hxxps://edpuzzle[.]com

Analysis

max time kernel
600s
max time network
591s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 14:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://edpuzzle.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4208	identity_helper.exe
4208	identity_helper.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1988	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1988	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 1724	4536	msedge.exe	89
PID 4536 wrote to memory of 1724	4536	msedge.exe	89
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 4944	4536	msedge.exe	90
PID 4536 wrote to memory of 5040	4536	msedge.exe	91
PID 4536 wrote to memory of 5040	4536	msedge.exe	91
PID 4536 wrote to memory of 2440	4536	msedge.exe	92
PID 4536 wrote to memory of 2440	4536	msedge.exe	92
PID 4536 wrote to memory of 2440	4536	msedge.exe	92
PID 4536 wrote to memory of 2440	4536	msedge.exe	92
PID 4536 wrote to memory of 2440	4536	msedge.exe	92
PID 4536 wrote to memory of 2440	4536	msedge.exe	92
PID 4536 wrote to memory of 2440	4536	msedge.exe	92
PID 4536 wrote to memory of 2440	4536	msedge.exe	92
PID 4536 wrote to memory of 2440	4536	msedge.exe	92
PID 4536 wrote to memory of 2440	4536	msedge.exe	92
PID 4536 wrote to memory of 2440	4536	msedge.exe	92
PID 4536 wrote to memory of 2440	4536	msedge.exe	92
PID 4536 wrote to memory of 2440	4536	msedge.exe	92
PID 4536 wrote to memory of 2440	4536	msedge.exe	92
PID 4536 wrote to memory of 2440	4536	msedge.exe	92
PID 4536 wrote to memory of 2440	4536	msedge.exe	92
PID 4536 wrote to memory of 2440	4536	msedge.exe	92
PID 4536 wrote to memory of 2440	4536	msedge.exe	92
PID 4536 wrote to memory of 2440	4536	msedge.exe	92
PID 4536 wrote to memory of 2440	4536	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://edpuzzle.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6ae546f8,0x7ffd6ae54708,0x7ffd6ae54718
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,2840335147372265563,3046579934162115960,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,2840335147372265563,3046579934162115960,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,2840335147372265563,3046579934162115960,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2840335147372265563,3046579934162115960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2840335147372265563,3046579934162115960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2028,2840335147372265563,3046579934162115960,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4200 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,2840335147372265563,3046579934162115960,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,2840335147372265563,3046579934162115960,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2840335147372265563,3046579934162115960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2840335147372265563,3046579934162115960,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2840335147372265563,3046579934162115960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2840335147372265563,3046579934162115960,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,2840335147372265563,3046579934162115960,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4916 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2444

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x448 0x338
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f35bb0615bb9816f562b83304e456294

SHA1
1049e2bd3e1bbb4cea572467d7c4a96648659cb4

SHA256
05e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71

SHA512
db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1eb86108cb8f5a956fdf48efbd5d06fe

SHA1
7b2b299f753798e4891df2d9cbf30f94b39ef924

SHA256
1b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40

SHA512
e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
864B

MD5
1873aaf8bd23294fd889bf3cda0a0c77

SHA1
f5b471effe7e6344f108fb5ed0ec0d37109987ee

SHA256
924dbdecdc03df5137c945da81147b4dc739a8103578d9fd24b722ebdedb2733

SHA512
169b4475140b3908a7734428b4300b33ff3fc9ce8f7bed007b4b805f3f38ede870205ae60275c6e62c6b8594601c64cc5065e028137006ebad6333e08eccf033

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
99c08fc8295a7b52d07ad695bca53b54

SHA1
f25eb45a620cd3b7b344b026ca7a057195727160

SHA256
9862f0818f1668c89b24e3031738b3c977882aa7f3d6a0e1d317e956f11008f6

SHA512
2c09b8833b433a6178dd2868b6b4790491f9a904b6519b281a561ba9997e7a67d2bc35cc332f1c33284dbbaa6bf3ff91c7736f53516d054ed887ed0492a3f228

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
be429a0e19af9918532a35d5da73747d

SHA1
ecda6e51ee9632ae81c809028379349f0e9dbaf6

SHA256
161ebd76c419f7e6a868b42534ee15a4dc359156c81774bfe6c85542fc041fd1

SHA512
114f0c614ff2fd732887e811566e59b17e0e56c2524bde2d3258caac8267ff2576ae3376208062d9e88207271401082dc831736b81247140087e2d7a7f623652

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
05144e3d31affb9b79a5b7af545ee68c

SHA1
c4eb193914376ad930c4abb5265197b287c46eb7

SHA256
3b8f2c7fc39afb8af734b86af04da1891f0b17e077fb32abccf762fe37eac510

SHA512
6eaaafe85b81d9d00b0fb1f1c8fd7c78bf3b5403058e77aae82e363130870f8273738b8441143b06bfa1ea86ebb8c4ddffc1dd2b376cd92817945c4701c4ab85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
03eaa81ac01b9008694e0e3319e1dcdb

SHA1
a10e907a1065f43e7a04db69a0f82dadb157520e

SHA256
6e015acd6190cce541caa2ef6a610a411f2511468c71ba1f637559043414d657

SHA512
02f716e5c48e172671187b99e4199613ca39345ec81ec0e9f99accfa2bc0c92bdb5fe60bdd57f77b9e4ba72e964316f585b23232094c11eadd900144b1002fbe

Download Submit