57eb96364f74cb20a33552d768c13e0453487d0c96d2acab89171942aa0fd767

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2024 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

xiaof_toupiao/resources/font/index.html
Size

132B
MD5

3f12ace2ae56bce9e8fd32dd80046e45
SHA1

4a50a0a702f2bc7b41ab9f066ca0a6fc43408fb4
SHA256

3a4910e3ed247925e4fb84f312ad1e1ec0a2e45196e75f13c59138ef6f11ade3
SHA512

654483399c2d263cbd6020b5ca73aa2e73d78e310fcb0b5abe21cadddfe5922af88e97f6743c9c4ce5d2f6e7a0e5344c0b94fa0019f5fe8c55aa09861439ffaf

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1688	msedge.exe
1688	msedge.exe
3088	msedge.exe
3088	msedge.exe
1192	identity_helper.exe
1192	identity_helper.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

3088 msedge.exe
3088 msedge.exe
3088 msedge.exe
3088 msedge.exe
3088 msedge.exe
3088 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3088 wrote to memory of 4048	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4048	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 3368	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1688	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 1688	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4512	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4512	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4512	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4512	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4512	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4512	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4512	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4512	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4512	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4512	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4512	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4512	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4512	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4512	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4512	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4512	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4512	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4512	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4512	3088	msedge.exe	msedge.exe
PID 3088 wrote to memory of 4512	3088	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\xiaof_toupiao\resources\font\index.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff88f5446f8,0x7ff88f544708,0x7ff88f544718
2⤵
PID:4048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,7685925018892393012,4692150158084073979,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
2⤵
PID:3368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,7685925018892393012,4692150158084073979,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,7685925018892393012,4692150158084073979,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:8
2⤵
PID:4512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7685925018892393012,4692150158084073979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
2⤵
PID:4388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7685925018892393012,4692150158084073979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
2⤵
PID:452

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,7685925018892393012,4692150158084073979,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
2⤵
PID:1792

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,7685925018892393012,4692150158084073979,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7685925018892393012,4692150158084073979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
2⤵
PID:3700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7685925018892393012,4692150158084073979,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
2⤵
PID:2056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7685925018892393012,4692150158084073979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
2⤵
PID:2084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,7685925018892393012,4692150158084073979,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
2⤵
PID:2164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,7685925018892393012,4692150158084073979,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4452 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:336

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
7740a919423ddc469647f8fdd981324d

SHA1
c1bc3f834507e4940a0b7594e34c4b83bbea7cda

SHA256
bdd4adaa418d40558ab033ac0005fd6c2312d5f1f7fdf8b0e186fe1d65d78221

SHA512
7ad98d5d089808d9a707d577e76e809a223d3007778a672734d0a607c2c3ac5f93bc72adb6e6c7f878a577d3a1e69a16d0cd871eb6f58b8d88e2ea25f77d87b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
9f44d6f922f830d04d7463189045a5a3

SHA1
2e9ae7188ab8f88078e83ba7f42a11a2c421cb1c

SHA256
0ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a

SHA512
7c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
322466538d1ceedeef207a1b715c4798

SHA1
6cebe27a677743dd79d461ddf12caa3259b8bcb2

SHA256
f62087dbf0342e55559ecd6409ed1059541244ad3c71ece504e47f7f094a866b

SHA512
b27866ffb73943f75c766c2229d0b8f95ac480eaa4369db7d313d39dde6ef5c334cb1e5c4c25a49450fb75e63a8ca0ff0ac45c4dd1ac8dc158578f5ead30e158

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
5a89474352cd8f41f29df77c0060a334

SHA1
e5afd8f7d66abec6b2500ec3e74f53f6d094cedf

SHA256
dbb947e6371f8cf28c1092d0519770d5020a1f30931c33c6087a8e37ae3c567a

SHA512
901c7116d6dc3f764cf79bdbb9308978060c421221edb86d8312b1f55351da4453dc1611e4859a00a251161a5450dc2dedf62e303cd37d1df24f24e0154339e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
116f1c100d3670a2435b4d1c03b5f387

SHA1
56bf77178e3c991b645b69ed74899eb2683531fb

SHA256
daddc6c3f3e1b3c5208c4db5f78c9b2db61aec9d3e98c5a140f017468c16be15

SHA512
bc58a0876934df8bad67000faa84a8e957372e7ec8878983d7c2969f5029414ef2f36fe23caf9b6d093468f7e99952ebf789e9ec31e8a19b0a7bb75855ac2738

Download Submit
\??\pipe\LOCAL\crashpad_3088_MKLTCNIQCJSDQGXW
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit