1aa74060a7131a97f4bd4e9a9b6c3faf4471ab696ba0e5d37e1558ce7e615947

Analysis

max time kernel
145s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 04:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

解压缩前必读.htm
Size

3KB
MD5

86b1626fe880a92ce4443bd60f925810
SHA1

5208329d351602324bfbff1fa878014f295cc65c
SHA256

a352456369430335d9a0b4d1d53cd49eeb61f7b94606d9a9777812c0dfc36aec
SHA512

3fcfe97d1418dc33d303746716f27ed3ad59cc8cc212a2ef9bf70bf2490d9c307b0ee72eb913e658447220019e68cb0536f6f39647488bc3b313c3b9b96303df

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
1368	msedge.exe
1368	msedge.exe
812	identity_helper.exe
812	identity_helper.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1268	1368	msedge.exe	84
PID 1368 wrote to memory of 1268	1368	msedge.exe	84
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 4888	1368	msedge.exe	85
PID 1368 wrote to memory of 3020	1368	msedge.exe	86
PID 1368 wrote to memory of 3020	1368	msedge.exe	86
PID 1368 wrote to memory of 4876	1368	msedge.exe	87
PID 1368 wrote to memory of 4876	1368	msedge.exe	87
PID 1368 wrote to memory of 4876	1368	msedge.exe	87
PID 1368 wrote to memory of 4876	1368	msedge.exe	87
PID 1368 wrote to memory of 4876	1368	msedge.exe	87
PID 1368 wrote to memory of 4876	1368	msedge.exe	87
PID 1368 wrote to memory of 4876	1368	msedge.exe	87
PID 1368 wrote to memory of 4876	1368	msedge.exe	87
PID 1368 wrote to memory of 4876	1368	msedge.exe	87
PID 1368 wrote to memory of 4876	1368	msedge.exe	87
PID 1368 wrote to memory of 4876	1368	msedge.exe	87
PID 1368 wrote to memory of 4876	1368	msedge.exe	87
PID 1368 wrote to memory of 4876	1368	msedge.exe	87
PID 1368 wrote to memory of 4876	1368	msedge.exe	87
PID 1368 wrote to memory of 4876	1368	msedge.exe	87
PID 1368 wrote to memory of 4876	1368	msedge.exe	87
PID 1368 wrote to memory of 4876	1368	msedge.exe	87
PID 1368 wrote to memory of 4876	1368	msedge.exe	87
PID 1368 wrote to memory of 4876	1368	msedge.exe	87
PID 1368 wrote to memory of 4876	1368	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\解压缩前必读.htm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffcd9ed46f8,0x7ffcd9ed4708,0x7ffcd9ed4718
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16028057606336523933,5844683062700426950,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,16028057606336523933,5844683062700426950,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,16028057606336523933,5844683062700426950,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16028057606336523933,5844683062700426950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16028057606336523933,5844683062700426950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,16028057606336523933,5844683062700426950,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,16028057606336523933,5844683062700426950,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16028057606336523933,5844683062700426950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2400 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16028057606336523933,5844683062700426950,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16028057606336523933,5844683062700426950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16028057606336523933,5844683062700426950,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16028057606336523933,5844683062700426950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16028057606336523933,5844683062700426950,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4896 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
ea9994bfefc979077161d6baa4c85a0d

SHA1
0898a6b33e12cb587cb75e4cdca7711b12c2f54d

SHA256
cd7926f7423723bf0f65552f9c3b62b9378aed2c54f0c04f7c19eb8d725dd6fd

SHA512
a56ff98eb6e91a2e818b4fdcf1080d4a51712fc5d1b5065bcb648e2e11a0f2ba5374636cbfd77c429c9415663260cd3aaf95796159c3c2f3f9fd991c9b216e4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
181B

MD5
a2409683300231b1972716d9dbea6f2a

SHA1
5c019e55d68c84410e431f6cb3f0f14ffa1ddbbb

SHA256
52221f251097ce9688060139f0edab6580db64db01e94a8670dff129d6061129

SHA512
0d967b2ff251060b88759ddf4b9448d52c53e7270fbf5a646998158b03f84c784805e055736203be173f397fa774aa7ba22ead7ca903c821281fe373dec95a41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
04302e435822103406bfd35621f8a61d

SHA1
9bc76cf8d92112bb15b663173c135600044accb9

SHA256
855c92fc665f046aff2d293c568807b08a7cfa80aec400b0757fa2c1a985fc7a

SHA512
7f111ca7652806d82c1ac4022e07e422db822fae97c7af51d69921279aef2d5a4c06e57b066b164af2c115088703e8226f4442e26ea33c9ab078b0e39d3a317f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4c9196507354dc64d31d830244c989a4

SHA1
70e1d067618e83043d46be7e145631323702aa0d

SHA256
d8c04b151f625965219886862a18f09d5b7b68f2059e3996ef2c75c3668ce6e1

SHA512
be2e5b806fc6c8e97964c433e01a37ba0cff43895de8c01d1e5a8f93db58cfa91b3b681ee2f8a7a89a37a053a5fbb0eb416feeb478b74630181ab27ed5c84d11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1701af19400c5f61a92eb45e5d47780e

SHA1
7dd6eeeb4615a0ff06f420aca77d1065441611dd

SHA256
30847c8369f2c5bbe858de2b327b116a855e80d451dc1c47667143217434a371

SHA512
7a2e3e8f0e06a797d2fd646c7df115d7597853314420e31e1379bd625c6062a92c01186a4749081a40267eaff3d9beaf9096b1e506f8362a9fb4eb6fa829c110

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
88ab474030f36607451e6fb102b2348a

SHA1
d0a2798b41241f91c9870a852ca7629ba8dfcfe5

SHA256
f149e37ad206e989dd1d41216c61921c81c44b3212997d5567f2f73dbb55e1b3

SHA512
c7b838eb6977d23a5320dd1f8b4c565c854f7bf11d11c4d93222e2a11b0e74254204a3f19bce30c3e71666881d89eedefc31ba18e0c0e7c8800abb35844d71c7

Download Submit