hxxps://www[.]cisa[.]gov/news-events/cybersecurity-advisories/aa24-109a

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a
Sample240430-wvf48aee39

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
548	msedge.exe
548	msedge.exe
536	msedge.exe
536	msedge.exe
4840	identity_helper.exe
4840	identity_helper.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 1920	536	msedge.exe	85
PID 536 wrote to memory of 1920	536	msedge.exe	85
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 1808	536	msedge.exe	87
PID 536 wrote to memory of 548	536	msedge.exe	88
PID 536 wrote to memory of 548	536	msedge.exe	88
PID 536 wrote to memory of 2228	536	msedge.exe	89
PID 536 wrote to memory of 2228	536	msedge.exe	89
PID 536 wrote to memory of 2228	536	msedge.exe	89
PID 536 wrote to memory of 2228	536	msedge.exe	89
PID 536 wrote to memory of 2228	536	msedge.exe	89
PID 536 wrote to memory of 2228	536	msedge.exe	89
PID 536 wrote to memory of 2228	536	msedge.exe	89
PID 536 wrote to memory of 2228	536	msedge.exe	89
PID 536 wrote to memory of 2228	536	msedge.exe	89
PID 536 wrote to memory of 2228	536	msedge.exe	89
PID 536 wrote to memory of 2228	536	msedge.exe	89
PID 536 wrote to memory of 2228	536	msedge.exe	89
PID 536 wrote to memory of 2228	536	msedge.exe	89
PID 536 wrote to memory of 2228	536	msedge.exe	89
PID 536 wrote to memory of 2228	536	msedge.exe	89
PID 536 wrote to memory of 2228	536	msedge.exe	89
PID 536 wrote to memory of 2228	536	msedge.exe	89
PID 536 wrote to memory of 2228	536	msedge.exe	89
PID 536 wrote to memory of 2228	536	msedge.exe	89
PID 536 wrote to memory of 2228	536	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6d7e46f8,0x7ffd6d7e4708,0x7ffd6d7e4718
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,1562978759843001516,3414188135272728504,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,1562978759843001516,3414188135272728504,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,1562978759843001516,3414188135272728504,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:8
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1562978759843001516,3414188135272728504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1562978759843001516,3414188135272728504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1562978759843001516,3414188135272728504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,1562978759843001516,3414188135272728504,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,1562978759843001516,3414188135272728504,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1562978759843001516,3414188135272728504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1562978759843001516,3414188135272728504,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1562978759843001516,3414188135272728504,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1562978759843001516,3414188135272728504,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,1562978759843001516,3414188135272728504,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
MD5 4f7152bc5a1a715ef481e37d1c791959
SHA1 c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA512 2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
MD5 ea98e583ad99df195d29aa066204ab56
SHA1 f89398664af0179641aa0138b337097b617cb2db
SHA512 e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 840B
SHA256 777b0e5ffa3e07f1465982a4b1443f92053192dc436ae7e60421fe2478bd0c75
MD5 bc489e44b03466a33634a88948903a56
SHA1 7133a96f21932894194cde2a3ef8bb65ae624091
SHA512 e556f518a3aa677c472e6ccab3654218ba4e1674450ccf4ce9dde058e7ba9cbb20ccbe6e6ee3e718c081f1e3f6cd4cbd25884a3c03937b084ae32165c6017ca8
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 02aec9123d778186e0d058877801c4fa2084d0b75eea4a890b2d37e875b85130
MD5 b86b5001fee6fcd11df637661581ec7f
SHA1 bccaab1fb9efac70be4ad99b8e33fc261629d755
SHA512 36a2d565c1b05599d48da10e05a0862281714967d69de91746664ddef85dcbb2069362a9879c115c2728d915416491b9f23ab0f1b1a8e5fc3191fcdba29824cc
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 decb32d24e4e3802fd928745887a155173339fea65793505f25f9358152744d6
MD5 638d5ece2eeb25aaf60af17512b1f3e0
SHA1 cdd84e5cbe805630d8f443411c15c437116a6931
SHA512 89a15e16744d5db62d1f3c18da434d08a7e4454de79f5f0663767fc99b4edb517392ecc48bbf7e93e64110b3c30dd2c0113638845b0e438d009013b5833182d4
SSDEEP 96:nSkaF1/33XwpvWMoiVmdeHp1kOLUWQyV+VD7ziEwb:nSkyNnXGWMXpzLrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

c123a6e8-eee8-487c-ba8c-a9d90d4e35b2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c123a6e8-eee8-487c-ba8c-a9d90d4e35b2.tmp
Size 7KB
SHA256 753dbc7f20e4a3921c1641bab0d6521ffde6ef1a116af58efe2fce4020c73fb7
MD5 d2022d4002fe8fd2091b62f5a25c4a0d
SHA1 cea59847f5861d7ed613645907e7521ba365545a
SHA512 10d682fe5f744e8a798a0584f3788cb4daeb8f3fdcf87b1a6804ff22361fe963130d5a518d913059f72285c6b3790eba897fd44f5ce0cc0a67f105e8df2dd62b
SSDEEP 96:nSkXF1/n3XwpvWMoiVmdeouj1aqIgGmloGZz2p16OLUWQyV+VD7AiEwb:nSk1N3XGWMYuj4z8lbz2pJLrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ba2a55781e269c0402f2d64c119ba585352240032895c48cc70486faa2044e1a
MD5 93a0b026d9f3b3c5d2cb46a00bb1854b
SHA1 d748b4b871842ad2392bd58ffd26e6016920f718
SHA512 b117ac3c9f7642abd329e20961d236797af09a1ca2d3dda504f402e8a7d46004b5f5f3f3f65214cb7bb808531ef537d72eff00ac701f69604245d62c1b2c602e
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupilp74e2RU3xo5Z+OblfBhA:A9iIxuERzA83h09RZxYi7K8aZ/XDafEk
MD5 SHA1 SHA512 SSDEEP

Submit Download