hxxps://attachment[.]my[.]canva[.]site/office365

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2024 12:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://attachment.my.canva.site/office365

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3944	msedge.exe
3944	msedge.exe
4408	msedge.exe
4408	msedge.exe
3440	identity_helper.exe
3440	identity_helper.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 4916	4408	msedge.exe	85
PID 4408 wrote to memory of 4916	4408	msedge.exe	85
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 4520	4408	msedge.exe	86
PID 4408 wrote to memory of 3944	4408	msedge.exe	87
PID 4408 wrote to memory of 3944	4408	msedge.exe	87
PID 4408 wrote to memory of 2112	4408	msedge.exe	88
PID 4408 wrote to memory of 2112	4408	msedge.exe	88
PID 4408 wrote to memory of 2112	4408	msedge.exe	88
PID 4408 wrote to memory of 2112	4408	msedge.exe	88
PID 4408 wrote to memory of 2112	4408	msedge.exe	88
PID 4408 wrote to memory of 2112	4408	msedge.exe	88
PID 4408 wrote to memory of 2112	4408	msedge.exe	88
PID 4408 wrote to memory of 2112	4408	msedge.exe	88
PID 4408 wrote to memory of 2112	4408	msedge.exe	88
PID 4408 wrote to memory of 2112	4408	msedge.exe	88
PID 4408 wrote to memory of 2112	4408	msedge.exe	88
PID 4408 wrote to memory of 2112	4408	msedge.exe	88
PID 4408 wrote to memory of 2112	4408	msedge.exe	88
PID 4408 wrote to memory of 2112	4408	msedge.exe	88
PID 4408 wrote to memory of 2112	4408	msedge.exe	88
PID 4408 wrote to memory of 2112	4408	msedge.exe	88
PID 4408 wrote to memory of 2112	4408	msedge.exe	88
PID 4408 wrote to memory of 2112	4408	msedge.exe	88
PID 4408 wrote to memory of 2112	4408	msedge.exe	88
PID 4408 wrote to memory of 2112	4408	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://attachment.my.canva.site/office365
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc83c046f8,0x7ffc83c04708,0x7ffc83c04718
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,12182402281799355793,12159841220108191057,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,12182402281799355793,12159841220108191057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,12182402281799355793,12159841220108191057,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12182402281799355793,12159841220108191057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12182402281799355793,12159841220108191057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,12182402281799355793,12159841220108191057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,12182402281799355793,12159841220108191057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12182402281799355793,12159841220108191057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12182402281799355793,12159841220108191057,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12182402281799355793,12159841220108191057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12182402281799355793,12159841220108191057,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,12182402281799355793,12159841220108191057,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5016 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cff358b013d6f9f633bc1587f6f54ffa

SHA1
6cb7852e096be24695ff1bc213abde42d35bb376

SHA256
39205cdf989e3a86822b3f473c5fc223d7290b98c2a3fb7f75e366fc8e3ecbe9

SHA512
8831c223a1f0cf5f71fa851cdd82f4a9f03e5f267513e05b936756c116997f749ffa563623b4724de921d049de34a8f277cc539f58997cda4d178ea205be2259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc629a750e345390344524fe0ea7dcd7

SHA1
5f9f00a358caaef0321707c4f6f38d52bd7e0399

SHA256
38b634f3fedcf2a9dc3280aa76bd1ea93e192200b8a48904664fac5c9944636a

SHA512
2a941fe90b748d0326e011258fa9b494dc2f47ac047767455ed16a41d523f04370f818316503a5bad0ff5c5699e92a0aaf3952748b09287c5328354bfa6cc902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
192B

MD5
6def7f93bb3898b44ccf5a8076e67921

SHA1
7e8178221ade078f33c3a65f8fcc5b6daa5ebd33

SHA256
2ef7c358d2b3247de7ae2dc036dcd80df232fefae196648a14389dfe1b99ddd2

SHA512
0d6cc88d1edb45afe70513566623847d137722c070c8c296a5303b6622bc64b82c7a861bd7271a3e61a4ed190627f9f2367fc0f22470cab382a2abd52a176252

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
798fd78022a3f0e757a3c6513f317bc3

SHA1
7781bcc0be506d5e945092ae83605bc1e277e605

SHA256
cf5bbdff07c9487d7301196c12ef2e945a66df36fab7afd59ec18e53e9ab49a2

SHA512
f40e133c02b87868befa9b6d5a9c1688ec845faefd5d68ca43d610fc7e286a149c72184af6140124325773959e3ea95e0031c529055d9e963ad65ef129df965d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d7f0b62a9756c64a457822d98cc90549

SHA1
ec473c98cdb29bae27b94c5ae917d107bd4e69e2

SHA256
ce547801b47fb4e0e8bb41151514fc43a5e086809c9903e8caf412ae37e2a856

SHA512
213cd7b2eb03d574eca9fadb51be6e5be6540f6b70996c425c229ee0715a84be99eb28d7c7bfd4acbd703338ad87d0761f5624632c608aba218291c8d36f83ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f835d8184c426da73bb5e8a0b5f42287

SHA1
5e9c6d7d15439f9cf51e04f27a83f082e1fbddd6

SHA256
f5bfa15b878f7e58fa165c6a29ce2551f60ae54e98d122dcdfde70fac89cb86e

SHA512
623a64e05ce19ad83ab135c6d212bcda972f82d1e3ba98736a6bb7c3204dd2c0b90478dc06d7fa62771e7f2c88d827a20eb33effdbb061b430f1330d4b2fd5fe

Download Submit