ed086414c58a78d08f2b8fe975a2073b52cedd6280815216c9a319c07a16824d

Resubmissions

25/03/2024, 18:50

240325-xhcfyaae5y 3

25/03/2024, 18:47

240325-xfhj6sae4v 3

Analysis

max time kernel
148s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20240319-en
resource tags

arch:x64arch:x86image:win11-20240319-enlocale:en-usos:windows11-21h2-x64system
submitted
25/03/2024, 18:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Screenshot 2024-03-22 6.36.59 PM.png
Size

105KB
MD5

b2082314f9ccd4827a3ae91acfe14969
SHA1

9271a41280d57d0bc1b97f8403b6270b7cf9ec81
SHA256

ed086414c58a78d08f2b8fe975a2073b52cedd6280815216c9a319c07a16824d
SHA512

0e25a636d03e98ba33952e6c9262472615133e2c3dc6050bc103d43ab95dcb12b8907845a170161966d80dbd4486cf12627e2b1ceaf5796d179ad0c6cb1f7994
SSDEEP

3072:54iUnVbRCFHYtbYwnaLB1hXeRs4rRC9HeWtj2W:JUVNLtbYwncGdqewj5

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5636	msedge.exe
5636	msedge.exe
244	msedge.exe
244	msedge.exe
6020	identity_helper.exe
6020	identity_helper.exe
4264	msedge.exe
4264	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 244 wrote to memory of 2812	244	msedge.exe	85
PID 244 wrote to memory of 2812	244	msedge.exe	85
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 2944	244	msedge.exe	86
PID 244 wrote to memory of 5636	244	msedge.exe	87
PID 244 wrote to memory of 5636	244	msedge.exe	87
PID 244 wrote to memory of 908	244	msedge.exe	88
PID 244 wrote to memory of 908	244	msedge.exe	88
PID 244 wrote to memory of 908	244	msedge.exe	88
PID 244 wrote to memory of 908	244	msedge.exe	88
PID 244 wrote to memory of 908	244	msedge.exe	88
PID 244 wrote to memory of 908	244	msedge.exe	88
PID 244 wrote to memory of 908	244	msedge.exe	88
PID 244 wrote to memory of 908	244	msedge.exe	88
PID 244 wrote to memory of 908	244	msedge.exe	88
PID 244 wrote to memory of 908	244	msedge.exe	88
PID 244 wrote to memory of 908	244	msedge.exe	88
PID 244 wrote to memory of 908	244	msedge.exe	88
PID 244 wrote to memory of 908	244	msedge.exe	88
PID 244 wrote to memory of 908	244	msedge.exe	88
PID 244 wrote to memory of 908	244	msedge.exe	88
PID 244 wrote to memory of 908	244	msedge.exe	88
PID 244 wrote to memory of 908	244	msedge.exe	88
PID 244 wrote to memory of 908	244	msedge.exe	88
PID 244 wrote to memory of 908	244	msedge.exe	88
PID 244 wrote to memory of 908	244	msedge.exe	88

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Screenshot 2024-03-22 6.36.59 PM.png"
1⤵
PID:3756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd0c6a3cb8,0x7ffd0c6a3cc8,0x7ffd0c6a3cd8
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,8366278901393959191,9797655482269774370,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,8366278901393959191,9797655482269774370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,8366278901393959191,9797655482269774370,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,8366278901393959191,9797655482269774370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,8366278901393959191,9797655482269774370,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,8366278901393959191,9797655482269774370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,8366278901393959191,9797655482269774370,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,8366278901393959191,9797655482269774370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3420 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,8366278901393959191,9797655482269774370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4464 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,8366278901393959191,9797655482269774370,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,8366278901393959191,9797655482269774370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4480 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,8366278901393959191,9797655482269774370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3912 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,8366278901393959191,9797655482269774370,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4996 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4113e45804b7888f88ae2a78482d0951

SHA1
4c59bba45c65ba65aa920cbd4eb0d7ccf517a220

SHA256
174195025b51f69ece21274cd7a97fff9f3d9a4bf57185ff3b1297bf2da6d1db

SHA512
16355c4c575a162396cf2ca377f586b3659a70e8c1708cad66b74bb3ef66cbf9ed33d9376730325d95420e5f4f558b2bdb6b5b7595b8b822eb6d2449a83c3f95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e521eb4a4c2bbe4898150cf066ee0cb0

SHA1
c2b311b8b78c677b55a356b8274197fdcbae8ab5

SHA256
1f947cf3be3f525e3039b9c363bb7d7bc0dd2b70da434149e0f0cbbc5d13dbe3

SHA512
59e1b52a41dad2e7f36e0343e330b00bc33a7ba88f616928fd2b6cc526cac6effed76b006cb8a23ff45e85be27647114c7a8376ef3ba53d38ccb9ed4de9a5ea8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8c6023ec09a6546cd00e0d5f073bcae8

SHA1
ebe210e943c52e05da09501f0ac8acc8db000bb4

SHA256
4b1ddcc747c35bab09b3fe08d9fc2a430eac7659e6646c923e246e35bf572de4

SHA512
fd2f7c214e725345c47fea1dd2ae78698229b4989c5a17779ca2a455bfe1cf042acc3b983f61350aed19e2339618fbb4717809cfd1190dc0aca8af41c394f096

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d973f5396606f41059380e319ae238a4

SHA1
d59d1642fcabc06b55f3568fe9f9348f501bc048

SHA256
c6dcbbdd673cda54f46cc80bada5d55fffc592979ee261ba710bc10ec62a68f7

SHA512
3b32af7d98e7cb87ea6b25d8d90986aa460d25d4f761c441bc38f228f3c20fa249822599a76e8e19ef53a985cd2967aba29a35c61ef601f8e8fee426b371f0eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
422d81c57ad1a6a69aea8ea174ea15f2

SHA1
71142d3e0261265b4039cacf42c00417afeeeaac

SHA256
8ee471052a9aaf3ea07c54cf96730aa317abbe4ec245dac3c422f20a5f324ee3

SHA512
c2b9af4086971d67fccaf0d952ccf78c38385769d910abaede42418a13e2c1d07b83ea54fc3f91b6a59633dc3bf66bb071a5a893793091709a9aca8151355a21

Download Submit