hxxps://www[.]hybrid-analysis[.]com/feed?json

Analysis

max time kernel
209s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 06:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.hybrid-analysis.com/feed?json

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3448	msedge.exe
3448	msedge.exe
4548	msedge.exe
4548	msedge.exe
3084	identity_helper.exe
3084	identity_helper.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 4916	4548	msedge.exe	84
PID 4548 wrote to memory of 4916	4548	msedge.exe	84
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 532	4548	msedge.exe	85
PID 4548 wrote to memory of 3448	4548	msedge.exe	86
PID 4548 wrote to memory of 3448	4548	msedge.exe	86
PID 4548 wrote to memory of 832	4548	msedge.exe	87
PID 4548 wrote to memory of 832	4548	msedge.exe	87
PID 4548 wrote to memory of 832	4548	msedge.exe	87
PID 4548 wrote to memory of 832	4548	msedge.exe	87
PID 4548 wrote to memory of 832	4548	msedge.exe	87
PID 4548 wrote to memory of 832	4548	msedge.exe	87
PID 4548 wrote to memory of 832	4548	msedge.exe	87
PID 4548 wrote to memory of 832	4548	msedge.exe	87
PID 4548 wrote to memory of 832	4548	msedge.exe	87
PID 4548 wrote to memory of 832	4548	msedge.exe	87
PID 4548 wrote to memory of 832	4548	msedge.exe	87
PID 4548 wrote to memory of 832	4548	msedge.exe	87
PID 4548 wrote to memory of 832	4548	msedge.exe	87
PID 4548 wrote to memory of 832	4548	msedge.exe	87
PID 4548 wrote to memory of 832	4548	msedge.exe	87
PID 4548 wrote to memory of 832	4548	msedge.exe	87
PID 4548 wrote to memory of 832	4548	msedge.exe	87
PID 4548 wrote to memory of 832	4548	msedge.exe	87
PID 4548 wrote to memory of 832	4548	msedge.exe	87
PID 4548 wrote to memory of 832	4548	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.hybrid-analysis.com/feed?json
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff351a46f8,0x7fff351a4708,0x7fff351a4718
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,18030210596965567290,8060887842145782062,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,18030210596965567290,8060887842145782062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,18030210596965567290,8060887842145782062,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18030210596965567290,8060887842145782062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18030210596965567290,8060887842145782062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,18030210596965567290,8060887842145782062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,18030210596965567290,8060887842145782062,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18030210596965567290,8060887842145782062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18030210596965567290,8060887842145782062,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18030210596965567290,8060887842145782062,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,18030210596965567290,8060887842145782062,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,18030210596965567290,8060887842145782062,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3572 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62c02dda2bf22d702a9b3a1c547c5f6a

SHA1
8f42966df96bd2e8c1f6b31b37c9a19beb6394d6

SHA256
cb8a0964605551ed5a0668c08ab888044bbd845c9225ffee5a28e0b847ede62b

SHA512
a7ce2c0946382188e1d8480cfb096b29bd0dcb260ccdc74167cc351160a1884d04d57a2517eb700b3eef30eaf4a01bfbf31858365b1e624d4b0960ffd0032fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
850f27f857369bf7fe83c613d2ec35cb

SHA1
7677a061c6fd2a030b44841bfb32da0abc1dbefb

SHA256
a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a

SHA512
7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
191B

MD5
8e9788a644e235e1a76f40bc09a77667

SHA1
7d4d46972b3c3b4612bc8d04c52a3e11cc16dfdf

SHA256
98c6978ad381f77905100ff332f77b917d10d0afc8dd968be83a695ecf2ccf45

SHA512
a7584319177327b8a8b650be442697a2121328d56a0bf6a74b0751540dc80176d8d6bd2cbe380f89d345fe2e38e98dcb5195de480e106979ed19c94cf25269d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
057717dcabaf23e59357c66867a7d1ba

SHA1
144c0dd2425ad76aadf9245a1c1a7b82e2e751cc

SHA256
8f28bef1e6f3dc401676e03b75f923951d481850c73ac84ac7ec50e638f8265c

SHA512
3a91fac227fddf58d7754076a8a2bffd11a683494c44c119b6e16ee63042d006570c5c6988a37f152c7c9e7bc9b8c2684df1bc96d43295d0dff9f3337bd820dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e312604f4f497302cb8af39a39d8b50a

SHA1
0f1c8ebafccfa9dd709ec887510542d55a9d293e

SHA256
93fbf6aad1c79cccf60fb3265b7ca33162216f6316e847aaf47fe8269f790052

SHA512
49a91771108375f2e141714157a06af893e19f79b0f846efe5cfcb2d9e9851eb7554460f95891f03e990c7654c2d556fee125dbfda5383533b1bceb7171c8568

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e63d890ff54d515b361fec461c0cffb0

SHA1
6c5ceb53ab6ed899a3f6bc3c716d2c49c57a9850

SHA256
babc4ea418394fcfe985c4f276a59c83ca426be91505c00d039186521c035db0

SHA512
ad1a6ac735490ab95aba75a603d7316ae75b073a73eea64524923797a649d08874f0ad0209dfa2917e7e8e933cf40c44d2633b4ec01b72bea35587a41142105e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
072c7c1a7a8531b43b33793fa6cc469b

SHA1
bc753d1d7231594fa12f60aaa6cf83e10cebaabe

SHA256
81e68c9c1f0355a2b460cfc58b57dd4cc0e37716fbc69651d1a746308ddc3ba9

SHA512
302b65fce285667edf9cab5b00880d7e1e9378bc19b3cf06508b822ef7c2c7f8f05c75870c8b3515b292e7c77ee2d9c8976082417e3ea8cfb2f13c8ed86b12ab

Download Submit