126df6858318cf72d7cdf75446847432a493790a757f9485aedcda184f22cafc

Resubmissions

09/04/2024, 11:11

240409-nafzqade69 10

09/04/2024, 11:10

240409-m972tade64 1

09/04/2024, 11:10

240409-m9xk3sde54 1

Analysis

max time kernel
148s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
09/04/2024, 11:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

search.html
Size

88KB
MD5

d1e188b1bd7094c8a678f41de9d16415
SHA1

8f0b5c5bbddadbe3e60c633eecaba5b0b70b3270
SHA256

126df6858318cf72d7cdf75446847432a493790a757f9485aedcda184f22cafc
SHA512

74501599574c0626d74ad676e8e54c2989109858ee80a197f9ae4953784f2a65e4c737d47b48737a1dbb37ed847f672c8e000ce55690281afc27b3b37f8fbb85
SSDEEP

1536:LUIy24fJIZDyMQCdl/J4RtX8aHN9oEYZw3xnP5VSEVHDo0Gp2n1sF8WgjVZuHcq1:Lm2Vdl/J4R5JHN9oEYZEx5LC8W8FPsF

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4100	msedge.exe
4100	msedge.exe
2584	msedge.exe
2584	msedge.exe
2192	msedge.exe
2192	msedge.exe
4704	identity_helper.exe
4704	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 1676	2584	msedge.exe	79
PID 2584 wrote to memory of 1676	2584	msedge.exe	79
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 2188	2584	msedge.exe	81
PID 2584 wrote to memory of 4100	2584	msedge.exe	82
PID 2584 wrote to memory of 4100	2584	msedge.exe	82
PID 2584 wrote to memory of 3400	2584	msedge.exe	83
PID 2584 wrote to memory of 3400	2584	msedge.exe	83
PID 2584 wrote to memory of 3400	2584	msedge.exe	83
PID 2584 wrote to memory of 3400	2584	msedge.exe	83
PID 2584 wrote to memory of 3400	2584	msedge.exe	83
PID 2584 wrote to memory of 3400	2584	msedge.exe	83
PID 2584 wrote to memory of 3400	2584	msedge.exe	83
PID 2584 wrote to memory of 3400	2584	msedge.exe	83
PID 2584 wrote to memory of 3400	2584	msedge.exe	83
PID 2584 wrote to memory of 3400	2584	msedge.exe	83
PID 2584 wrote to memory of 3400	2584	msedge.exe	83
PID 2584 wrote to memory of 3400	2584	msedge.exe	83
PID 2584 wrote to memory of 3400	2584	msedge.exe	83
PID 2584 wrote to memory of 3400	2584	msedge.exe	83
PID 2584 wrote to memory of 3400	2584	msedge.exe	83
PID 2584 wrote to memory of 3400	2584	msedge.exe	83
PID 2584 wrote to memory of 3400	2584	msedge.exe	83
PID 2584 wrote to memory of 3400	2584	msedge.exe	83
PID 2584 wrote to memory of 3400	2584	msedge.exe	83
PID 2584 wrote to memory of 3400	2584	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\search.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffebdcf3cb8,0x7ffebdcf3cc8,0x7ffebdcf3cd8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,17596357609472332270,3173487462544417415,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,17596357609472332270,3173487462544417415,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,17596357609472332270,3173487462544417415,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17596357609472332270,3173487462544417415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17596357609472332270,3173487462544417415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17596357609472332270,3173487462544417415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17596357609472332270,3173487462544417415,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17596357609472332270,3173487462544417415,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,17596357609472332270,3173487462544417415,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,17596357609472332270,3173487462544417415,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,17596357609472332270,3173487462544417415,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,17596357609472332270,3173487462544417415,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:4140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
caaacbd78b8e7ebc636ff19241b2b13d

SHA1
4435edc68c0594ebb8b0aa84b769d566ad913bc8

SHA256
989cc6f5cdc43f7bac8f6bc10624a47d46cbc366c671c495c6900eabc5276f7a

SHA512
c668a938bef9bbe432af676004beb1ae9c06f1ba2f154d1973e691a892cb39c345b12265b5996127efff3258ebba333847df09238f69e95f2f35879b5db7b7fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c194bbd45fc5d3714e8db77e01ac25a

SHA1
e758434417035cccc8891d516854afb4141dd72a

SHA256
253f8f4a60bdf1763526998865311c1f02085388892f14e94f858c50bf6e53c3

SHA512
aca42768dcc4334e49cd6295bd563c797b11523f4405cd5b4aeb41dec9379d155ae241ce937ec55063ecbf82136154e4dc5065afb78d18b42af86829bac6900d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
178B

MD5
f309294e637a5b79d379ed0bfb81fd2c

SHA1
89d52c028287b1cc474bfeb72fb6f22aed87d6ff

SHA256
c1d5e96c856cf9fb693dc5bc048e83c50558a70dd9d1da5ee2b805b0ab67b121

SHA512
5eed662eac92135444d2a3217c6a0759e9e81f633633043ff18a52747e81931bb7a9c546c04925c4497869bc144f47ce9f4a5ea5a96909d9127ae7feb2f23176

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a6495c7066627c4345bfdfbb52832a35

SHA1
84b814b20a29fbd05ab56a5cfdc96f076015494d

SHA256
56a6136271fea80365f12fad75ce727763097f6b5a4993c4b87247ee953da978

SHA512
9c64ea019c89202e51b605c9d77a3b6bffa049ba07c5f34f9eedb5e5f880940f12e8e279005672ccf1d79c8f7789d8bededaaaa499de446a9fed02eb3f8f3770

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2ba0f297d2987e2b64bb9199e196ce53

SHA1
6917e1e8bda7dc83d4c6ed2a101eb0b08bf21e11

SHA256
0febafcf50c88bdba78c59b97faeebdfe75b93febe195612624d43af59ec86a5

SHA512
e4c9a6636c698e7d34d1853a5f5cabe43f5e585b70892942d29bf20e8ec8adb74705fe4669eb2dfbdcf04c45d28373cf46bc29951ea304b7faa0772019a473b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
68343b720328afc8f026da1d677e1187

SHA1
a4bbb1418f14ded67dfd839914d438b0bd0f60eb

SHA256
08754ecc1da0b7bdfc3128d700133d6423fe912aa15a85b32d154b8e079eec6d

SHA512
93e7d261031bd4bb1607678dd780327db25d6b05cfc99954b46cc3fee91b80104f1f1eda95ce18887b6d2ea911db388ef95f3dd4f4f3d7b4a03a2f6b81f83084

Download Submit