05b1ac197d0d17f6fdf2dc85a8a4ec4f3e6544b158040e844e1848bf0bb42fc2

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
25/04/2024, 21:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/app/cmp.html
Size

5KB
MD5

d7b8b31b190e552677589cfd4cbb5d8e
SHA1

09ffb3c63991d5c932c819393de489268bd3ab88
SHA256

6c21e8c07ce28327dca05f873d73fe85d5473f9b22a751a4d3d28931f5d0c74f
SHA512

32794507a4b9a12e52ceb583222cb93300e38c634a72ea3f51a0189127aba60cf476fb7918942355a4f826185d7071e876cb40348ba34cf5d1ca7e9546ccb310
SSDEEP

48:t9rc0/GLAoShbEHaLKNGiNQtvmolOGR36tgtr/GTvJP8AscaV4LiMt7ByBZXGz+p:4VLjHa2NGiivmmpWsBVutFwAk5vSG

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1888	msedge.exe
1888	msedge.exe
1968	msedge.exe
1968	msedge.exe
4304	identity_helper.exe
4304	identity_helper.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2444	1968	msedge.exe	86
PID 1968 wrote to memory of 2444	1968	msedge.exe	86
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 3616	1968	msedge.exe	87
PID 1968 wrote to memory of 1888	1968	msedge.exe	88
PID 1968 wrote to memory of 1888	1968	msedge.exe	88
PID 1968 wrote to memory of 4812	1968	msedge.exe	89
PID 1968 wrote to memory of 4812	1968	msedge.exe	89
PID 1968 wrote to memory of 4812	1968	msedge.exe	89
PID 1968 wrote to memory of 4812	1968	msedge.exe	89
PID 1968 wrote to memory of 4812	1968	msedge.exe	89
PID 1968 wrote to memory of 4812	1968	msedge.exe	89
PID 1968 wrote to memory of 4812	1968	msedge.exe	89
PID 1968 wrote to memory of 4812	1968	msedge.exe	89
PID 1968 wrote to memory of 4812	1968	msedge.exe	89
PID 1968 wrote to memory of 4812	1968	msedge.exe	89
PID 1968 wrote to memory of 4812	1968	msedge.exe	89
PID 1968 wrote to memory of 4812	1968	msedge.exe	89
PID 1968 wrote to memory of 4812	1968	msedge.exe	89
PID 1968 wrote to memory of 4812	1968	msedge.exe	89
PID 1968 wrote to memory of 4812	1968	msedge.exe	89
PID 1968 wrote to memory of 4812	1968	msedge.exe	89
PID 1968 wrote to memory of 4812	1968	msedge.exe	89
PID 1968 wrote to memory of 4812	1968	msedge.exe	89
PID 1968 wrote to memory of 4812	1968	msedge.exe	89
PID 1968 wrote to memory of 4812	1968	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app\cmp.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba6f646f8,0x7ffba6f64708,0x7ffba6f64718
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,15313675272157001919,3592867543371385318,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,15313675272157001919,3592867543371385318,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,15313675272157001919,3592867543371385318,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15313675272157001919,3592867543371385318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15313675272157001919,3592867543371385318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,15313675272157001919,3592867543371385318,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,15313675272157001919,3592867543371385318,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15313675272157001919,3592867543371385318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15313675272157001919,3592867543371385318,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15313675272157001919,3592867543371385318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15313675272157001919,3592867543371385318,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,15313675272157001919,3592867543371385318,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3060 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9519bc058003dbea34765176083739e

SHA1
ef49b8790219eaddbdacb7fc97d3d05433b8575c

SHA256
e034683bc434a09f5d0293cb786e6a3943b902614f9211d42bed47759164d38b

SHA512
a1b67ccf313173c560ead25671c64de65e3e2599251926e33ce8399fde682fce5cb20f36ee330fcd8bb8f7a9c00ef432da56c9b02dfd7d3f02865f390c342b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cb138796dbfb37877fcae3430bb1e2a7

SHA1
82bb82178c07530e42eca6caf3178d66527558bc

SHA256
50c55ba7baeebe1fa4573118edbca59010d659ea42761148618fb3af8a1c9bdd

SHA512
287471cccbe33e08015d6fc35e0bcdca0ec79bebc3a58f6a340b7747b5b2257b33651574bc83ed529aef2ba94be6e68968e59d2a8ef5f733dce9df6404ad7cc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
309B

MD5
8a0cd0d83d49bc70dee2306dc55b1a48

SHA1
286782943d48307a1de5f415f8851f7016e2fc6d

SHA256
36c001a318645cae87452ae87bca9a3ecf869d2a316f3e2e5fc12c75e782002c

SHA512
a35e6dd94721b25b1d0d3f76952485bb79f67af6fb08bd4c3d5ba76622848019b69248544ece37786caaa857fab32ddcd090b063a628810e5a3520746013e40c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
42d75740bd051190caba6440c50ca5f8

SHA1
ff4712876489d7344f05d1057c054240a1a912f4

SHA256
22b6535dacffdf23b1d77692b93b43e16c7d408dc55fd1027fd5d3c0c4adc3a9

SHA512
c251614745f981f94cea0f2ae510ceb00ce642aaafe0d3bc9f9cd13f7a0c82041dc8166f8e070b9bf43d935a61afbd50a2d7be631f43b951f8d587704c0d96bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
321dd85aa671f79512410dbd0168a417

SHA1
e0907991187edec23abf39cd983126a441f01dc3

SHA256
0bb4571610c5f31e58a82a74a7c9553a26f32b6f926ff4a1e26eadb516bb9e84

SHA512
47cc326e1558a0d495d5273f468b7b1e0caa6674ae650074215bad210885f52cff258d7a9a3dbcb7f84b5d1c754485d175a7cfa8c9a143f22d52f35d39afcdb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8f8f74acbbd0361f8d3dbe93c2508bee

SHA1
6f70069f9c849d68fff85a1ba0e20ba99ef6df42

SHA256
e4d63ba563ee3875762ac8344f5312ebdc654be95e0f92ced3dfc4cba6a42318

SHA512
f7fe9a17165d7d95f51592fd7ddd80ccfa3eb7bafac450ab3486740e2e60728624a94b192ffdac9b4c6b236579c635266c5dd190ef8df787dd99d19b43896a77

Download Submit