af277117f93fbe518b20b27504d9607df8389027daa848178dcf24355b33bd82

Resubmissions

15/03/2024, 17:57

240315-wjxylafa5y 8

Analysis

max time kernel
164s
max time network
247s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
15/03/2024, 17:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

8.4MB
MD5

e400cd908b8fb7c13985e2f5cc7a7044
SHA1

bbafebdf5b067a7d7da130025851eaa52ec3c9d7
SHA256

ee3b1ab8794c749673ce9bd2dd302f12d69f0a1a4adfe40a64247746cc311829
SHA512

e7ca440f0e042d7fcfa99367426bf19899a2b227c6d7b6e2c25d4f1a40113250f21ebeaaf91067d8569dfbad1415d4fe3e5626d7254722f2778497fcb22e5d6e
SSDEEP

24576:/UrV6CI675knWSgRBPyQlrUmf1C6C6y6Z6/678HqBMUpuQ:MsWKA

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
428	msedge.exe
428	msedge.exe
4444	msedge.exe
4444	msedge.exe
980	msedge.exe
980	msedge.exe
1536	identity_helper.exe
1536	identity_helper.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 5040	4444	msedge.exe	79
PID 4444 wrote to memory of 5040	4444	msedge.exe	79
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 3556	4444	msedge.exe	80
PID 4444 wrote to memory of 428	4444	msedge.exe	81
PID 4444 wrote to memory of 428	4444	msedge.exe	81
PID 4444 wrote to memory of 112	4444	msedge.exe	82
PID 4444 wrote to memory of 112	4444	msedge.exe	82
PID 4444 wrote to memory of 112	4444	msedge.exe	82
PID 4444 wrote to memory of 112	4444	msedge.exe	82
PID 4444 wrote to memory of 112	4444	msedge.exe	82
PID 4444 wrote to memory of 112	4444	msedge.exe	82
PID 4444 wrote to memory of 112	4444	msedge.exe	82
PID 4444 wrote to memory of 112	4444	msedge.exe	82
PID 4444 wrote to memory of 112	4444	msedge.exe	82
PID 4444 wrote to memory of 112	4444	msedge.exe	82
PID 4444 wrote to memory of 112	4444	msedge.exe	82
PID 4444 wrote to memory of 112	4444	msedge.exe	82
PID 4444 wrote to memory of 112	4444	msedge.exe	82
PID 4444 wrote to memory of 112	4444	msedge.exe	82
PID 4444 wrote to memory of 112	4444	msedge.exe	82
PID 4444 wrote to memory of 112	4444	msedge.exe	82
PID 4444 wrote to memory of 112	4444	msedge.exe	82
PID 4444 wrote to memory of 112	4444	msedge.exe	82
PID 4444 wrote to memory of 112	4444	msedge.exe	82
PID 4444 wrote to memory of 112	4444	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdba903cb8,0x7ffdba903cc8,0x7ffdba903cd8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,16586407914299687323,13175713716470190462,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,16586407914299687323,13175713716470190462,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,16586407914299687323,13175713716470190462,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,16586407914299687323,13175713716470190462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,16586407914299687323,13175713716470190462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,16586407914299687323,13175713716470190462,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,16586407914299687323,13175713716470190462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,16586407914299687323,13175713716470190462,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2320 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,16586407914299687323,13175713716470190462,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,16586407914299687323,13175713716470190462,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,16586407914299687323,13175713716470190462,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,16586407914299687323,13175713716470190462,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5004 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
341f6b71eb8fcb1e52a749a673b2819c

SHA1
6c81b6acb3ce5f64180cb58a6aae927b882f4109

SHA256
57934852f04cef38bb4acbe4407f707f137fada0c36bab71b2cdfd58cc030a29

SHA512
57ecaa087bc5626752f89501c635a2da8404dbda89260895910a9cc31203e15095eba2e1ce9eee1481f02a43d0df77b75cb9b0d77a3bc3b894fdd1cf0f6ce6f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
88e9aaca62aa2aed293699f139d7e7e1

SHA1
09d9ccfbdff9680366291d5d1bc311b0b56a05e9

SHA256
27dcdb1cddab5d56ac53cff93489038de93f61b5504f8595b1eb2d3124bbc12c

SHA512
d90dabe34504dde422f5f6dec87851af8f4849f521759a768dfa0a38f50827b099dfde256d8f8467460c289bdb168358b2678772b8b49418c23b882ba21d4793

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6615d121f21020de7a0538d018404b33

SHA1
2a682a6528b1603fde22b8fa380dd0fe35f1b5f0

SHA256
0b82218f7ebbbe64c8f2f2209870bc570f32d75990efad200ebb175899515c0c

SHA512
f6865ae3f6d8b283cc85fbdfb8397f177b5540021682d25710db75a5dbf55897894962e33d5a0dfbb051b6f6c2f611264fe9055a96a9761e0b58b62c3ab66dc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6bf6fb68116fc1d0b3cea6669090ace3

SHA1
24db221e63cd4e08c58881d0d17fad55fc15bf51

SHA256
9f8d0fc1caf92634327d15db99eb608a33e12fab754ebd3f26daf493d18f0e73

SHA512
30238ceea5f46f6453e90c183f12ef4ca72896b5e325333ea04bb6fc21f5a3703dece9344bd3c185eee067570691a59e3b2447cc55f125a1ef1a87327b203f00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9d7b0e6ed3fd4102a88726559c0ca763

SHA1
852eac884113e75c746e2f3cfa02ce8ae9234e43

SHA256
a7546f3deeba25b860599f258b1e62220925bd66c6fe819087721c48ee0e78fc

SHA512
ff19f57b969973ff1952c1b55b714f1518eda331dc194ad4a6d096f73bfcea15890e775d02b31da6f4cbeb2c63efe1735034669426326784d503b63f338e2f91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
12431e9e6978a78adfb8be14416f2a4e

SHA1
917a8cc88aa361933db9550d6631f865641259a8

SHA256
0f4c7361c810cd0c73ad5ffc7e81be1154a5638d43dd8aab10371869b07d443d

SHA512
8757c05836566e8505cc2b06a86dcf07530c78ca08d8526dc1a1e151226c1076f5a8095949392036910ee66a693354ee9d6ec358cf50a43fe95cfede42baa13d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bd8f005efc7c9dbc0e37e8cbb18b93f9

SHA1
7d112438ff1bf23efbd8d6d62a3fc7dbe78f55ce

SHA256
8d78ae2a2960fa37f73cb967b17306e497fac470ca5700420ece148947035d46

SHA512
f44dcf9f98bf0be792fb4e0940f2ec1d44ea1dbe457921e3cd9edb122550f93cbe3abfdd495d294f6e0f474b06bb4d51cd2eeffd258021400a55244b8e80ac15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
99c6560d01cf67acb9ee74782c2837e0

SHA1
d6f4fa3ea84a9ee001ee265181e86d7e6c73ccb0

SHA256
891ff14af02c46f084e94e52acc904467086c8d421708273705625eee2508b00

SHA512
e0c9724e924f72c562a32f332bfcf68da249b6cec9dc8f73f94ae83a11dc56239408ddae58d4b7323063341e4459e82df52c83b3ba5eb9b7580a370fc2180a86

Download Submit