3d3a748b9c5e2db830cf3f9dd58d299d64ef8168b69b8d939e9f32040f3be03e

Analysis

max time kernel
157s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-03-2024 20:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/assets/updater/updater.html
Size

423B
MD5

80ca9f9545a5cb816ec202c5ac7cc6d8
SHA1

383035241b86667aa8cc192d675706974e89eeef
SHA256

6ab2c4f63e9c6fb6b29315b9a0909f0977d935e61027603dc4773f1f673848ab
SHA512

a78d8c9ae1cc2e40a113c1843bb03efe7a09ab1125338681a580bf2457efa582a3c4c72c61b3a3e06849d9fe200a2005648ac8276533f583abf7fe03eb8a786a

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1472	msedge.exe
1472	msedge.exe
3088	msedge.exe
3088	msedge.exe
4608	identity_helper.exe
4608	identity_helper.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 4164	3088	msedge.exe	89
PID 3088 wrote to memory of 4164	3088	msedge.exe	89
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1460	3088	msedge.exe	90
PID 3088 wrote to memory of 1472	3088	msedge.exe	91
PID 3088 wrote to memory of 1472	3088	msedge.exe	91
PID 3088 wrote to memory of 1120	3088	msedge.exe	92
PID 3088 wrote to memory of 1120	3088	msedge.exe	92
PID 3088 wrote to memory of 1120	3088	msedge.exe	92
PID 3088 wrote to memory of 1120	3088	msedge.exe	92
PID 3088 wrote to memory of 1120	3088	msedge.exe	92
PID 3088 wrote to memory of 1120	3088	msedge.exe	92
PID 3088 wrote to memory of 1120	3088	msedge.exe	92
PID 3088 wrote to memory of 1120	3088	msedge.exe	92
PID 3088 wrote to memory of 1120	3088	msedge.exe	92
PID 3088 wrote to memory of 1120	3088	msedge.exe	92
PID 3088 wrote to memory of 1120	3088	msedge.exe	92
PID 3088 wrote to memory of 1120	3088	msedge.exe	92
PID 3088 wrote to memory of 1120	3088	msedge.exe	92
PID 3088 wrote to memory of 1120	3088	msedge.exe	92
PID 3088 wrote to memory of 1120	3088	msedge.exe	92
PID 3088 wrote to memory of 1120	3088	msedge.exe	92
PID 3088 wrote to memory of 1120	3088	msedge.exe	92
PID 3088 wrote to memory of 1120	3088	msedge.exe	92
PID 3088 wrote to memory of 1120	3088	msedge.exe	92
PID 3088 wrote to memory of 1120	3088	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\resources\assets\updater\updater.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb1d4546f8,0x7ffb1d454708,0x7ffb1d454718
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,6913848677617817087,6804794193719847228,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,6913848677617817087,6804794193719847228,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2532 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,6913848677617817087,6804794193719847228,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6913848677617817087,6804794193719847228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6913848677617817087,6804794193719847228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,6913848677617817087,6804794193719847228,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,6913848677617817087,6804794193719847228,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6913848677617817087,6804794193719847228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6913848677617817087,6804794193719847228,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6913848677617817087,6804794193719847228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6913848677617817087,6804794193719847228,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,6913848677617817087,6804794193719847228,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3196 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
586B

MD5
e2d5b78912e61b56b76193dc64802932

SHA1
642e6f42af28ddfa94dd1111263c7c2d886f3fd0

SHA256
fd7f3a5c4270f54c3b2a41db78844fc3eb92a6ff304a7fd7c03bd3e184e74c1b

SHA512
3a97045ed1e6a5f455c16d2e32e9995acbd6ee587507061139672178bccf36689b8fe2a1abcfed1e3548f942bb7a3069da2d4354e4ff0d64fc7df0ebea73bf8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
63a34a2323a1e47f69ab481a3beca699

SHA1
992f33d6c50b7990b5663c3be61f017fedc0d58a

SHA256
c51f09e8f388ea6228d36c0fd2e093de35f456461544e82911b6fb8b2be8ffe0

SHA512
36fe15341d41897e49a8b69da4c1e09f7d2f13bf7c8a1d56fc112540100c576402a3aa890c6ca7d7180de18b45c3a30dbbb393706ba88c5de4cc51c894e215fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6336102d0751db21481dfd70ea678576

SHA1
3e02c151395d8cd7be26c548176fef1d0b5336d4

SHA256
c945e31ade994d99442e327a97a2e1c85f6dffbb50332894df4f089a53832a75

SHA512
3a51a632c72adc8e2df6c41f311f02ee97b27e98c5da718be09e464b22662e631650806c0c8d6f43aa4b6c11a2e699df70bfd5675314ce7ce2eddedbd50e97d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
780e9afa680726258226f55cc0086b61

SHA1
e96296aa710b117d1429fae5be76fdd98370cda3

SHA256
02c766d57ab4c8944d3c8e2203810779113ffb12c9818469363b76143b6ab34d

SHA512
a90de5a2123e2ec27bf31f7aec5c49fa7c72a58b3fe044409dd6a8b1054d643ae7e6ca4af9c8b5cc3009c57e00783d390d6cbf052dd2e84941cb6c6228b14f9e

Download Submit