fe22e0a3594bff1aaa8daa3d102e840bde89ea342a3e16dfb1ee298f08e5696f

Analysis

max time kernel
145s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 08:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$R1/script/dialog.html
Size

1KB
MD5

d800fdd62461179fd537c8c4669dd5e8
SHA1

d44bcee9d9e63d50e8ed42be2ce1a3964870a5aa
SHA256

4af54a319e8be177e2d48f4effcce3ca98c3bc564e3f46b4b7e14471fdfba1c9
SHA512

e0670d9dee7e15520085d269224a4188f09fe753bf3041a9c1f0246771b1928c4fc644e17633a2e08fa02e4064518945afaaa6bdc098ee41288dda42854f5083

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3584	msedge.exe
3584	msedge.exe
4308	msedge.exe
4308	msedge.exe
640	identity_helper.exe
640	identity_helper.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe
4308	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 4396	4308	msedge.exe	84
PID 4308 wrote to memory of 4396	4308	msedge.exe	84
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 1560	4308	msedge.exe	85
PID 4308 wrote to memory of 3584	4308	msedge.exe	86
PID 4308 wrote to memory of 3584	4308	msedge.exe	86
PID 4308 wrote to memory of 2060	4308	msedge.exe	87
PID 4308 wrote to memory of 2060	4308	msedge.exe	87
PID 4308 wrote to memory of 2060	4308	msedge.exe	87
PID 4308 wrote to memory of 2060	4308	msedge.exe	87
PID 4308 wrote to memory of 2060	4308	msedge.exe	87
PID 4308 wrote to memory of 2060	4308	msedge.exe	87
PID 4308 wrote to memory of 2060	4308	msedge.exe	87
PID 4308 wrote to memory of 2060	4308	msedge.exe	87
PID 4308 wrote to memory of 2060	4308	msedge.exe	87
PID 4308 wrote to memory of 2060	4308	msedge.exe	87
PID 4308 wrote to memory of 2060	4308	msedge.exe	87
PID 4308 wrote to memory of 2060	4308	msedge.exe	87
PID 4308 wrote to memory of 2060	4308	msedge.exe	87
PID 4308 wrote to memory of 2060	4308	msedge.exe	87
PID 4308 wrote to memory of 2060	4308	msedge.exe	87
PID 4308 wrote to memory of 2060	4308	msedge.exe	87
PID 4308 wrote to memory of 2060	4308	msedge.exe	87
PID 4308 wrote to memory of 2060	4308	msedge.exe	87
PID 4308 wrote to memory of 2060	4308	msedge.exe	87
PID 4308 wrote to memory of 2060	4308	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\$R1\script\dialog.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd1bc46f8,0x7ffcd1bc4708,0x7ffcd1bc4718
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,53810838453236412,10348629075582853866,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,53810838453236412,10348629075582853866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,53810838453236412,10348629075582853866,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,53810838453236412,10348629075582853866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,53810838453236412,10348629075582853866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,53810838453236412,10348629075582853866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,53810838453236412,10348629075582853866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,53810838453236412,10348629075582853866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,53810838453236412,10348629075582853866,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,53810838453236412,10348629075582853866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,53810838453236412,10348629075582853866,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,53810838453236412,10348629075582853866,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5314ce7b2de2249cfc3b8b8a1e540925

SHA1
92249de850b611e945ab9beb8adc58f6bfacb885

SHA256
f8c64c7b8326f4acab3394524456dda45c23c5b897fd75e9fdde555bb8d2c868

SHA512
fbbe7ef8afe2bb8f80999d8f9e7d2ba17a78828c8ee7e1aa268184d1b346425655c0637fe5fdc5164e12446d2ab0cb2977268817a6882033feb1cf08b5971846

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e12477d1012fc208f6fcffd90f0bdc1f

SHA1
3ef6749e4ce7b00bad6edc431edf0c31ea7992ff

SHA256
601b9cd8dcfd2f2a9940e140b75d5511cd5c43fecc64dcfa823ded70a5f50283

SHA512
5c351ec4c1ecd964b4b3542ddd8df4b98c7699aef368e9bb572519ffbe56d983efd4ad674a7225922dad336941f799cf5e76f503931a829e9104af1dc64cbb44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
344542160349e53ebc93a617673f567d

SHA1
abed9293bc59686ec307d4e0f5542644a2790001

SHA256
e5255f6171ecdda146672de58aac849c37c6e886d9e54a305b784410cfecdab2

SHA512
72455cdf10ac80b116dc71ec97e8132683c0cf3461775be4612318be76443cb07243acd5bb67312520b4ad4e09ce21beefb971cff137fbe9b833937ea5227591

Download Submit