Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11-04-2024 05:26
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
-
Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
Processes:
flow ioc 12 https://df.onecloud.azure-test.net/Error/UE_404?shown=true -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 3716 msedge.exe 3716 msedge.exe 2884 msedge.exe 2884 msedge.exe 2712 identity_helper.exe 2712 identity_helper.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe 1036 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe 2884 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 2884 wrote to memory of 2504 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2504 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 2440 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 3716 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 3716 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 4776 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 4776 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 4776 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 4776 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 4776 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 4776 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 4776 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 4776 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 4776 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 4776 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 4776 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 4776 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 4776 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 4776 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 4776 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 4776 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 4776 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 4776 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 4776 2884 msedge.exe msedge.exe PID 2884 wrote to memory of 4776 2884 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://assets-gbr.mkt.dynamics.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc8b3d46f8,0x7ffc8b3d4708,0x7ffc8b3d47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,1498344875837797804,9931707497139957539,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,1498344875837797804,9931707497139957539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,1498344875837797804,9931707497139957539,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,1498344875837797804,9931707497139957539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,1498344875837797804,9931707497139957539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,1498344875837797804,9931707497139957539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,1498344875837797804,9931707497139957539,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,1498344875837797804,9931707497139957539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,1498344875837797804,9931707497139957539,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,1498344875837797804,9931707497139957539,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,1498344875837797804,9931707497139957539,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,1498344875837797804,9931707497139957539,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3032 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57c6136bc98a5aedca2ea3004e9fbe67d
SHA174318d997f4c9c351eef86d040bc9b085ce1ad4f
SHA25650c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2
SHA5122d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD55c6aef82e50d05ffc0cf52a6c6d69c91
SHA1c203efe5b45b0630fee7bd364fe7d63b769e2351
SHA256d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32
SHA51277ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
271B
MD536266d2ed2edb3f22b059b97207eb0d4
SHA1243b9ef105f4f135ffe7153c584fd7d673f7b76a
SHA256a31640ae87311fcacf3305e020698ac14d2ceda74349c1ed9aaca4906f55016d
SHA5123941fb75b886d34ebaa4368bbb4a6132e5caf55f2bdd091a77d08d4555cda8d56f35473a9ad8cafb554ef4cc06fdf2f2e49ab5a940cbaa493bea87a65629bf0e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD52fe86e76cd4c3c8dac4595b966ab4d52
SHA1183918ad0a55ab36efb6da7b150775d17583bf65
SHA25698dd259d28d2c47f2ae97bfbd8a0922be1e2c7d6bd075efb5862a9ab00d544f2
SHA51298012bf56dc5be8082afa70f78e303c5a9d0dcd7d5ea29728765b985f059077ef0b16517ca9b712dedf8beb69d4d28e16b90a9cb02e526c6acba02798a046d8a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5a376750a418ffb51bd0a0225cabb72be
SHA1f14c59d9ca30a6eb9071a939b14b56b94a6d7b51
SHA256687b817e98af398a1d8f41935aff379de4d55ca5ded9ad427fbe418e06c8d921
SHA512594ece4c5f08a3256e6495f67c8253d81fc5ba6f79986eea94c165529c63d4ce441c3dfc5bc6238669f6f11beebec639563a7c10ee9986c497ce60f63588d5c3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD58e63720041c320d043fde7af3df0720e
SHA1b3779e55f26703fd05c6debbb79f919ee7b7996d
SHA256480151d5cb9d1bc0300311bbd9975c84cfcbeacbd7b979014d475373b0e16741
SHA5125517eafae7250169bdaf3d6e90550eb7b6d7497996f7e4bd4794e7fd37a5dba5364619e0d293b1432539f858aa666c87fa1da83cad5a20d30278453d0ee2a9a9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5d687ebaff28d594a3261efd042d2479e
SHA15769d5a9cefe97517e58e6b14dc32032a2dce013
SHA256235666516d40e93a36581508bf38aa82e252cfe4a4963845689fff26ce12fd53
SHA512bd0fa82ff3d3cc9918f715f1ddf20b5ff407ad1340fde46e585e28022015bb0919d3eb9efc489b6dd602ac9fd323912e33a807e79a1a8671b9ec7e35e3f635a8
-
\??\pipe\LOCAL\crashpad_2884_BAGUCOIZXRSZRVLXMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e