6fc494a717e1d8ca843578c7c19a27e4403eea0859393fda256d281cfa6f9535

Analysis

max time kernel
1681s
max time network
1693s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 11:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jre/Welcome.html
Size

983B
MD5

3cb773cb396842a7a43ad4868a23abe5
SHA1

ace737f039535c817d867281190ca12f8b4d4b75
SHA256

f450aee7e8fe14512d5a4b445aa5973e202f9ed1e122a8843e4dc2d4421015f0
SHA512

6058103b7446b61613071c639581f51718c12a9e7b6abd3cf3047a3093c2e54b2d9674faf9443570a3bb141f839e03067301ff35422eb9097bd08020e0dd08a4

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4524	msedge.exe
4524	msedge.exe
3904	msedge.exe
3904	msedge.exe
1612	identity_helper.exe
1612	identity_helper.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

3904 msedge.exe
3904 msedge.exe
3904 msedge.exe
3904 msedge.exe
3904 msedge.exe
3904 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3904 wrote to memory of 2028	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 2028	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 3936	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 4524	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 4524	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 1844	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 1844	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 1844	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 1844	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 1844	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 1844	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 1844	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 1844	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 1844	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 1844	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 1844	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 1844	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 1844	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 1844	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 1844	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 1844	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 1844	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 1844	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 1844	3904	msedge.exe	msedge.exe
PID 3904 wrote to memory of 1844	3904	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\jre\Welcome.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb1ec846f8,0x7ffb1ec84708,0x7ffb1ec84718
2⤵
PID:2028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,1108793097772356445,17451753152017162222,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
2⤵
PID:3936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,1108793097772356445,17451753152017162222,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,1108793097772356445,17451753152017162222,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
2⤵
PID:1844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1108793097772356445,17451753152017162222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
2⤵
PID:1712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1108793097772356445,17451753152017162222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
2⤵
PID:1588

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,1108793097772356445,17451753152017162222,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
2⤵
PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,1108793097772356445,17451753152017162222,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1108793097772356445,17451753152017162222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
2⤵
PID:2836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1108793097772356445,17451753152017162222,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
2⤵
PID:1680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1108793097772356445,17451753152017162222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
2⤵
PID:2668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1108793097772356445,17451753152017162222,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
2⤵
PID:2392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,1108793097772356445,17451753152017162222,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3028 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4584

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a9519bc058003dbea34765176083739e

SHA1
ef49b8790219eaddbdacb7fc97d3d05433b8575c

SHA256
e034683bc434a09f5d0293cb786e6a3943b902614f9211d42bed47759164d38b

SHA512
a1b67ccf313173c560ead25671c64de65e3e2599251926e33ce8399fde682fce5cb20f36ee330fcd8bb8f7a9c00ef432da56c9b02dfd7d3f02865f390c342b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
cb138796dbfb37877fcae3430bb1e2a7

SHA1
82bb82178c07530e42eca6caf3178d66527558bc

SHA256
50c55ba7baeebe1fa4573118edbca59010d659ea42761148618fb3af8a1c9bdd

SHA512
287471cccbe33e08015d6fc35e0bcdca0ec79bebc3a58f6a340b7747b5b2257b33651574bc83ed529aef2ba94be6e68968e59d2a8ef5f733dce9df6404ad7cc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
69285f619e2e31067eb1f0d0bf5ffa26

SHA1
c267efc72df2ec8bb9e019dc35af4ebfc4265066

SHA256
a94cbec82b3ee5bc44fa16c90eaa0713f5945ed9d65575c339f49d3be8cf65c3

SHA512
812d71439b60d3cd22f42fe30b73d5944f97186806f78d556d02f85f4e0f2b5115a62ae5620733ea6caf8f6457608a3886eafe925b7f5ef9fbf0d36398a445a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
7c0af95883795f5e76f0d4bfef622359

SHA1
245289b45443a322537ed1b2dfddac148b7d9519

SHA256
c39cf4899f30d2ca5547c049a35d094ced68e95ac1f32e08b63f2b9e74ca4be1

SHA512
23b558b012ba11dd1692b07ccbc6e21b7a9c9fba7ac2ceaf4c9116382c0e881b74bceb50f491d8a6cc31e793dbe2b3b4d264456167a21b59daca548521858625

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
6a86ae0f442285083bfb36ef18752a20

SHA1
8a607b9cdb4ce027984ec77e60da20e8d13c6bbc

SHA256
bd916a52c6ac3100b5c31e246158bf30b9491cc48ba1626e4e17457d38618cc8

SHA512
79c07ed50937fa6f4b751150b85737fd67983395a0e316710dc6231884345fb41090ad8454607ba3d78c959f59f04afd2f1dfed8f6ce88ce51bccc63e024d8ad

Download Submit