bcc8812a2385f7a4db7d7633eb5ce0770e5cc3b5093873fd3e0a7c239f8daa1d

Resubmissions

11/04/2024, 06:06

240411-gt1pxagh4y 7

11/04/2024, 05:53

11/04/2024, 05:51

11/04/2024, 05:48

11/04/2024, 05:44

11/04/2024, 05:39

Analysis

max time kernel
148s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
11/04/2024, 05:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/app/progress.html
Size

20KB
MD5

91462d1f452add0ccac7455e010e89df
SHA1

55435ad7c270cb137c19ad90503652bc63d3ef0c
SHA256

c3cd601ed7b1ce97e9a45518af8d9011353f9629b034e9d3939ee951c417bbf8
SHA512

0e2c8dfae33141ad9fb782d742b09f6cd12f8f4bca298c9599236d0708fc9fc6b753a672e68d2d25cf1f29f1792a00ead814ffe2d5bb136713812409866cb43a
SSDEEP

192:hadqnDNlPkZHmY74+/qmtRCtmK8W9I2gHHMlxh8B39LJ1Hab4OJgJnc5w/93gAJP:5O3aMOUnbC63UA5ia6w

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3084	msedge.exe
3084	msedge.exe
1320	msedge.exe
1320	msedge.exe
4524	msedge.exe
4524	msedge.exe
4732	identity_helper.exe
4732	identity_helper.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 1348	1320	msedge.exe	81
PID 1320 wrote to memory of 1348	1320	msedge.exe	81
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 1656	1320	msedge.exe	82
PID 1320 wrote to memory of 3084	1320	msedge.exe	83
PID 1320 wrote to memory of 3084	1320	msedge.exe	83
PID 1320 wrote to memory of 3628	1320	msedge.exe	84
PID 1320 wrote to memory of 3628	1320	msedge.exe	84
PID 1320 wrote to memory of 3628	1320	msedge.exe	84
PID 1320 wrote to memory of 3628	1320	msedge.exe	84
PID 1320 wrote to memory of 3628	1320	msedge.exe	84
PID 1320 wrote to memory of 3628	1320	msedge.exe	84
PID 1320 wrote to memory of 3628	1320	msedge.exe	84
PID 1320 wrote to memory of 3628	1320	msedge.exe	84
PID 1320 wrote to memory of 3628	1320	msedge.exe	84
PID 1320 wrote to memory of 3628	1320	msedge.exe	84
PID 1320 wrote to memory of 3628	1320	msedge.exe	84
PID 1320 wrote to memory of 3628	1320	msedge.exe	84
PID 1320 wrote to memory of 3628	1320	msedge.exe	84
PID 1320 wrote to memory of 3628	1320	msedge.exe	84
PID 1320 wrote to memory of 3628	1320	msedge.exe	84
PID 1320 wrote to memory of 3628	1320	msedge.exe	84
PID 1320 wrote to memory of 3628	1320	msedge.exe	84
PID 1320 wrote to memory of 3628	1320	msedge.exe	84
PID 1320 wrote to memory of 3628	1320	msedge.exe	84
PID 1320 wrote to memory of 3628	1320	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app\progress.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9a4293cb8,0x7ff9a4293cc8,0x7ff9a4293cd8
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,3842137543080200163,17395658190873783613,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,3842137543080200163,17395658190873783613,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,3842137543080200163,17395658190873783613,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3842137543080200163,17395658190873783613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3842137543080200163,17395658190873783613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,3842137543080200163,17395658190873783613,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,3842137543080200163,17395658190873783613,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3842137543080200163,17395658190873783613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3842137543080200163,17395658190873783613,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3842137543080200163,17395658190873783613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,3842137543080200163,17395658190873783613,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,3842137543080200163,17395658190873783613,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5200 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
12b71c4e45a845b5f29a54abb695e302

SHA1
8699ca2c717839c385f13fb26d111e57a9e61d6f

SHA256
c353020621fa6cea80eaa45215934d5f44f181ffa1a673cdb7880f20a4e898e0

SHA512
09f0d1a739102816c5a29106343d3b5bb54a31d67ddbfcfa21306b1a6d87eaa35a9a2f0358e56cc0f78be15eeb481a7cc2038ce54d552b9b791e7bee78145241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce319bd3ed3c89069337a6292042bbe0

SHA1
7e058bce90e1940293044abffe993adf67d8d888

SHA256
34070e3eea41c0e180cb5541de76cea15ef6f9e5c641e922d82a2d97bdce3aa3

SHA512
d42f7fc32a337ecd3a24bcbf6cd6155852646cae5fb499003356f713b791881fc2e46825c4ff61d09db2289f25c0992c10d6fadb560a9bea33284bd5acc449f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ad6673fee29890b64b73e0bf1afe9c67

SHA1
1e0377776b228438396cc93132988100f45987dc

SHA256
fec6b13c55e0eaeb35b5899e260e09b7c18ad601b611931c1f0ef6ff1c17ced0

SHA512
e9da9eb9eab9cebcebe74a71938ac46bfc20e6930211676fb9ada8a12d97773473ffad6dfb5fc8c4052b9eaf284d660ce86a4f06603300c1358da5679687ba3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
465101b267f53cb9e79380264b12f198

SHA1
ec74820287bc8d8fb076e3f4af6a40f3baf47aac

SHA256
4eac59effaaaa8ac75baf2d24c0eb0f2158f38cc7b350dc639b783a8cca7d552

SHA512
08417b12d93661fd4aac48b4c10c6d51e538a55980e49875b8a0c1db6c0696f76d6fa71ee3d42fad7953be0ef3e3a5cc225df2aae18252b63ec0885a4a8cc8a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
882a74cd70f0f784be11be5769fdc9a7

SHA1
a2a8628070a0a6b558a55b005186cba3538c8d11

SHA256
dd4d430d97e078e9d9665febe54574cd332bc9428f6c784e53ad2a48b4b49db9

SHA512
589bf5a1fb3c76ad1e7b8dddc3173ea982a77cc9d46fc4a7abc1acdc0aea0923ed29e9fc4551782c46eba24c2efcd1125ee80056a69d9ec8f7da4766311d263f

Download Submit