hxxps://www[.]malwarebytes[.]com

Analysis

max time kernel
1800s
max time network
1794s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 16:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.malwarebytes.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4024	msedge.exe
4024	msedge.exe
4044	msedge.exe
4044	msedge.exe
4628	identity_helper.exe
4628	identity_helper.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 4064	4044	msedge.exe	85
PID 4044 wrote to memory of 4064	4044	msedge.exe	85
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4372	4044	msedge.exe	86
PID 4044 wrote to memory of 4024	4044	msedge.exe	87
PID 4044 wrote to memory of 4024	4044	msedge.exe	87
PID 4044 wrote to memory of 3260	4044	msedge.exe	88
PID 4044 wrote to memory of 3260	4044	msedge.exe	88
PID 4044 wrote to memory of 3260	4044	msedge.exe	88
PID 4044 wrote to memory of 3260	4044	msedge.exe	88
PID 4044 wrote to memory of 3260	4044	msedge.exe	88
PID 4044 wrote to memory of 3260	4044	msedge.exe	88
PID 4044 wrote to memory of 3260	4044	msedge.exe	88
PID 4044 wrote to memory of 3260	4044	msedge.exe	88
PID 4044 wrote to memory of 3260	4044	msedge.exe	88
PID 4044 wrote to memory of 3260	4044	msedge.exe	88
PID 4044 wrote to memory of 3260	4044	msedge.exe	88
PID 4044 wrote to memory of 3260	4044	msedge.exe	88
PID 4044 wrote to memory of 3260	4044	msedge.exe	88
PID 4044 wrote to memory of 3260	4044	msedge.exe	88
PID 4044 wrote to memory of 3260	4044	msedge.exe	88
PID 4044 wrote to memory of 3260	4044	msedge.exe	88
PID 4044 wrote to memory of 3260	4044	msedge.exe	88
PID 4044 wrote to memory of 3260	4044	msedge.exe	88
PID 4044 wrote to memory of 3260	4044	msedge.exe	88
PID 4044 wrote to memory of 3260	4044	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.malwarebytes.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6d1046f8,0x7ffd6d104708,0x7ffd6d104718
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,16605836741089487491,823189541500356518,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,16605836741089487491,823189541500356518,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,16605836741089487491,823189541500356518,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,16605836741089487491,823189541500356518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,16605836741089487491,823189541500356518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,16605836741089487491,823189541500356518,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4136 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,16605836741089487491,823189541500356518,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,16605836741089487491,823189541500356518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,16605836741089487491,823189541500356518,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,16605836741089487491,823189541500356518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,16605836741089487491,823189541500356518,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,16605836741089487491,823189541500356518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,16605836741089487491,823189541500356518,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3184 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
947de02d722ad4f66a3d657b79cc3d42

SHA1
f900aec07c01221156ef60debb329f2eb3e62ab7

SHA256
aff3836f9b16ecab2c97979be51465ad92428db3051524f14163b71138e05a93

SHA512
9fd922c7d9d14d2133e9e8ae120b605086159964026094cb0e6d6427f7bef4c7cc08428b98a883821653dfd17c70ff66d4640c3adf944099ba1636c295d53f1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2076c3cfb92a1fee0da0bcab1977f160

SHA1
4de1f16fbe1898cccdbc36843aee3beedd578453

SHA256
ccf246f997bf77d2e63e54ceef2ef78fa0b7fcf5c7c05fd7da727603fbfc354f

SHA512
7a907ef618acd8d38cad17502e2c0ee2bde0b4f3c6b4964fca9c625b4f27aba41a1e464d2ae19ff247c9290c32c96648e9f70d939b16a1a044187f922e58b09b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2616f83c7d4d88aa6c8d1c64d0f893a8

SHA1
c0849658f184f2bb000dbd14c420e3a814a96ab5

SHA256
4ea114da1061a3a13bb8c6f46391ab4583c2fe317a8969e3ddd8e0f0e1d81a0f

SHA512
c7fccc42de37f78737896682619350d929dfc2b54b4e2b219be432d663112bfc398432a64dc8733a973d96549458b0820f2c8a340a925dde60348b1c349ea42a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e606f7d7d52fb22feea1efff2e1e7ca6

SHA1
bd163e7c12c15a544b45a9dcb46db9a67b6e8b3b

SHA256
5911bcecc66fafc5eb27eb6a51c1cfa09b2beac8718a2afa757114565f319077

SHA512
1a6850aa00ebcd63397bbcaa61b311b11424c46fb21fe59d2a4791ed7ddc366ed55ab61232de93c6eca9ad613b82b7ceeb10bd1f921b8de53465864b1c799e2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1f111a3305e738bf3f97adc5803878f8

SHA1
4cb3cac3294390eeb543398c41257f75163d3dc1

SHA256
2ae118dd13be55a8d67745386c239afe46e208d3a657312be7634c61dab9a5f2

SHA512
bd0ed8a75ee0abc65dfca6672e68547b83ff4b2625a7798f901d39ebe996b9c3786c69f48e1b5c4aaaca0b3c4478c9e20c507a9b550cac711eceafe14977d24d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ae4bc565f400ab15cc502afaa41b41c8

SHA1
072a9daa09ce7cc99817b7100194643e3485c93e

SHA256
db74ace3ef26460927bd999971063d3d0865f1b00517a94f13830090462d7f21

SHA512
bf0cd48334eb3648d57ba55cd49d2bc41775eca74551b9302c3dc4744771a1acf7fd5388334193097b8aef49434f7ba6ef27666805dc98a3b031f95b795461e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c40b.TMP

Filesize
705B

MD5
dadf01297894cf5daeaa8d541ca543b1

SHA1
64450f20d0a8d4b8275b0d3463b9a5919fa634a9

SHA256
37a9deecffd64096852353f49b3e43b729fe2c0742bc01180295a303a5ed10d6

SHA512
b59a7aaed4779f401bc10dd669006e815d4bc1bfff36446e414d3e58229c5c5646997a0f17c51cf891a94647af29849627894a38d1c19e8552bd493dc524390b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
64b9f20fe22585f2aad03488b67f6962

SHA1
58713f21e9c0371a09c13c70201c4abe67e92439

SHA256
5257e89b63632e4b08b72f81b2051a09c572d3586d01c5c0ecc68d8bb93ed7d7

SHA512
8288c175622ee4826b161fae354b36f344062ade38fa1708056befd3916d46c3593a4d9514b1473d418dc374de350cfede125154abaf7239e7c16f08a54dc43a

Download Submit