304c6bcf15510a4e5c16861b8d2ea08c5a438f5f42e416eaec560ea8d8833a78

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
06/05/2024, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
apps/admin/view/default/common/foot.html
Size 1KB
Sample240506-wx9vbage99
SHA256 c53c599f95878d38c0911ccc8934d14a0e00ee2b2e1c3f8b552a11dcd6452671
MD5 cc55c37297e91c7be5c29552e551b61d
SHA1 284c0ac4ae866e5f5af0d3d8b51dcf205eb2b07b
SHA512 d6b1e402eb0af40dc1c8e7471b04941db16bfebe55f710d0be7933ac740bf57575dd2a8d8363e45458a52515a3469cdd5fa8a48c3502cfecca5f564f93a70493
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3624	msedge.exe
3624	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
692	identity_helper.exe
692	identity_helper.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2816	2652	msedge.exe	84
PID 2652 wrote to memory of 2816	2652	msedge.exe	84
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 5040	2652	msedge.exe	85
PID 2652 wrote to memory of 3624	2652	msedge.exe	86
PID 2652 wrote to memory of 3624	2652	msedge.exe	86
PID 2652 wrote to memory of 2932	2652	msedge.exe	87
PID 2652 wrote to memory of 2932	2652	msedge.exe	87
PID 2652 wrote to memory of 2932	2652	msedge.exe	87
PID 2652 wrote to memory of 2932	2652	msedge.exe	87
PID 2652 wrote to memory of 2932	2652	msedge.exe	87
PID 2652 wrote to memory of 2932	2652	msedge.exe	87
PID 2652 wrote to memory of 2932	2652	msedge.exe	87
PID 2652 wrote to memory of 2932	2652	msedge.exe	87
PID 2652 wrote to memory of 2932	2652	msedge.exe	87
PID 2652 wrote to memory of 2932	2652	msedge.exe	87
PID 2652 wrote to memory of 2932	2652	msedge.exe	87
PID 2652 wrote to memory of 2932	2652	msedge.exe	87
PID 2652 wrote to memory of 2932	2652	msedge.exe	87
PID 2652 wrote to memory of 2932	2652	msedge.exe	87
PID 2652 wrote to memory of 2932	2652	msedge.exe	87
PID 2652 wrote to memory of 2932	2652	msedge.exe	87
PID 2652 wrote to memory of 2932	2652	msedge.exe	87
PID 2652 wrote to memory of 2932	2652	msedge.exe	87
PID 2652 wrote to memory of 2932	2652	msedge.exe	87
PID 2652 wrote to memory of 2932	2652	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\apps\admin\view\default\common\foot.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff95a6d46f8,0x7ff95a6d4708,0x7ff95a6d4718
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1816,3229166034083736145,8431029251943571779,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1816,3229166034083736145,8431029251943571779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1816,3229166034083736145,8431029251943571779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,3229166034083736145,8431029251943571779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,3229166034083736145,8431029251943571779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1816,3229166034083736145,8431029251943571779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1816,3229166034083736145,8431029251943571779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,3229166034083736145,8431029251943571779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,3229166034083736145,8431029251943571779,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,3229166034083736145,8431029251943571779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,3229166034083736145,8431029251943571779,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1816,3229166034083736145,8431029251943571779,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4784 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
MD5 4f7152bc5a1a715ef481e37d1c791959
SHA1 c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA512 2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
MD5 ea98e583ad99df195d29aa066204ab56
SHA1 f89398664af0179641aa0138b337097b617cb2db
SHA512 e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 184B
SHA256 300795040b536e036df64b8c4ce90045d07e64c56add9aa8d11598f878ff5d5a
MD5 6fa711522a332e1d8faed8548c0dcfd0
SHA1 0a71bd15b0c22a9af49a37fa09a3468780396f8e
SHA512 ad1782da32d5714ae547c8f8e8b3441cd923aa45d17e5a25b28b8aa5940d90e15c80d33486054324263673f2f21f0b58fd58c7617509da37069b3f3da9243cea
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 94841b793e333b478b7d26244a1f3bf41d94ba029ae5884a1a856f6e75127dbf
MD5 8e484d7b31889a1bc750e905b75a33e9
SHA1 21bbc12d5b6c6ad47cc44147c183ee161b794dc3
SHA512 d3984cbe21a2203436aa14e0360664e2d72601716e865d5a5fee8072514d22b0db35db253a5848d5d37de109641444660ca440d073566b549273d5ec6f89d7fb
SSDEEP 96:nIfk4xm/eQYmqvK1R1yH3XwpvWMoiVmdeHp1k3SUWQyV+VDCziEwb:nIfk5HNT0XXGWMXpuSro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 cd7d642aca2c7b5fb7056dd831378e1aed59a37cf7422d15d1bca4b7bcb6474a
MD5 a149564502f98af3d1974a270553f7c3
SHA1 2f6247d9fa5249dc6bde538874ea86408e27404b
SHA512 296aaa60eed1ea54e52c4e615b5715b0fa75f1f561acedd6f1974719e15e4a035b264945ea5436ff1d73782c2d8305790571998abd57a78f9e6771fab62222a9
SSDEEP 96:nIfk4xm/enmqvK1R1yH3XwpvWMoiVmdeHp1k3SUWQyV+VD7AiEwb:nIfk5ZNT0XXGWMXpuSrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 a4241f88b644c737bcbc6584afd53cf0fb9095b484a6753324d07496da828630
MD5 876ff4e7b0070d511cefa5f0b305cb20
SHA1 1172ece2be9f16cb83dd7776b9cdedb4a6f3314f
SHA512 554f70ee9bdea3997502877df4831d55ed077869be5e86da77eb19bbeafbd0a9886d0b32e7e0c22d4d7db5411ef59a61322c1d233cb69334cb47ff1fd7dfceb4
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup3NS7Ife2RU6o5re+OblfBC:A9iIxuERzA83h09RZxYAcn4re/XDafEA
MD5 SHA1 SHA512 SSDEEP

Submit Download