27bf8e239f59a87c27cc9d1c7e92adece25427d246cb5c04fa0237930181fea9

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 04:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$R2/WOL/REGISTER.exe
Size

64KB
MD5

6556664a8840cf90e24f4368fb4843b8
SHA1

30110ab0094a13b3cbd627bced25b923c1c99a4e
SHA256

861f42c1eed88b62bf5c3ce06fad2c497dfddfeaecc75ee878ca405017a54ad6
SHA512

17d146f303feec1a76fb35663fb9683e4ef46ca5d9e4a25313e02388ae7d62b26114481af849dff0ae301ccd9e04e00666c7ffbb3814859a70ffae6e6cab6b09
SSDEEP

768:ByA1Axd6Ch1K9O44XQok6A3HlLBZduof/bKyx2X7iB9uqB+VV+2Q8mhgnKxouVJs:X1A31YOWFFZduonbhTiI3/gOouVJNWV9

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2240	msedge.exe
2240	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
4432	identity_helper.exe
4432	identity_helper.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 3668	2264	REGISTER.exe	84
PID 2264 wrote to memory of 3668	2264	REGISTER.exe	84
PID 3668 wrote to memory of 4544	3668	msedge.exe	85
PID 3668 wrote to memory of 4544	3668	msedge.exe	85
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2308	3668	msedge.exe	86
PID 3668 wrote to memory of 2240	3668	msedge.exe	87
PID 3668 wrote to memory of 2240	3668	msedge.exe	87
PID 3668 wrote to memory of 1688	3668	msedge.exe	88
PID 3668 wrote to memory of 1688	3668	msedge.exe	88
PID 3668 wrote to memory of 1688	3668	msedge.exe	88
PID 3668 wrote to memory of 1688	3668	msedge.exe	88
PID 3668 wrote to memory of 1688	3668	msedge.exe	88
PID 3668 wrote to memory of 1688	3668	msedge.exe	88
PID 3668 wrote to memory of 1688	3668	msedge.exe	88
PID 3668 wrote to memory of 1688	3668	msedge.exe	88
PID 3668 wrote to memory of 1688	3668	msedge.exe	88
PID 3668 wrote to memory of 1688	3668	msedge.exe	88
PID 3668 wrote to memory of 1688	3668	msedge.exe	88
PID 3668 wrote to memory of 1688	3668	msedge.exe	88
PID 3668 wrote to memory of 1688	3668	msedge.exe	88
PID 3668 wrote to memory of 1688	3668	msedge.exe	88
PID 3668 wrote to memory of 1688	3668	msedge.exe	88
PID 3668 wrote to memory of 1688	3668	msedge.exe	88
PID 3668 wrote to memory of 1688	3668	msedge.exe	88
PID 3668 wrote to memory of 1688	3668	msedge.exe	88

C:\Users\Admin\AppData\Local\Temp\$R2\WOL\REGISTER.exe
"C:\Users\Admin\AppData\Local\Temp\$R2\WOL\REGISTER.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  [open] http://apiregister.westwood.com/cgi-bin/cgiclient?register&request=serialreg_menu&REGVER=65536&LANGCODE=0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8299e46f8,0x7ff8299e4708,0x7ff8299e4718
    3⤵
    PID:4544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,4961126950211369377,10441109843773946002,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
    3⤵
    PID:2308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,4961126950211369377,10441109843773946002,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,4961126950211369377,10441109843773946002,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
    3⤵
    PID:1688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4961126950211369377,10441109843773946002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:1504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4961126950211369377,10441109843773946002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:4324
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,4961126950211369377,10441109843773946002,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
    3⤵
    PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,4961126950211369377,10441109843773946002,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4961126950211369377,10441109843773946002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
    3⤵
    PID:3060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4961126950211369377,10441109843773946002,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
    3⤵
    PID:512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4961126950211369377,10441109843773946002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
    3⤵
    PID:888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4961126950211369377,10441109843773946002,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
    3⤵
    PID:3232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4961126950211369377,10441109843773946002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
    3⤵
    PID:3216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4961126950211369377,10441109843773946002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
    3⤵
    PID:2052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4961126950211369377,10441109843773946002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
    3⤵
    PID:2096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4961126950211369377,10441109843773946002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3100 /prefetch:1
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,4961126950211369377,10441109843773946002,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5100 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9cf24cf2ab90e257c4561a9c08f520c7

SHA1
1bb68afcaa0bc13b045485971ce277474522db86

SHA256
c0b0c3d5f6b6a68e12efd3135c848a5187061f7d28f65e43eb41d2958e6019de

SHA512
9f7f76ab2f862a4c01105ee6e9ff45fcb2a7231ef6ffa18fe5eed9d18beaa20e2e91d5e00116626f7d2eb2c51a001fc20ba416fcb0a4214ac607e4bb3100e6bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a416399b08dcab574cc6ad19be8a3985

SHA1
1e945de0573226c29217bda6607b5a1e98cfc9fa

SHA256
a2916ccd2a6f920f081962a58986d5dcdb3f8a90f6c366b18025f639ec096222

SHA512
5ac0768aabcf90e468cf42b92e04084bb46eed46a004713ba0178eef46b65f90f0baed7f2c3d4109465f37a322aa2ad1d4c79e7b29a7cf1c6a894fbc937b24e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fec7cbc68401d8c31d6c1cfbd7155ef6

SHA1
9ff1e726640b55070f9fce220de6451690a76734

SHA256
47a25eab9f7bd496d4d40e45628830f4e8c66a13c0acb54ba9ae58e667181691

SHA512
f0825679301e80be163fb59810eae02a4d3efadf9d2be2c3aac461445d2735e8308b0adb3e190af95ca2c6839af3deb5b0da2535e2118de80be30cabc0a54a2d

Download Submit