bcc8812a2385f7a4db7d7633eb5ce0770e5cc3b5093873fd3e0a7c239f8daa1d

Resubmissions

11/04/2024, 06:06

240411-gt1pxagh4y 7

11/04/2024, 05:53

11/04/2024, 05:51

11/04/2024, 05:48

11/04/2024, 05:44

11/04/2024, 05:39

Analysis

max time kernel
149s
max time network
162s
platform
windows11-21h2_x64
resource
win11-20240319-en
resource tags

arch:x64arch:x86image:win11-20240319-enlocale:en-usos:windows11-21h2-x64system
submitted
11/04/2024, 05:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/app/index.html
Size

20KB
MD5

6d8c9edde0ce101ce0abd73be45c684a
SHA1

ce6d94d2d1a7f4761438781affd3aa991018e4f5
SHA256

f15c54f4ac4f55bcfa281b668220eb144e63b9de2292e970095a4dc566209682
SHA512

06f35ece48e4e19174da18ecc5dcac3a7e4d7ffbb102c4859221c7c569027ca72e40c9ed945872bf4396bc02ced7ae46655c88e3ec40d0a2f2e3bd0fcec80203
SSDEEP

192:DgNbdqnDNlPkZHmY74+/qmtRCtmK8W9I2gHHMlxh8B39LJ1Hab4OJgJnc5w/93gb:ENMO3aMOUnbCky05SN1

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3200	msedge.exe
3200	msedge.exe
4600	msedge.exe
4600	msedge.exe
4708	msedge.exe
4708	msedge.exe
3052	identity_helper.exe
3052	identity_helper.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 4060	4600	msedge.exe	81
PID 4600 wrote to memory of 4060	4600	msedge.exe	81
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 2224	4600	msedge.exe	82
PID 4600 wrote to memory of 3200	4600	msedge.exe	83
PID 4600 wrote to memory of 3200	4600	msedge.exe	83
PID 4600 wrote to memory of 3472	4600	msedge.exe	84
PID 4600 wrote to memory of 3472	4600	msedge.exe	84
PID 4600 wrote to memory of 3472	4600	msedge.exe	84
PID 4600 wrote to memory of 3472	4600	msedge.exe	84
PID 4600 wrote to memory of 3472	4600	msedge.exe	84
PID 4600 wrote to memory of 3472	4600	msedge.exe	84
PID 4600 wrote to memory of 3472	4600	msedge.exe	84
PID 4600 wrote to memory of 3472	4600	msedge.exe	84
PID 4600 wrote to memory of 3472	4600	msedge.exe	84
PID 4600 wrote to memory of 3472	4600	msedge.exe	84
PID 4600 wrote to memory of 3472	4600	msedge.exe	84
PID 4600 wrote to memory of 3472	4600	msedge.exe	84
PID 4600 wrote to memory of 3472	4600	msedge.exe	84
PID 4600 wrote to memory of 3472	4600	msedge.exe	84
PID 4600 wrote to memory of 3472	4600	msedge.exe	84
PID 4600 wrote to memory of 3472	4600	msedge.exe	84
PID 4600 wrote to memory of 3472	4600	msedge.exe	84
PID 4600 wrote to memory of 3472	4600	msedge.exe	84
PID 4600 wrote to memory of 3472	4600	msedge.exe	84
PID 4600 wrote to memory of 3472	4600	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app\index.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8513c3cb8,0x7ff8513c3cc8,0x7ff8513c3cd8
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,1607139362976579659,18434101622139816678,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,1607139362976579659,18434101622139816678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,1607139362976579659,18434101622139816678,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1607139362976579659,18434101622139816678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1607139362976579659,18434101622139816678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1607139362976579659,18434101622139816678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1607139362976579659,18434101622139816678,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,1607139362976579659,18434101622139816678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1607139362976579659,18434101622139816678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1607139362976579659,18434101622139816678,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,1607139362976579659,18434101622139816678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,1607139362976579659,18434101622139816678,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2604 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4113e45804b7888f88ae2a78482d0951

SHA1
4c59bba45c65ba65aa920cbd4eb0d7ccf517a220

SHA256
174195025b51f69ece21274cd7a97fff9f3d9a4bf57185ff3b1297bf2da6d1db

SHA512
16355c4c575a162396cf2ca377f586b3659a70e8c1708cad66b74bb3ef66cbf9ed33d9376730325d95420e5f4f558b2bdb6b5b7595b8b822eb6d2449a83c3f95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e521eb4a4c2bbe4898150cf066ee0cb0

SHA1
c2b311b8b78c677b55a356b8274197fdcbae8ab5

SHA256
1f947cf3be3f525e3039b9c363bb7d7bc0dd2b70da434149e0f0cbbc5d13dbe3

SHA512
59e1b52a41dad2e7f36e0343e330b00bc33a7ba88f616928fd2b6cc526cac6effed76b006cb8a23ff45e85be27647114c7a8376ef3ba53d38ccb9ed4de9a5ea8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
309B

MD5
709dfd01155fac412d69874eb6581594

SHA1
98ffdfe9e3f2ee524021142a3ad5e9f258355b3b

SHA256
0594dee307a04ae2e6b7d602df85355f17db4377aaf832d386944d855f435d55

SHA512
8d59f7060b71bbabb0776884405dbf8f95d6a0602422145d65871ad558e70599a49d61dd180c7cae947737cc6219376843399792bc50a9c23b90b60ef16f750d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f77deb78f7a21b8f50585bdbd2043482

SHA1
53acfe61d8410a27716f7277b4fb2d59f72088d9

SHA256
0910330d6834a86b25e0775f33d79d04130d05c27341f96caab302ead74e9bae

SHA512
7801d0913380622e661123b2e753eada72b32557ea0c4cba0489b2933279cb9e00f404968f2acdf314393469c396c2629b01427413b8bb8ccb2e7f34e2c99a76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f5e8906605837549d57cefcdaf09db86

SHA1
cc2d3cd696e36ba9de9c45fb841613f73dfb2cbb

SHA256
d62c212f1836161293083158f562bf8dd775aa743f0bb0c8d05c12b342d1df26

SHA512
08a5f7438f38cef78dabcd6f2ea90c3453821e1dbdaa66d001781a995e3b816faf2ad0c397dfe836aa4717910dbcc6362ce175d2f157d84b365b05f03112be2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b71bcc34f539ba18dcc84056f283ddc9

SHA1
5a6052f2dbfd688f94b7bd6140cf4686db847cb5

SHA256
a3f25b22cb8cbe6e1c177d408af5083c2fa6732f510de6c52674f6636a436c3e

SHA512
2a9eba1498048f4569bb867c00ff3bebfcf9dcd31bf3794c3f2350f7a4eb6804242c11159845888815dff679ff5805da5e325fb1248321325fa74156b80d1ee6

Download Submit