c8b514c3f087a82fe2d755bc65404e59e14a45fb9c737e08eeccb8f89cf74a62

Analysis

max time kernel
147s
max time network
159s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
07/04/2024, 19:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 6.5MB
Sample240407-yft4mscf4x
SHA256 0bfa9a636e722107b6192ff35c365d963a54e1de8a09c8157680e8d0fbbfba1c
MD5 180f8acc70405077badc751453d13625
SHA1 35dc54acad60a98aeec47c7ade3e6a8c81f06883
SHA512 40d3358b35eb0445127c70deb0cb87ec1313eca285307cda168605a4fd3d558b4be9eb24a59568eca9ee1f761e578c39b2def63ad48e40d31958db82f128e0ec
SSDEEP 24576:d7rs5kjWSnB3lWNeUmf0f6W6M6q6A6r/HXpErpem:rovj
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4476	msedge.exe
4476	msedge.exe
1340	msedge.exe
1340	msedge.exe
2212	identity_helper.exe
2212	identity_helper.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 3948	4476	msedge.exe	78
PID 4476 wrote to memory of 3948	4476	msedge.exe	78
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 3648	4476	msedge.exe	79
PID 4476 wrote to memory of 4708	4476	msedge.exe	80
PID 4476 wrote to memory of 4708	4476	msedge.exe	80
PID 4476 wrote to memory of 3508	4476	msedge.exe	81
PID 4476 wrote to memory of 3508	4476	msedge.exe	81
PID 4476 wrote to memory of 3508	4476	msedge.exe	81
PID 4476 wrote to memory of 3508	4476	msedge.exe	81
PID 4476 wrote to memory of 3508	4476	msedge.exe	81
PID 4476 wrote to memory of 3508	4476	msedge.exe	81
PID 4476 wrote to memory of 3508	4476	msedge.exe	81
PID 4476 wrote to memory of 3508	4476	msedge.exe	81
PID 4476 wrote to memory of 3508	4476	msedge.exe	81
PID 4476 wrote to memory of 3508	4476	msedge.exe	81
PID 4476 wrote to memory of 3508	4476	msedge.exe	81
PID 4476 wrote to memory of 3508	4476	msedge.exe	81
PID 4476 wrote to memory of 3508	4476	msedge.exe	81
PID 4476 wrote to memory of 3508	4476	msedge.exe	81
PID 4476 wrote to memory of 3508	4476	msedge.exe	81
PID 4476 wrote to memory of 3508	4476	msedge.exe	81
PID 4476 wrote to memory of 3508	4476	msedge.exe	81
PID 4476 wrote to memory of 3508	4476	msedge.exe	81
PID 4476 wrote to memory of 3508	4476	msedge.exe	81
PID 4476 wrote to memory of 3508	4476	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb74663cb8,0x7ffb74663cc8,0x7ffb74663cd8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,16594337270489061659,16855143672689735641,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,16594337270489061659,16855143672689735641,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,16594337270489061659,16855143672689735641,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,16594337270489061659,16855143672689735641,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,16594337270489061659,16855143672689735641,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,16594337270489061659,16855143672689735641,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4512 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,16594337270489061659,16855143672689735641,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1872,16594337270489061659,16855143672689735641,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,16594337270489061659,16855143672689735641,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,16594337270489061659,16855143672689735641,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1872,16594337270489061659,16855143672689735641,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,16594337270489061659,16855143672689735641,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5344 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c3b287c29eaa57166b2ab1ba9bd0aaced13cc2f946a04b8d708ac429187fe944
MD5 5c48e8b68231fb5b2d7f1188b930bc0e
SHA1 1822aef5da8fdd47626fb91afcf79a2be175a325
SHA512 2bd09b83e44e0104fbe080a8573690217dc9fbf7fd59ff25a1a9e9ebd2d87ac533f9b99350773d081a7e748b39657115a13e94538b153bceb13ecdfc4672a0f8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 eadeadba37eed18e5acba408d7e076270b00403fed372b77164577232232428a
MD5 f2dc80f5403feb8461b7ffa09890d6a0
SHA1 d5b61e6d672e7e71571e0132e21cead181da8805
SHA512 5e2119529b99b76be105c43714e4b9977ee2147172c1c44e92bd9b41fa7a66f55d4073c864aac668a912aff2898bd216fb38f2fe34ef65de69ad12965218caf5
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 25bcc9b5dd1216e6a855b874b2e28fdf3d7e3bab4490e6e22d839c6f8d728cbe
MD5 d50fab4f191f0582ba580bd8c2ec6636
SHA1 7ed0a80d9d43630f59b88508663dc21d5b38b5a0
SHA512 23eb4c0a5bf579993472d63fb3bc09d6e1575142cdac8c6bd8dd97166cf811060d62cf3df4bc9e3ba8f771ecefc8fa8144674719c934072b8ddfb6b36a176c3d
SSDEEP 96:n/k3Nt0gUk5wSv0MoiVmdHIkJW70WQyV+VpziX3wI3:n/k3NC5k5v0MAIi2Lx93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 fc411ca391d91cd2c3012f8c2e4fed1a0a9726ab350bb7ca8447ba3259c8f8b7
MD5 f32a1636fd775617d65fcf35e84c5d0a
SHA1 6bc6a2953d66d39a4bf8c60a6f8b8fa5bac0473f
SHA512 0eb37af5c3c59e95d1a61af2d6ac3e3efb0897bb0720eeebf82f31197e14bd1c890d88f53b272a646011d47d5c2af99be8ab70c5d2cd2f872c7196e559dbccdc
SSDEEP 96:n/k3Nq0gUkXwSv0MoiVmdHIkJW70WQyV+VpAiX3wI3:n/k3Nl5kXv0MAIi2Le93
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 01636fae3192485dacc97b07293bd30e9cef95b016b0117f3d4f6eb018c6b728
MD5 b3b3b827849457196cb3f397b0443645
SHA1 92e6daa8f371d741582e32f12d4ccad8c0e1457a
SHA512 108e9986e2e3da6a4d47218637435625ff2513105bfc7a5c960f53a5607ed3ae3a7a2f334bd9e017de4a84b80c000835dbfb635666a45b3ea69f1185b1ee8d85
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG6ae2RUiSR7zPI7+gbmDOHSqA:M9iIxuERzA83h09RZxASGJLCjI7bmqHy
MD5 SHA1 SHA512 SSDEEP

Submit Download