fa09d24d7481dbdfc1cff6aaa92d2aec908e037a22a02346f6feeee5d6ba688e

Analysis

max time kernel
145s
max time network
135s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
19-05-2024 15:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Plugins/Milkdrop2/docs/milkdrop.html
Size

76KB
MD5

a7fded8f052ed6ffcc61702ec6a528d0
SHA1

5a3b0ff72e4f3ac91e04cce22669e1d3e8546984
SHA256

13f5186a57165cc65c046ebb1a36d64a6c722f595beb1fdd37df5642842467af
SHA512

05cd56e832d13da935f9e705490ae9195f54dfaa01f626d0e77533c20a83015279e7a079040e6515f99098175e908b9ab126443adc3d0e9ff10d0160fedea38c
SSDEEP

1536:2jg7YupSrU2ZXeI5qIEUPVdn1F6wmFwki:2jrupSrFuMquzn1FdOwV

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
1560	msedge.exe
1560	msedge.exe
4024	msedge.exe
4024	msedge.exe
5104	identity_helper.exe
5104	identity_helper.exe
4596	msedge.exe
4596	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

4024 msedge.exe
4024 msedge.exe
4024 msedge.exe
4024 msedge.exe
4024 msedge.exe
4024 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4024 wrote to memory of 2220	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 2220	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 3640	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 1560	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 1560	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 1312	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 1312	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 1312	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 1312	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 1312	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 1312	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 1312	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 1312	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 1312	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 1312	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 1312	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 1312	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 1312	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 1312	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 1312	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 1312	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 1312	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 1312	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 1312	4024	msedge.exe	msedge.exe
PID 4024 wrote to memory of 1312	4024	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Plugins\Milkdrop2\docs\milkdrop.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe1cc83cb8,0x7ffe1cc83cc8,0x7ffe1cc83cd8
2⤵
PID:2220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,2191793608544709722,10368133902667113077,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
2⤵
PID:3640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,2191793608544709722,10368133902667113077,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,2191793608544709722,10368133902667113077,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
2⤵
PID:1312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2191793608544709722,10368133902667113077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
2⤵
PID:744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2191793608544709722,10368133902667113077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
2⤵
PID:2448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2191793608544709722,10368133902667113077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
2⤵
PID:1460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2191793608544709722,10368133902667113077,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
2⤵
PID:2152

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,2191793608544709722,10368133902667113077,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2191793608544709722,10368133902667113077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
2⤵
PID:4776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,2191793608544709722,10368133902667113077,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
2⤵
PID:3380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,2191793608544709722,10368133902667113077,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4084 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,2191793608544709722,10368133902667113077,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3508 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6876cbd342d4d6b236f44f52c50f780f

SHA1
a215cf6a499bfb67a3266d211844ec4c82128d83

SHA256
ca5a6320d94ee74db11e55893a42a52c56c8f067cba35594d507b593d993451e

SHA512
dff3675753b6b733ffa2da73d28a250a52ab29620935960673d77fe2f90d37a273c8c6afdf87db959bdb49f31b69b41f7aa4febac5bbdd43a9706a4dd9705039

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c1c7e2f451eb3836d23007799bc21d5f

SHA1
11a25f6055210aa7f99d77346b0d4f1dc123ce79

SHA256
429a870d582c77c8a661c8cc3f4afa424ed5faf64ce722f51a6a74f66b21c800

SHA512
2ca40bbbe76488dff4b10cca78a81ecf2e97d75cd65f301da4414d93e08e33f231171d455b0dbf012b2d4735428e835bf3631f678f0ab203383e315da2d23a34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d82503c4ace3c784f875ca3a1a71c420

SHA1
443e9b01ec222ab9abc41d6414b90b13f589e31b

SHA256
6137c2d089a40a39b19b2d1d198436e6e7c1f049462e4d07e7cf9ddcb90d4dcf

SHA512
e8cc4028e3d304a5343e4be70e6bf21373312eaebe1ea3290d546edf7bf7b06782ffa3771844993302b66ba2af7eac6cf86d5f409e2b2044524e2eb6b23b0da4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
082091bed864c21ff35e266308dd8e06

SHA1
e71e156acf8c6b9bdbbd98b70420d304aa1266e0

SHA256
bf7c27e2371940461d12c463c123093466ba7b296809d2038e43dac775530f1e

SHA512
7b8d4ad4089d782efb7086967900e0882e67668eea4c0f701723faff16ae0eb7ef9d16a6c0c60fb6f9ccdc27ef643deb7483110063e4e7e44bd4ee5e24d2fea6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e21a83c080e38a96d3fef3377bef950f

SHA1
1bb552d6c04570687f4db1724179ea82106e7dfe

SHA256
1a720cb96a1841200a177234b50be96b8808e1e2d58d6c89751f63d1b084ed73

SHA512
80d57b869c58d7a50f40277d280d7fb13ffabf04e7d63ca54ed783b73b40d67a17fccee0685bdc810577e1a04f8eb3738c54316eb26e7f22219520d576cc3b62

Download Submit
\??\pipe\LOCAL\crashpad_4024_FEMGFVBZMCGCFTDZ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit