a330c8fa28ecfbee2f18bd55b0ba0f859e3533eaa61d13b29d1172ec1dfff23b

Analysis

max time kernel
145s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 05:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

application/helpers/index.html
Size

114B
MD5

0227cfd904e99656279202032b98d4a7
SHA1

7f3c810f643e9c100b82520a7c11aed6131f7674
SHA256

0d5819fed1543a314272c42a0b0ec512909f690cb9835d9631abc2f83f3c3c86
SHA512

a39d6f75293deeb537e26a4b7c1aa077f1b27e3d008e99e560312e5081206bdd7856c974aa5cb2b0b20f95d34fbe39bf1941fd62abbb999988293c8986202b7f

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
804	msedge.exe
804	msedge.exe
3584	msedge.exe
3584	msedge.exe
2876	identity_helper.exe
2876	identity_helper.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe
1096	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 3864	3584	msedge.exe	82
PID 3584 wrote to memory of 3864	3584	msedge.exe	82
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 1508	3584	msedge.exe	83
PID 3584 wrote to memory of 804	3584	msedge.exe	84
PID 3584 wrote to memory of 804	3584	msedge.exe	84
PID 3584 wrote to memory of 5024	3584	msedge.exe	85
PID 3584 wrote to memory of 5024	3584	msedge.exe	85
PID 3584 wrote to memory of 5024	3584	msedge.exe	85
PID 3584 wrote to memory of 5024	3584	msedge.exe	85
PID 3584 wrote to memory of 5024	3584	msedge.exe	85
PID 3584 wrote to memory of 5024	3584	msedge.exe	85
PID 3584 wrote to memory of 5024	3584	msedge.exe	85
PID 3584 wrote to memory of 5024	3584	msedge.exe	85
PID 3584 wrote to memory of 5024	3584	msedge.exe	85
PID 3584 wrote to memory of 5024	3584	msedge.exe	85
PID 3584 wrote to memory of 5024	3584	msedge.exe	85
PID 3584 wrote to memory of 5024	3584	msedge.exe	85
PID 3584 wrote to memory of 5024	3584	msedge.exe	85
PID 3584 wrote to memory of 5024	3584	msedge.exe	85
PID 3584 wrote to memory of 5024	3584	msedge.exe	85
PID 3584 wrote to memory of 5024	3584	msedge.exe	85
PID 3584 wrote to memory of 5024	3584	msedge.exe	85
PID 3584 wrote to memory of 5024	3584	msedge.exe	85
PID 3584 wrote to memory of 5024	3584	msedge.exe	85
PID 3584 wrote to memory of 5024	3584	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\application\helpers\index.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb884446f8,0x7ffb88444708,0x7ffb88444718
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,15066457490974990946,11908762061342329844,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,15066457490974990946,11908762061342329844,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,15066457490974990946,11908762061342329844,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15066457490974990946,11908762061342329844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15066457490974990946,11908762061342329844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,15066457490974990946,11908762061342329844,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,15066457490974990946,11908762061342329844,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15066457490974990946,11908762061342329844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15066457490974990946,11908762061342329844,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15066457490974990946,11908762061342329844,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15066457490974990946,11908762061342329844,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,15066457490974990946,11908762061342329844,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bc368270674a5fe5a5e9056a4c05bcd7

SHA1
bf65b2192de06877d9708874f7f6dfb1d3f951b8

SHA256
379f6f7047e19355eebd706d159d64f373c9341829c2c7365b62d513063c7180

SHA512
0d5624f85ded6c9371712395b873b2ec140c4d6a08e3566ca56330619bb267b5c6b8e998460e33e454e2d9ab2c7a609e110fc29e26f4bec6d2cda5c186052344

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a37c1b0ea983f12b7cd43f486fba2e02

SHA1
f008dc7eedba674d992fa8b4be5f22d6680f95bb

SHA256
8f195ba2d0c2a459a7a8798bb9e8aae9d88a963dd85dc4c303e21505589d5186

SHA512
cea5649d15c1b82901287dda5c103e7a28982c6476bdd8401ad36d5ae68ec54fc65f2aab50509c676d8d8b1a327607ce9575362ae72c1d35e0de9402793b0861

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b495d9e9ed5314809724fbbdbb552f66

SHA1
94fae6107eb7a2e13033f43e8174fe1a86d45a0c

SHA256
a7de0846f32d33a8718c315321440441baa2ff83696076e6a44598a622c1dfd3

SHA512
adc03944d925139b8f5c45b3533e6db173aedeff1599d4d9550f1dcfa90a3eec544a7410e16a66a42fc334af7f2c10eccd2a94113a78c86d31cc8d650d77a38e

Download Submit