0ff0224edb6a27b5c23adc7fb759864bb3c645f2cf2f38d0a0290c1fa691fdd2

Analysis

max time kernel
145s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 14:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WaveTrial/dist/client/index.html
Size 642B
Sample240409-rntphscf6x
SHA256 4988e09362697dd88b69e9185f884145ac1b939c1e883855dad7b80479465c17
MD5 dc0297e1499d6be4efc3d519623623d9
SHA1 3babddcfc55a2e33f4f21bedd8d15097fe26e8dd
SHA512 7dbcdcf74a4569b2d188b5ffca867db82acaddabf3c7ba184c62250cbcc375475f31a89607d799021be918dfdf76b5b7a215a87e1a7a157a433f1b8c21f5f61b
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
1172	msedge.exe
1172	msedge.exe
380	identity_helper.exe
380	identity_helper.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe
1172	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 4584	1172	msedge.exe	85
PID 1172 wrote to memory of 4584	1172	msedge.exe	85
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4916	1172	msedge.exe	86
PID 1172 wrote to memory of 4352	1172	msedge.exe	87
PID 1172 wrote to memory of 4352	1172	msedge.exe	87
PID 1172 wrote to memory of 2212	1172	msedge.exe	88
PID 1172 wrote to memory of 2212	1172	msedge.exe	88
PID 1172 wrote to memory of 2212	1172	msedge.exe	88
PID 1172 wrote to memory of 2212	1172	msedge.exe	88
PID 1172 wrote to memory of 2212	1172	msedge.exe	88
PID 1172 wrote to memory of 2212	1172	msedge.exe	88
PID 1172 wrote to memory of 2212	1172	msedge.exe	88
PID 1172 wrote to memory of 2212	1172	msedge.exe	88
PID 1172 wrote to memory of 2212	1172	msedge.exe	88
PID 1172 wrote to memory of 2212	1172	msedge.exe	88
PID 1172 wrote to memory of 2212	1172	msedge.exe	88
PID 1172 wrote to memory of 2212	1172	msedge.exe	88
PID 1172 wrote to memory of 2212	1172	msedge.exe	88
PID 1172 wrote to memory of 2212	1172	msedge.exe	88
PID 1172 wrote to memory of 2212	1172	msedge.exe	88
PID 1172 wrote to memory of 2212	1172	msedge.exe	88
PID 1172 wrote to memory of 2212	1172	msedge.exe	88
PID 1172 wrote to memory of 2212	1172	msedge.exe	88
PID 1172 wrote to memory of 2212	1172	msedge.exe	88
PID 1172 wrote to memory of 2212	1172	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\WaveTrial\dist\client\index.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe62b346f8,0x7ffe62b34708,0x7ffe62b34718
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,10355832124497605947,4710557168913800841,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,10355832124497605947,4710557168913800841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,10355832124497605947,4710557168913800841,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10355832124497605947,4710557168913800841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10355832124497605947,4710557168913800841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,10355832124497605947,4710557168913800841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,10355832124497605947,4710557168913800841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10355832124497605947,4710557168913800841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10355832124497605947,4710557168913800841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10355832124497605947,4710557168913800841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10355832124497605947,4710557168913800841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,10355832124497605947,4710557168913800841,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4768 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc
MD5 9ffb5f81e8eccd0963c46cbfea1abc20
SHA1 a02a610afd3543de215565bc488a4343bb5c1a59
SHA512 2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60
MD5 e1b45169ebca0dceadb0f45697799d62
SHA1 803604277318898e6f5c6fb92270ca83b5609cd5
SHA512 357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 54902486934c090a767105984397fed2f5a46dd181e25fd414af5f3c68d9d491
MD5 3bb7a5175ec533dae4c9c69452e3d551
SHA1 5a1235c034ac090a70c8734b67d960a34162a7f6
SHA512 2cbac58ba58000e4b8de3a539f17795f67ec7075b802aed84fdc50e1623e3e7e447bcd2f540c261efe09eed03e686aacdc6c30f75548a8272c932a8aef1a0866
SSDEEP 96:nmAk04F1YOwpvWMoiVmdeHOHTsYUWQyV+VD7ziEwb:nmAkRmOGWMXET9rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 2c23e3afc511f46ab1b9c699930be56eb67ce51672167481d0f2cd0395d8abd6
MD5 a53624b5493890394f76565f0d976b1e
SHA1 0f8b2df3ac76239cfe32a64e44b56c3da04839d4
SHA512 70bdbf54dd12f947e013975e76fa838c82816f3e0f825b97c47b00c526664ce22f8e1b7f15dbe4c4a9ec9c49fdee4a9d575703e15b6830e87d6d5bb828e34d18
SSDEEP 96:nmAkf4F1YOwpvWMoiVmdeHOHTsYUWQyV+VD7AiEwb:nmAkomOGWMXET9rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 532f28a073657e0e345ae73f8f6c4f18b8344acda831fde4f8ce7066baeea06e
MD5 2b8459d235858d612ee0a1099454f48f
SHA1 28aa1cfc056e32a4a6323bd795a1ec83577cf871
SHA512 0831da90479adbae0d388f0118e5db0caf27b0ccd7db739fe03cc80674cb94461a78cb9cea48395a74b2dc7028c86cee1f2d0fa2b404f2842403bdd2b89f684f
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupXe2RURybROxvFt2pTEEjx+:A9iIxuERzA83h09RZxYfzOTt2h3Cow
MD5 SHA1 SHA512 SSDEEP

Submit Download