175123aaa61381809b382e7e676815c20c3e671a098f0f39810
SSDEEP

24576:ZQQa6Ne6P5d2WSmwRFXe1vmfpV6k626D6b62vSuSpZ:ZMfTVQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3724	msedge.exe
3724	msedge.exe
2460	msedge.exe
2460	msedge.exe
740	identity_helper.exe
740	identity_helper.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe
3520	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 1484	2460	msedge.exe	87
PID 2460 wrote to memory of 1484	2460	msedge.exe	87
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 400	2460	msedge.exe	89
PID 2460 wrote to memory of 3724	2460	msedge.exe	88
PID 2460 wrote to memory of 3724	2460	msedge.exe	88
PID 2460 wrote to memory of 3260	2460	msedge.exe	90
PID 2460 wrote to memory of 3260	2460	msedge.exe	90
PID 2460 wrote to memory of 3260	2460	msedge.exe	90
PID 2460 wrote to memory of 3260	2460	msedge.exe	90
PID 2460 wrote to memory of 3260	2460	msedge.exe	90
PID 2460 wrote to memory of 3260	2460	msedge.exe	90
PID 2460 wrote to memory of 3260	2460	msedge.exe	90
PID 2460 wrote to memory of 3260	2460	msedge.exe	90
PID 2460 wrote to memory of 3260	2460	msedge.exe	90
PID 2460 wrote to memory of 3260	2460	msedge.exe	90
PID 2460 wrote to memory of 3260	2460	msedge.exe	90
PID 2460 wrote to memory of 3260	2460	msedge.exe	90
PID 2460 wrote to memory of 3260	2460	msedge.exe	90
PID 2460 wrote to memory of 3260	2460	msedge.exe	90
PID 2460 wrote to memory of 3260	2460	msedge.exe	90
PID 2460 wrote to memory of 3260	2460	msedge.exe	90
PID 2460 wrote to memory of 3260	2460	msedge.exe	90
PID 2460 wrote to memory of 3260	2460	msedge.exe	90
PID 2460 wrote to memory of 3260	2460	msedge.exe	90
PID 2460 wrote to memory of 3260	2460	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb123146f8,0x7ffb12314708,0x7ffb12314718
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,2934443746032228835,13537710111247514588,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,2934443746032228835,13537710111247514588,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,2934443746032228835,13537710111247514588,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2934443746032228835,13537710111247514588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2934443746032228835,13537710111247514588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,2934443746032228835,13537710111247514588,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,2934443746032228835,13537710111247514588,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2934443746032228835,13537710111247514588,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2934443746032228835,13537710111247514588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2934443746032228835,13537710111247514588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2934443746032228835,13537710111247514588,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,2934443746032228835,13537710111247514588,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e494d16e4b331d7fc483b3ae3b2e0973

SHA1
d13ca61b6404902b716f7b02f0070dec7f36edbf

SHA256
a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165

SHA512
016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0764f5481d3c05f5d391a36463484b49

SHA1
2c96194f04e768ac9d7134bc242808e4d8aeb149

SHA256
cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3

SHA512
a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eaecf775bc947c39cc287a015c621e90

SHA1
173aef45616fcefc6a1e817d4b37956babefc1ee

SHA256
c287786f49df165ad58e035075c2678e92eeda44e10fe7f3a5d0da026b101741

SHA512
a76a54aff7a7d271fa5e7b0e536349f20ff92daf684bf3026dcc1567d1ef871de040641a9ca6b785d552dc7951bcb64a00b92a64a8e18c5543b315fffa618f67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
320b3fc3b60f0d11b3c7501f71556960

SHA1
5faa35b0bbd05bff4acdd3e9526d5f40ba3a1522

SHA256
b4912323e47a0e38eeb74171c4742b9b5dc2b627cf351f1cebbfb1d6c31c3099

SHA512
586954fbf6fc25062202939c85a41ebc9a7816ec10728a38c8f4d5687ec9a1e63a515d4626cde371e1f2fd4e54acae7b40903db35b74b58304330d8739ad7df0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f2841e30875a8b20ed3196afd21de72e

SHA1
ec0f48b5453eb8a70017c4898d593e2b34012bf4

SHA256
ca3c3ec01f6d81319690586667c7fd03f9138ffc2467a773cee65ce74f4b8d4d

SHA512
388cf3cf25ef07e30a316e4dc05afc49db34c3b83590bf92d5e4850d132c0ba870a0749970a3c59d97a35c9dcb6537589728761217b73e5f79314f61348f876a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c4c6a101d5e9700cce7dbe09a5fb48a6

SHA1
148f84c0cff78ef3779489b660b90726191c5e01

SHA256
4ac522e3dde15237ad4968041249ad593ba67af7f648cf9d3b2c3dcaa8d751e8

SHA512
c366f1bb2fbc8f119e92a8ac039177752c6d1c0632f9c41bb1f84f5a68f8ac8bf2454121da544f618d5dc57cfb7257a907baff2862fae84c95d303ec5a4ae57f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ae68a0cf1d6794cb8eed9a2106b9086a

SHA1
4c1ca97b3b091a5c5284e38c4af755e5a8b189d9

SHA256
a2ea89072546c5d18da0382c2536364b4b247c3cc3a61944994bf3301897d29c

SHA512
e2879b87c6c15f51f19af937c8910d135b8d0339d3ae04b6436b2a83de3e3d29a1d4d140efe2b7759d013e646afeb53013da9c6c441c64371ffa4f69a5873bc2

Download Submit