4b7abdcb2c958a551b20d87025adb7bcb12ab3fe5f063c5b10461c775e7aab8b

Analysis

max time kernel
145s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 19:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Samples/VC/TestApp.html
Size

2KB
MD5

aed787ef99ae1d65ab810f75406e7b6e
SHA1

8b23f7bd25122289c4ba6aa69d1926e17c885113
SHA256

a8c9b63a32597c36dec41b97fa0d945ff320f885b576dd27c43814fdd446e56f
SHA512

534a84a250d44a871fd885ca100c8f9170d587872e1bc34b05f5b75b7ba3e12140bd430c9fe7318307d9a9ea17dfacbda486bcdc73f0f00d960aa6ca3b9acd72

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2604	msedge.exe
2604	msedge.exe
3944	msedge.exe
3944	msedge.exe
4988	identity_helper.exe
4988	identity_helper.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 4240	3944	msedge.exe	84
PID 3944 wrote to memory of 4240	3944	msedge.exe	84
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2684	3944	msedge.exe	85
PID 3944 wrote to memory of 2604	3944	msedge.exe	86
PID 3944 wrote to memory of 2604	3944	msedge.exe	86
PID 3944 wrote to memory of 1200	3944	msedge.exe	87
PID 3944 wrote to memory of 1200	3944	msedge.exe	87
PID 3944 wrote to memory of 1200	3944	msedge.exe	87
PID 3944 wrote to memory of 1200	3944	msedge.exe	87
PID 3944 wrote to memory of 1200	3944	msedge.exe	87
PID 3944 wrote to memory of 1200	3944	msedge.exe	87
PID 3944 wrote to memory of 1200	3944	msedge.exe	87
PID 3944 wrote to memory of 1200	3944	msedge.exe	87
PID 3944 wrote to memory of 1200	3944	msedge.exe	87
PID 3944 wrote to memory of 1200	3944	msedge.exe	87
PID 3944 wrote to memory of 1200	3944	msedge.exe	87
PID 3944 wrote to memory of 1200	3944	msedge.exe	87
PID 3944 wrote to memory of 1200	3944	msedge.exe	87
PID 3944 wrote to memory of 1200	3944	msedge.exe	87
PID 3944 wrote to memory of 1200	3944	msedge.exe	87
PID 3944 wrote to memory of 1200	3944	msedge.exe	87
PID 3944 wrote to memory of 1200	3944	msedge.exe	87
PID 3944 wrote to memory of 1200	3944	msedge.exe	87
PID 3944 wrote to memory of 1200	3944	msedge.exe	87
PID 3944 wrote to memory of 1200	3944	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Samples\VC\TestApp.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe963946f8,0x7ffe96394708,0x7ffe96394718
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,1039457233987261781,11818022902382609337,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,1039457233987261781,11818022902382609337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,1039457233987261781,11818022902382609337,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1039457233987261781,11818022902382609337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1039457233987261781,11818022902382609337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,1039457233987261781,11818022902382609337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,1039457233987261781,11818022902382609337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1039457233987261781,11818022902382609337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1039457233987261781,11818022902382609337,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1039457233987261781,11818022902382609337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1039457233987261781,11818022902382609337,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,1039457233987261781,11818022902382609337,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3108 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:64

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d6e17218d9a99976d1a14c6f6944c96

SHA1
9e54a19d6c61d99ac8759c5f07b2f0d5faab447f

SHA256
32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93

SHA512
3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d5d4bdfc9fd4d729010dec76815ec035

SHA1
1ebc904f954b2c8b51e0362f731800c4677ce215

SHA256
7f37b10a3668b2e847ff59d6d6f6990a373306f53b1cbbc710e9b59d6bb84e5f

SHA512
4066594707c07ad6e17c4b9d1330ad49343bb9aa0b1e06d471492e949cf81a64e3ccba3d207802492e3fb8a39e1621f4ef3da80b5671c1c31e45909427cabaa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2c5e9771cae7daa364cc576353391998

SHA1
ac79886ef109732dda48223051cbb14b319bfb11

SHA256
bdf5ab74f01240c301589879cc86e4f2fba9e84274d3252e730ced254d7d359a

SHA512
94721d7b8abe3159c493aba1bd3ba1de920bf425839066987fc35cdcb348ccf95acf375f8a43cd52cde42b9a113160fbf33bcf62b83e2e6b7f53544c465b569d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
c2ef1d773c3f6f230cedf469f7e34059

SHA1
e410764405adcfead3338c8d0b29371fd1a3f292

SHA256
185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521

SHA512
2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1f41ccc3a1e759bfd7697cbb8ef2a0bc

SHA1
8e7f697b5526bd1518edb18fbed10789d515d321

SHA256
8ca3bd281d400513cb56372a8d98b652fd8beb673bd223ac519c8df4c5a0cf20

SHA512
d878fb7578e3b7167a2b1c62ac4239482208e53bb6ff8b711ea72843555961e2e1dbc58d0e6b447fdbbff2d379d1f9972a5a6b8bbd9296a6e683465012f7a6cf

Download Submit