hxxps://pub-386574dc51114476911e60d1ef1a2e6f[.]r2[.]dev/CHAMELEO[.]html

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 21:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://pub-386574dc51114476911e60d1ef1a2e6f.r2.dev/CHAMELEO.html

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4732	msedge.exe
4732	msedge.exe
468	msedge.exe
468	msedge.exe
3120	identity_helper.exe
3120	identity_helper.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

468 msedge.exe
468 msedge.exe
468 msedge.exe
468 msedge.exe
468 msedge.exe
468 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe
468	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 468 wrote to memory of 1312	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1312	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 1928	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 4732	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 4732	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 3712	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 3712	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 3712	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 3712	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 3712	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 3712	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 3712	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 3712	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 3712	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 3712	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 3712	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 3712	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 3712	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 3712	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 3712	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 3712	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 3712	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 3712	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 3712	468	msedge.exe	msedge.exe
PID 468 wrote to memory of 3712	468	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://pub-386574dc51114476911e60d1ef1a2e6f.r2.dev/CHAMELEO.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed0d246f8,0x7ffed0d24708,0x7ffed0d24718
2⤵
PID:1312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,10097094450560463382,3103621921901100703,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
2⤵
PID:1928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,10097094450560463382,3103621921901100703,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,10097094450560463382,3103621921901100703,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
2⤵
PID:3712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10097094450560463382,3103621921901100703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
2⤵
PID:3936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10097094450560463382,3103621921901100703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
2⤵
PID:540

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,10097094450560463382,3103621921901100703,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
2⤵
PID:4648

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,10097094450560463382,3103621921901100703,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10097094450560463382,3103621921901100703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
2⤵
PID:1592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10097094450560463382,3103621921901100703,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
2⤵
PID:4968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10097094450560463382,3103621921901100703,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
2⤵
PID:5220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10097094450560463382,3103621921901100703,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
2⤵
PID:5228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,10097094450560463382,3103621921901100703,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1428 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4416

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
192B

MD5
0f029d7cada3d58c9e45c826169c8131

SHA1
9a0bd8dfde9035c0a1dd5ef6a3e1db3920fa25f3

SHA256
104580cdf56e49ebbd6f3de2e5361cb760d255a3c33f5d7a70142fc149c87992

SHA512
534c513d82ff2fedf87041969d67804a2e04120a4114e0b78e54a5976f720567ccb4da62d7263c3dffcdcdc6d50ef0f94890b989c3433cbc6e7061628c784dd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
b2f0746b8666bea1d9104cee840b91b0

SHA1
9f3207a5024b3871d3b5f00bcb3e3b4db5a91003

SHA256
de0dbd0b667e8770c28ffddc2553abe55f3b4c10103706fc7abeb2df10615b10

SHA512
7246ec746c5a1f79e2df9c196b84ac7e6cceda7ea6f04fe9743fa32132cc518898470d90ab948127f1a5e9a62dc0e211125a2fe84fe3726023a6c6fa6f5349f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
4dbe70e920e0c3979e55bfaef3b8a6c6

SHA1
de84ba665f761548924bd5063e15b94474eb291e

SHA256
c3993474b1d3ef43815c8494fe5e33dd97a65285ab8459f8c889c07e06032fe9

SHA512
b5eecb2890ae128fb72ed10c89882967d5e7c1d00c1dd72f6cf0d6ed606c348cacdb08c858b02e8624957afd631d456477e29d9789b5c240c9917aaa7f04430e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
f0b7715a1e2c1404956d268e97c3b656

SHA1
384cef07657f7a0b3ed2987fda7dbab79de7d41b

SHA256
e428787afc0bb5f27caa9f91d352302d0b9e808b6a2b046e7d9941bd26f4ebdb

SHA512
37dbae66332fad8623e0dec94ae5338413c9adb5a4967cf85b998bc4e87123813e5479574b2254665d1668309b9772a6926861a67ad25b606022a1e6c178779d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
70ec9dbc877d3a020f5b7a639047f24a

SHA1
c3c69c7ff7e8e8b413193eab3b898484e9d00189

SHA256
3d2fc2c37153d1991bd3a37a73b0ac16acc2dc919947cc03fb3d8d8ede91dffa

SHA512
c81907c78091fcaa43b76bce8f034242fd3cb440947629c19aff88bed5f0b549629398f43c7b565102038f1f33f9423aef37e6c38718cac073d9a632a0c25d76

Download Submit
\??\pipe\LOCAL\crashpad_468_AVIVOTXAHQKWSZIG
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit