eadcf660e731fd3de0a5a8bee2f2337e7d78438f4e9293d2c90d5e63a2d9368e

Resubmissions

26-07-2024 08:19

240726-j7ytkszeqd 3

07-05-2024 20:40

240507-zgaxtseg4v 10

23-04-2024 21:09

240423-zzq2rsca28 7

Analysis

max time kernel
146s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 20:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

8.4MB
MD5

e400cd908b8fb7c13985e2f5cc7a7044
SHA1

bbafebdf5b067a7d7da130025851eaa52ec3c9d7
SHA256

ee3b1ab8794c749673ce9bd2dd302f12d69f0a1a4adfe40a64247746cc311829
SHA512

e7ca440f0e042d7fcfa99367426bf19899a2b227c6d7b6e2c25d4f1a40113250f21ebeaaf91067d8569dfbad1415d4fe3e5626d7254722f2778497fcb22e5d6e
SSDEEP

24576:/UrV6CI675knWSgRBPyQlrUmf1C6C6y6Z6/678HqBMUpuQ:MsWKA

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4844	msedge.exe
4844	msedge.exe
2092	msedge.exe
2092	msedge.exe
2644	identity_helper.exe
2644	identity_helper.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe
5268	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

2092 msedge.exe
2092 msedge.exe
2092 msedge.exe
2092 msedge.exe
2092 msedge.exe
2092 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2092 wrote to memory of 3152	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 3152	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 5220	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 4844	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 4844	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 2576	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 2576	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 2576	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 2576	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 2576	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 2576	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 2576	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 2576	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 2576	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 2576	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 2576	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 2576	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 2576	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 2576	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 2576	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 2576	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 2576	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 2576	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 2576	2092	msedge.exe	msedge.exe
PID 2092 wrote to memory of 2576	2092	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd3c846f8,0x7ffdd3c84708,0x7ffdd3c84718
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,8438065969637043162,2912787125042208314,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,8438065969637043162,2912787125042208314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,8438065969637043162,2912787125042208314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,8438065969637043162,2912787125042208314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,8438065969637043162,2912787125042208314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,8438065969637043162,2912787125042208314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,8438065969637043162,2912787125042208314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,8438065969637043162,2912787125042208314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,8438065969637043162,2912787125042208314,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,8438065969637043162,2912787125042208314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,8438065969637043162,2912787125042208314,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,8438065969637043162,2912787125042208314,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4844 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9dc60aef38e7832217e7fa02d6f0d9f6

SHA1
4f8539dc7d5739b36fe976a932338f459d066db6

SHA256
8a0ee0b6fafabb256571b691c2faf77c7244945faa749c72124d5eb43a197a32

SHA512
18371541811910992c2b84a8eae7e997e8627640bdb60b9e82751389e50931db9b3e206d31f4d9d2dc3ca25ea3a82c0be413ecb0ef3ac227a14e54f406eaa7e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7ac03b15b68af2d5cb5c8063057cc83e

SHA1
9b2d4db737f57322ff5c4bbddd765b3177f930ab

SHA256
b90d7596301470b389842eecb46bd3a8e614260b0d374d5c35a36afb9c71a700

SHA512
a5e9f40dd9040803046b0218fab6b058d49e5e2a3ada315e161fe9fc80ebb8d6d4442ccc1c98d19e561fc7c61bcf43d662fe2231cacacb447876a2113c2e3732

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4efcd7c8-0524-4fad-877e-7959d3e98cd4.tmp

Filesize
6KB

MD5
943bd72ac82628d5445dfaa5dccfce4e

SHA1
8119a5aa28e6f1ad644af520f1d2458428ded0b6

SHA256
992cd5f493758de857ce4da101eea22b995bdaac8a94c99ea8dc1342d56ed07e

SHA512
057765e3bda098684583d7eae495d6859fcc5850f3ed1f59955f3a4f60db27ef12fbbf8601940a3b19b8561d3dbd18d933556a1cbf321806f486a6d93396a7d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
529ac650eec6e6d3dfe42dc6d522d9cc

SHA1
5767c8f0773e80a19751c35b47045a322ac3b35c

SHA256
aec8c4dc20b6af692cd7916d910f467057e7be6a137e4f165e9299403e4dd71a

SHA512
266c4b6bf2cc59aa3a7ced44a683c691bfab7532aaf6d5e933980e68791a13f2b82579cc18df772ac18426a18c1803b97bd9af2433fb3a7e2159d5cb48bd3126

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e75f1aaaf0561f2ea7b3607eb7de1fdb

SHA1
24c6fcb8d2e0d650fd102f01010b9b86f224962a

SHA256
f0bc45ca9e4c265b783d35dd8e01857ef0250fb92cb4d2921185bbb0caa861ac

SHA512
7459247a4e51b8fc5f14403cbae15edb64cc118043826951ed3ffb730a437afec45219f6412c3cb378e6c964ae950477bdf81522be91435998cda5cd4a779867

Download Submit
\??\pipe\LOCAL\crashpad_2092_GFEEUOXEHVMCVCDI

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit