9c1a052b4f6fbbe3c6437b3af2a3f93f2218b3c175073e7daeb6361f999a94c5

Analysis

max time kernel
173s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2024 08:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

5.2MB
MD5

4247afa6679602da138e41886bcf27da
SHA1

3bb8c83dc9d5592119675e67595b294211ddbf6e
SHA256

bf59a74b4404aa0c893ca8bbe636498629b6a3acdff4acb84de692462fd626e4
SHA512

ad3103f7fd32f0ec652bc7fcb8c303796367292a366037acad8e1312775cdd92c2f36ed8c34a809251ad044508e1e7579b79847de61025baf8bda5ad578a0330
SSDEEP

12288:/7etnqnVnMnBnunQ9RBvjYJEi400/Q599b769B9UOE6MwMGucMEbHDuX0YnpWQZG:sPMM5FaWStHvmUKItmfDTeHiVQZp4

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
2256	msedge.exe
2256	msedge.exe
4740	identity_helper.exe
4740	identity_helper.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe
2256	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 3572	2256	msedge.exe	82
PID 2256 wrote to memory of 3572	2256	msedge.exe	82
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 2304	2256	msedge.exe	85
PID 2256 wrote to memory of 4388	2256	msedge.exe	86
PID 2256 wrote to memory of 4388	2256	msedge.exe	86
PID 2256 wrote to memory of 5020	2256	msedge.exe	87
PID 2256 wrote to memory of 5020	2256	msedge.exe	87
PID 2256 wrote to memory of 5020	2256	msedge.exe	87
PID 2256 wrote to memory of 5020	2256	msedge.exe	87
PID 2256 wrote to memory of 5020	2256	msedge.exe	87
PID 2256 wrote to memory of 5020	2256	msedge.exe	87
PID 2256 wrote to memory of 5020	2256	msedge.exe	87
PID 2256 wrote to memory of 5020	2256	msedge.exe	87
PID 2256 wrote to memory of 5020	2256	msedge.exe	87
PID 2256 wrote to memory of 5020	2256	msedge.exe	87
PID 2256 wrote to memory of 5020	2256	msedge.exe	87
PID 2256 wrote to memory of 5020	2256	msedge.exe	87
PID 2256 wrote to memory of 5020	2256	msedge.exe	87
PID 2256 wrote to memory of 5020	2256	msedge.exe	87
PID 2256 wrote to memory of 5020	2256	msedge.exe	87
PID 2256 wrote to memory of 5020	2256	msedge.exe	87
PID 2256 wrote to memory of 5020	2256	msedge.exe	87
PID 2256 wrote to memory of 5020	2256	msedge.exe	87
PID 2256 wrote to memory of 5020	2256	msedge.exe	87
PID 2256 wrote to memory of 5020	2256	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa450946f8,0x7ffa45094708,0x7ffa45094718
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,12788872467214399116,7454101412066455125,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,12788872467214399116,7454101412066455125,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,12788872467214399116,7454101412066455125,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12788872467214399116,7454101412066455125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12788872467214399116,7454101412066455125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,12788872467214399116,7454101412066455125,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,12788872467214399116,7454101412066455125,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12788872467214399116,7454101412066455125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12788872467214399116,7454101412066455125,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12788872467214399116,7454101412066455125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12788872467214399116,7454101412066455125,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,12788872467214399116,7454101412066455125,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4668 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e494d16e4b331d7fc483b3ae3b2e0973

SHA1
d13ca61b6404902b716f7b02f0070dec7f36edbf

SHA256
a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165

SHA512
016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0764f5481d3c05f5d391a36463484b49

SHA1
2c96194f04e768ac9d7134bc242808e4d8aeb149

SHA256
cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3

SHA512
a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
97f478e704124d0bb85416a9176ed693

SHA1
d20ed95033b1f329198a0045ece2d5ada4708bff

SHA256
cb87d0a0efc315bc9407b43b3b62143c195679537ccb234243a13550c92918ea

SHA512
fa063a21470a21fb97289153e26e3ef1656f9a2af10eb6dcc5f7acc0dc80cdf1870deca60b62d8732834d2a969b1c7deeb396b7288ba96724f438d6a61e19a3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5bb958b905b6fe46d20a2d5741ce0ee8

SHA1
1288526ba0dc3d32b45b57b56145acc83197a0fb

SHA256
065edc4b2670d5415dadb8104166c6e3a98f47382093c81aa4cd1944a5c840da

SHA512
35e5cb6dcacc8b17e557f404e6ce07f70e0b93c4d8d0a6005da01a2dcde4c5cb65638ca317c6096af300116062e950a4aaefaad54842957e7727a1b65127605e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4dc9ba6c17041b9846cf48a8b2c45c73

SHA1
1364cd086a70926d04fda1d810ebf1939c629b1a

SHA256
ea3996b03e78ad8869ac623937b0113bcfe3895438eeaa38761607d97694b9cd

SHA512
814083b072c878562895ba5585badc4e751832c72a89f85e54ed3f5be19bf6dc62dfc4338f2775281a4783666669fc20e92c8e6f3a7990e0eda2e97565c3001c

Download Submit