def6e4badfc2331e4668c3aef2c3dbe2eb8e09cd70cf7db545c4dbbd6b1eb146

Analysis

max time kernel
143s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
19/03/2024, 19:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20240222_132354_HDR.jpg
Size

2.1MB
MD5

3b4f61b98d3e167584ef1ccdea5ae00f
SHA1

5e8fa7143e77a73d8f89164d67c8d8a79da4c13e
SHA256

def6e4badfc2331e4668c3aef2c3dbe2eb8e09cd70cf7db545c4dbbd6b1eb146
SHA512

a6f78c48c919e806098a4851424033755db5f6de793b81426247df79d69b01189e6a4b0c3c875a81a9c0de13bf5c7ba4928036b17726a23c40e020f70616d232
SSDEEP

24576:dhSxuAAmDCEVcgon2/PE08nbHTl4YWUh06sd0+H5IQmW+m3ia7NOBxiZXKuftRv1:LSM2boYcnV4YvM0+HbiasviZxfvND0W

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
4636	msedge.exe
4636	msedge.exe
4908	identity_helper.exe
4908	identity_helper.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe
776	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 3872	776	msedge.exe	86
PID 776 wrote to memory of 3872	776	msedge.exe	86
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 1908	776	msedge.exe	87
PID 776 wrote to memory of 4536	776	msedge.exe	88
PID 776 wrote to memory of 4536	776	msedge.exe	88
PID 776 wrote to memory of 3364	776	msedge.exe	89
PID 776 wrote to memory of 3364	776	msedge.exe	89
PID 776 wrote to memory of 3364	776	msedge.exe	89
PID 776 wrote to memory of 3364	776	msedge.exe	89
PID 776 wrote to memory of 3364	776	msedge.exe	89
PID 776 wrote to memory of 3364	776	msedge.exe	89
PID 776 wrote to memory of 3364	776	msedge.exe	89
PID 776 wrote to memory of 3364	776	msedge.exe	89
PID 776 wrote to memory of 3364	776	msedge.exe	89
PID 776 wrote to memory of 3364	776	msedge.exe	89
PID 776 wrote to memory of 3364	776	msedge.exe	89
PID 776 wrote to memory of 3364	776	msedge.exe	89
PID 776 wrote to memory of 3364	776	msedge.exe	89
PID 776 wrote to memory of 3364	776	msedge.exe	89
PID 776 wrote to memory of 3364	776	msedge.exe	89
PID 776 wrote to memory of 3364	776	msedge.exe	89
PID 776 wrote to memory of 3364	776	msedge.exe	89
PID 776 wrote to memory of 3364	776	msedge.exe	89
PID 776 wrote to memory of 3364	776	msedge.exe	89
PID 776 wrote to memory of 3364	776	msedge.exe	89

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\20240222_132354_HDR.jpg
1⤵
PID:2420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\SetRepair.htm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff993683cb8,0x7ff993683cc8,0x7ff993683cd8
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,15866218791912792359,5313728515603199218,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1868 /prefetch:2
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1860,15866218791912792359,5313728515603199218,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1860,15866218791912792359,5313728515603199218,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15866218791912792359,5313728515603199218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15866218791912792359,5313728515603199218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15866218791912792359,5313728515603199218,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15866218791912792359,5313728515603199218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15866218791912792359,5313728515603199218,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1860,15866218791912792359,5313728515603199218,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15866218791912792359,5313728515603199218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15866218791912792359,5313728515603199218,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1860,15866218791912792359,5313728515603199218,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1860,15866218791912792359,5313728515603199218,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1860,15866218791912792359,5313728515603199218,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5676 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
12b71c4e45a845b5f29a54abb695e302

SHA1
8699ca2c717839c385f13fb26d111e57a9e61d6f

SHA256
c353020621fa6cea80eaa45215934d5f44f181ffa1a673cdb7880f20a4e898e0

SHA512
09f0d1a739102816c5a29106343d3b5bb54a31d67ddbfcfa21306b1a6d87eaa35a9a2f0358e56cc0f78be15eeb481a7cc2038ce54d552b9b791e7bee78145241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce319bd3ed3c89069337a6292042bbe0

SHA1
7e058bce90e1940293044abffe993adf67d8d888

SHA256
34070e3eea41c0e180cb5541de76cea15ef6f9e5c641e922d82a2d97bdce3aa3

SHA512
d42f7fc32a337ecd3a24bcbf6cd6155852646cae5fb499003356f713b791881fc2e46825c4ff61d09db2289f25c0992c10d6fadb560a9bea33284bd5acc449f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0b45e9aa8687ebe10dff2b14fba49b2e

SHA1
5152434226ba936f9c3ae17bc569fb3a80c49d01

SHA256
5fb408b64357ab21d9d8f3eda70a7da9e345f961f0e26c8c26b75d39e8b9f894

SHA512
acd3a043cad3f761a1af1c48f96acd788b384b86dfe91ddf6dae00f265121c9a346e8198ed69b2db38056866712f328154189db7305faa339a8776ac543b7122

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
39a1f2dfceec01b0c50b3df69fb25fb0

SHA1
95bed99b051b97422a554629ee5041ea01020129

SHA256
94bd42ed611af435c2bb4331ebf9fc5f90a84949f5671f7928ffc51dffe2fc20

SHA512
3ea20753c555922467509d8c1bffb0f5a8b88051b811a3997bdd54c7c6a2fb06ff95fcb01ed7471a6a3b4fcc3ec83e221ceae159aa222ecf39b237a4cf24c8a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b5fe748d78db11a26090a2d599c11704

SHA1
6288abf5b9f998171f2529dd3795eac7e94a703a

SHA256
1642b124b3c10656791a7a5f0e80651373929b7088226f07b38c749ab8c81c4a

SHA512
cefe0644aba4758ebf9c3c9c94e2107ba59702bbd81bbac2d0d8882597975b53c34d0fb5e50d40806158417e30956f3ba608944735402f85b9d73dc538995979

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bab4976613c8a437afcd996cd0309939

SHA1
1449ebd0333751e3bd470e2c4204022dc792fd2b

SHA256
8c4629e92c722710da0931c79059a24b05cb4041819d13d21106cdff90b42e12

SHA512
622464175538ce5c9d5122975f53f2aa20d5d87800227ce54b2c198cd5aa3c2a3c6213b05f64d04e382d3b2805381dad7a2b878f5c905cc70ccd1e75e814613d

Download Submit