Analysis
-
max time kernel
59s -
max time network
55s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2024 15:02
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
-
Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
Processes:
flow ioc 10 https://www.manageengine.com/cookiepolicybanner.html -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exepid process 4568 msedge.exe 4568 msedge.exe 4880 msedge.exe 4880 msedge.exe 872 identity_helper.exe 872 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4880 wrote to memory of 2516 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 2516 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1328 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 4568 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 4568 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1120 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1120 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1120 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1120 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1120 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1120 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1120 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1120 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1120 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1120 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1120 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1120 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1120 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1120 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1120 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1120 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1120 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1120 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1120 4880 msedge.exe msedge.exe PID 4880 wrote to memory of 1120 4880 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.manageengine.com/cookiepolicybanner.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffd704a46f8,0x7ffd704a4708,0x7ffd704a47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2272,5649312296919139585,18149759422601040178,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2272,5649312296919139585,18149759422601040178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2272,5649312296919139585,18149759422601040178,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,5649312296919139585,18149759422601040178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,5649312296919139585,18149759422601040178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2272,5649312296919139585,18149759422601040178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2272,5649312296919139585,18149759422601040178,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,5649312296919139585,18149759422601040178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,5649312296919139585,18149759422601040178,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,5649312296919139585,18149759422601040178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,5649312296919139585,18149759422601040178,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,5649312296919139585,18149759422601040178,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1904 /prefetch:12⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5cbec32729772aa6c576e97df4fef48f5
SHA16ec173d5313f27ba1e46ad66c7bbe7c0a9767dba
SHA256d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e
SHA512425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5279e783b0129b64a8529800a88fbf1ee
SHA1204c62ec8cef8467e5729cad52adae293178744f
SHA2563619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932
SHA51232730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4e417436-ba0a-439d-a1a2-872f8054c3cb.tmpFilesize
6KB
MD525e9af325d97d4805493e5bfc57b72ec
SHA19ca4c17b8f636090c068f43477797c59a491699f
SHA256503f36cfb58c21af845a916f77a9b5f478997e4750d15aeb57ce110448aa989a
SHA5123bc6e4021ad86d8d2ab50260681791287745f37a966b07434018f93576d039ea8d55e10cf9d282df045cc73c6d5771fca40e5013eadb1eb714a90095e36b2767
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD517aa6d369e8a0e3c841f09da63f284f7
SHA127a7299162e41778a54687b3f2c8059ebb8585c0
SHA25620680ded45daa70ccfedd1a815bf102d36e8f7e068932eb36766e559ea8a1d3c
SHA512876835a05f09e073f7e48a4493cd465365e2800c95f8f62f48c9f9f9d106295139384dce11560a346fa78d74355ad69fc15ed41d20949ead5e3e6bddfeb1f108
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD520bdb94c6390d3b4a8271cde6a33fedc
SHA13cf68971a19111d7c38cfd5c2c635b37ef0902a8
SHA25656702f4b05eed9815e2826f6d3224597f04d26e1585e31dd2453095c2fad87ff
SHA51232946595d651a29f2f0b05be791f47ef7cf7edd58aa47d1678a8370f21b4523d488e20ca36c18ed95bd1b4e866af07c06d1b5a6767ffe380b04f0d12bfad82ac
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
708B
MD53e2f9913c3778a76289fab8e4f27c680
SHA158c511f3cce663937cb134512e617a2f57a2f376
SHA256c6f6abaa7ec83d75b95989078796255bcc79fe3e56c58d26cd5ec942b0620dd5
SHA512ffb4f68438987a2abcaa22a2fecc8a08e6fc90b02b553df542c8fc81386be46123c0b837974b5c3119870c3d5d420c4206a4b11929027685839a450ba4a02222
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5816de.TMPFilesize
204B
MD55b5ba51ef650f57dd32143ac72475037
SHA1fe1361f35fb3582ce70267e2e954aa4cb77b25dc
SHA2567a006abde880d2afb90e58fc443612db8bdef5f0da42ea4e83b9c0c8464cdc79
SHA512456673ad151d1c06e224f9672b99d8ef4d337c72a10596292692ff1bc30848a66d90f9142142821033ee552c7b84d8fab08917110323bb55d205af29b2e3b234
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD595619da7de89d9e8b81ae2670a1b7e3a
SHA162e9fd0e76bbc5b8d230f26c7ac91542f03cad46
SHA2568920527ce0c825a0ea74e3d578c901d794816a6357145c1effb7fa7a63f53bcd
SHA5126780e765e6b709039ffe076fbf8fb0296419e6ed5ad26b4f3b935ba5943a3fb1c5ce291baa53bca5bc83f78321c7aad3a78d63a93174c7139fe26892a98ee9ca
-
\??\pipe\LOCAL\crashpad_4880_CRYOAANISUUFZESHMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e