bcc8812a2385f7a4db7d7633eb5ce0770e5cc3b5093873fd3e0a7c239f8daa1d

Resubmissions

11/04/2024, 06:06

240411-gt1pxagh4y 7

11/04/2024, 05:53

11/04/2024, 05:51

11/04/2024, 05:48

11/04/2024, 05:44

11/04/2024, 05:39

Analysis

max time kernel
148s
max time network
163s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
11/04/2024, 05:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/app/cmp.html
Size

5KB
MD5

d7b8b31b190e552677589cfd4cbb5d8e
SHA1

09ffb3c63991d5c932c819393de489268bd3ab88
SHA256

6c21e8c07ce28327dca05f873d73fe85d5473f9b22a751a4d3d28931f5d0c74f
SHA512

32794507a4b9a12e52ceb583222cb93300e38c634a72ea3f51a0189127aba60cf476fb7918942355a4f826185d7071e876cb40348ba34cf5d1ca7e9546ccb310
SSDEEP

48:t9rc0/GLAoShbEHaLKNGiNQtvmolOGR36tgtr/GTvJP8AscaV4LiMt7ByBZXGz+p:4VLjHa2NGiivmmpWsBVutFwAk5vSG

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4400	msedge.exe
4400	msedge.exe
2984	msedge.exe
2984	msedge.exe
5060	identity_helper.exe
5060	identity_helper.exe
3672	msedge.exe
3672	msedge.exe
352	msedge.exe
352	msedge.exe
352	msedge.exe
352	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 4940	2984	msedge.exe	77
PID 2984 wrote to memory of 4940	2984	msedge.exe	77
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 2424	2984	msedge.exe	78
PID 2984 wrote to memory of 4400	2984	msedge.exe	79
PID 2984 wrote to memory of 4400	2984	msedge.exe	79
PID 2984 wrote to memory of 3856	2984	msedge.exe	80
PID 2984 wrote to memory of 3856	2984	msedge.exe	80
PID 2984 wrote to memory of 3856	2984	msedge.exe	80
PID 2984 wrote to memory of 3856	2984	msedge.exe	80
PID 2984 wrote to memory of 3856	2984	msedge.exe	80
PID 2984 wrote to memory of 3856	2984	msedge.exe	80
PID 2984 wrote to memory of 3856	2984	msedge.exe	80
PID 2984 wrote to memory of 3856	2984	msedge.exe	80
PID 2984 wrote to memory of 3856	2984	msedge.exe	80
PID 2984 wrote to memory of 3856	2984	msedge.exe	80
PID 2984 wrote to memory of 3856	2984	msedge.exe	80
PID 2984 wrote to memory of 3856	2984	msedge.exe	80
PID 2984 wrote to memory of 3856	2984	msedge.exe	80
PID 2984 wrote to memory of 3856	2984	msedge.exe	80
PID 2984 wrote to memory of 3856	2984	msedge.exe	80
PID 2984 wrote to memory of 3856	2984	msedge.exe	80
PID 2984 wrote to memory of 3856	2984	msedge.exe	80
PID 2984 wrote to memory of 3856	2984	msedge.exe	80
PID 2984 wrote to memory of 3856	2984	msedge.exe	80
PID 2984 wrote to memory of 3856	2984	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app\cmp.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffded493cb8,0x7ffded493cc8,0x7ffded493cd8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,14891616062109292119,2555300751065909104,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,14891616062109292119,2555300751065909104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,14891616062109292119,2555300751065909104,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,14891616062109292119,2555300751065909104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,14891616062109292119,2555300751065909104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,14891616062109292119,2555300751065909104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,14891616062109292119,2555300751065909104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,14891616062109292119,2555300751065909104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,14891616062109292119,2555300751065909104,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,14891616062109292119,2555300751065909104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,14891616062109292119,2555300751065909104,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,14891616062109292119,2555300751065909104,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5008 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c48e8b68231fb5b2d7f1188b930bc0e

SHA1
1822aef5da8fdd47626fb91afcf79a2be175a325

SHA256
c3b287c29eaa57166b2ab1ba9bd0aaced13cc2f946a04b8d708ac429187fe944

SHA512
2bd09b83e44e0104fbe080a8573690217dc9fbf7fd59ff25a1a9e9ebd2d87ac533f9b99350773d081a7e748b39657115a13e94538b153bceb13ecdfc4672a0f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f2dc80f5403feb8461b7ffa09890d6a0

SHA1
d5b61e6d672e7e71571e0132e21cead181da8805

SHA256
eadeadba37eed18e5acba408d7e076270b00403fed372b77164577232232428a

SHA512
5e2119529b99b76be105c43714e4b9977ee2147172c1c44e92bd9b41fa7a66f55d4073c864aac668a912aff2898bd216fb38f2fe34ef65de69ad12965218caf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
309B

MD5
62c01adc1a9deb61bb41b24e1a50100a

SHA1
2cce45def0d412b0836b6655c2b0e20d97f38919

SHA256
ca0cf0c49499a6cc9edb412ee97fdd98d3f1ee1edfc07cb216081040acfda7e0

SHA512
0358121bd4bd696e2b974fc7735fe6d23a56ba98276143d0e9f3f73a5d1a8593a139a5dc62a0fa014b8c7c17a97ed1b25fcb7589aa4dea83429bef84d80072ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e32dea787272f95f5db62770a845a859

SHA1
6bc25b9aad8f92223ae68d98c154b620373fb93b

SHA256
3b1584de84968aeb27ce4c5b00630cea3f88861725f01aeaf4d18cb13a8e6592

SHA512
7f6480a7e72a03778965ffc1b73a9d41a6b94a5a1d943c994e1e446aef9658a6965415d85553430a1395a6fe4a417dc2ad65a9284cff8621eb67b927cbbefadd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
df3c108cf2829b303b804292149c5801

SHA1
7e1581de35da86611cae654e5eb600f71f3588e9

SHA256
ed15281e93a69b7671d85afd1f3dcd958c6518e458d191b4c8b822d4190d00b1

SHA512
6515ce69e64628a5d2cf7dd3f60e5630f1f0caaa029793a9e3664843fa9cfda80291912d2e4e3ee6dc10981052ea23c6d650c1b937c3fec839626ac3d3a0dae8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5d033ed2c87cba89f8dc3d0fb84afb8a

SHA1
72dea3573cbc9d8aeb26f1da26fdf5c9f8926318

SHA256
3cffb00c3abf38daceccb2269ee7169a2021d07d4ad5462f569d193be4b4dc63

SHA512
21e6ff89fdb5365943f52f5bcc43e321b852760ccc180ca7f4343e77c50f1b41413e3e3055aa46dd3dcad3e520752f6c40c03c29ad3cfb61f6d4796b761a588b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3a2e72c9e2f77457f8dc25e12d5099a0

SHA1
b8fb1ee34a0f4177313d065e12bc161a46363cd9

SHA256
39a48838e59751174d0e32593ee2178bd7015b49f4a678657925e9bf57626d9b

SHA512
14b34edc1d3024e518a3cd8a7fe9c3fbac890abf9936a3477fb70d7f4d08f218f79fb54d547e03c4cc24bec5e4996ef0c5e3c2fcdc677ed203de3aa0deb3853e

Download Submit