3da6828f8567c3cfbd3982484da2f94dd40f721a77fd46c624268cdb550c0035

Analysis

max time kernel
145s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

oofile_1.47/viewer/htwin/p_OpenMoreWindow.html
Size

3KB
MD5

dcd549c139fd9f41038457b34aeecd39
SHA1

5563db8187d04924f944ecee9a52a4e74e7d6a52
SHA256

e501837d4ef2ad35211d82dbecc4c5d27f86e6b3aad1921836aee68611a2d3ed
SHA512

1a2bca6b9bb5362d8d8b67f372d74c72bbdb333009d35b4c7620587c959814e11dde11226a69c1f7ad9306a3a03d9b9e28b760107dd8d8aa674d48275c96053d

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2108	msedge.exe
2108	msedge.exe
3724	msedge.exe
3724	msedge.exe
5952	identity_helper.exe
5952	identity_helper.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 3140	3724	msedge.exe	85
PID 3724 wrote to memory of 3140	3724	msedge.exe	85
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 4156	3724	msedge.exe	86
PID 3724 wrote to memory of 2108	3724	msedge.exe	87
PID 3724 wrote to memory of 2108	3724	msedge.exe	87
PID 3724 wrote to memory of 1780	3724	msedge.exe	88
PID 3724 wrote to memory of 1780	3724	msedge.exe	88
PID 3724 wrote to memory of 1780	3724	msedge.exe	88
PID 3724 wrote to memory of 1780	3724	msedge.exe	88
PID 3724 wrote to memory of 1780	3724	msedge.exe	88
PID 3724 wrote to memory of 1780	3724	msedge.exe	88
PID 3724 wrote to memory of 1780	3724	msedge.exe	88
PID 3724 wrote to memory of 1780	3724	msedge.exe	88
PID 3724 wrote to memory of 1780	3724	msedge.exe	88
PID 3724 wrote to memory of 1780	3724	msedge.exe	88
PID 3724 wrote to memory of 1780	3724	msedge.exe	88
PID 3724 wrote to memory of 1780	3724	msedge.exe	88
PID 3724 wrote to memory of 1780	3724	msedge.exe	88
PID 3724 wrote to memory of 1780	3724	msedge.exe	88
PID 3724 wrote to memory of 1780	3724	msedge.exe	88
PID 3724 wrote to memory of 1780	3724	msedge.exe	88
PID 3724 wrote to memory of 1780	3724	msedge.exe	88
PID 3724 wrote to memory of 1780	3724	msedge.exe	88
PID 3724 wrote to memory of 1780	3724	msedge.exe	88
PID 3724 wrote to memory of 1780	3724	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\oofile_1.47\viewer\htwin\p_OpenMoreWindow.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9de3246f8,0x7ff9de324708,0x7ff9de324718
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,15186882335710895932,17962746245645988440,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,15186882335710895932,17962746245645988440,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,15186882335710895932,17962746245645988440,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15186882335710895932,17962746245645988440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15186882335710895932,17962746245645988440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,15186882335710895932,17962746245645988440,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,15186882335710895932,17962746245645988440,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15186882335710895932,17962746245645988440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15186882335710895932,17962746245645988440,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15186882335710895932,17962746245645988440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15186882335710895932,17962746245645988440,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,15186882335710895932,17962746245645988440,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3068 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7b56675b54840d86d49bde5a1ff8af6a

SHA1
fe70a1b85f88d60f3ba9fc7bb5f81fc41e150811

SHA256
86af7213f410df65d0937f4331f783160f30eaeb088e28a9eef461713b9a3929

SHA512
11fc61b83365391efee8084de5c2af7e064f0182b943a0db08d95a0f450d3877bde5b5e6a6b9f008e58b709bb1a34f7b50085c41927f091df1eea78f039402e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
48cff1baabb24706967de3b0d6869906

SHA1
b0cd54f587cd4c88e60556347930cb76991e6734

SHA256
f6b5fbc610a71b3914753feb2bd4475a7c77d0d785cc36255bf93b3fe3ccb775

SHA512
fd0c848f3f9de81aca81af999262f96ea4c1cd1d1f32d304f56c7382f3b1bb604e5fbe9f209ad6e4b38988d92357ef82e9668806d0727f2856c7dc1f07aae2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1cc61c4303a2eed2dd821f93af0b38c4

SHA1
8447bfd21063ac421c98207bb875dfa6e2aabcdc

SHA256
fc1de478b349bc03cfd63f56289fe4606380e4a4d050a391bc08ae05d95302d2

SHA512
52d5c014dba982e545a64bd4d838f7ceed84cc89ea1486db510ca402911fd181054b42d09e0bf3d4b20dfbe00a3040e86e2fc1aec57c8b6fb490176780cad23b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0c8f36158b5d0f061c6a6b46c47cde86

SHA1
e4171fe5194efa88b5d846ee06df249c825a925e

SHA256
cd619b94c2732ad5a6c9c593cb8869e49c7afeda8c0f09a930e6e84b3245968b

SHA512
a456efec99c7f4655b3500e9269c2bb74f865b67b3e798b424e3a4ea0c1a3df5ad6f35029a73dfa884fac41a081abfccc339d5ebb3f6e6b342c81e548628f2c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
62b2538c7b965f0e697a743ab74c6184

SHA1
55e1a0cb034da91e9e73e2fbe95b210c53c08ef5

SHA256
b5b898536df6434ca70d60682ca0e7352f554ab518639e66d5c9a14ab5648c6b

SHA512
7fe5c6dcea9627515b071d7327f6e7be0d83169ca6cb328981dc25d3a8a574c87e4309f7e7b693e0ab15ec8e9883b545b9898d28e947e4e6c5139f234c7eb921

Download Submit