9424128833a503e72a27491b27e772139f5c5e078f7d7401048feb17e82f2fca

Analysis

max time kernel
145s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
22-05-2024 09:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

features/org.eclipse.cvs_1.4.404.v20180330-0640/license.html
Size

8KB
MD5

1fabf1d6edd14f933014d5557c7b7522
SHA1

67958aa114880c281036cc14a4e53fa123c4d9ad
SHA256

5f7d79ccbca7bdd2d9e036984a8a60c6bb9051411a740dc538f36f882f983b6e
SHA512

4c4f2caafc7ea9e97303f31c6f6a192a64fea4f24cc9d071b8339a519c1ea7f951e14571c9e9a23eee140fb676c7b213dc25828b274639046d9e01f6cd85dd3b
SSDEEP

192:BKd0PKSgaKbWKG7Mh2NdbqXu60oCNKzsYck5DWMbr+y6dmrM0Zqp:BKd1aKSKYMhgKIYf4I+y6d0vZ4

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1560	msedge.exe
1560	msedge.exe
432	msedge.exe
432	msedge.exe
4840	msedge.exe
4840	msedge.exe
4348	identity_helper.exe
4348	identity_helper.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

432 msedge.exe
432 msedge.exe
432 msedge.exe
432 msedge.exe
432 msedge.exe
432 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 432 wrote to memory of 5024	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 5024	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1492	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1560	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1560	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4688	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4688	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4688	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4688	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4688	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4688	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4688	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4688	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4688	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4688	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4688	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4688	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4688	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4688	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4688	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4688	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4688	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4688	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4688	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4688	432	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\features\org.eclipse.cvs_1.4.404.v20180330-0640\license.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb844a3cb8,0x7ffb844a3cc8,0x7ffb844a3cd8
2⤵
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,3053420457890489496,141794214471591617,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
2⤵
PID:1492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,3053420457890489496,141794214471591617,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,3053420457890489496,141794214471591617,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
2⤵
PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3053420457890489496,141794214471591617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
2⤵
PID:2464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3053420457890489496,141794214471591617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
2⤵
PID:2380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3053420457890489496,141794214471591617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
2⤵
PID:644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3053420457890489496,141794214471591617,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
2⤵
PID:3404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3053420457890489496,141794214471591617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
2⤵
PID:2284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,3053420457890489496,141794214471591617,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
2⤵
PID:4900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,3053420457890489496,141794214471591617,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4840

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,3053420457890489496,141794214471591617,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,3053420457890489496,141794214471591617,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5032 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e4bf11ed97b6b312e938ca216cf30e

SHA1
ff6b0b475e552dc08a2c81c9eb9230821d3c8290

SHA256
296db8c9361efb62e23be1935fd172cfe9fbcd89a424f34f347ec3cc5ca5afad

SHA512
ce1a05df2619af419ed3058dcbd7254c7159d333356d9f1d5e2591c19e17ab0ac9b6d3e625e36246ad187256bee75b7011370220ef127c4f1171879014d0dd76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
23da8c216a7633c78c347cc80603cd99

SHA1
a378873c9d3484e0c57c1cb6c6895f34fee0ea61

SHA256
03dbdb03799f9e37c38f6d9d498ad09f7f0f9901430ff69d95aa26cae87504d3

SHA512
d34ae684e8462e3f2aba2260f2649dee01b4e2138b50283513c8c19c47faf039701854e1a9cbf21d7a20c28a6306f953b58ffb9144ead067f5f73650a759ff17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c39526f3ec5729e765ba973f4450365d

SHA1
1c1efb1a6f5c7bbc12b12d597ecbd75dfa8c2711

SHA256
f9ff97ee3c22eeaa3b8a34359513d3eea8e61266e438543746ca64efc4494483

SHA512
69478fc8e6b333fe26f3b3fbce16b12fc9401f82f0debb2eda130a89690dcadaf9ba2624b52289ab20b8f10c79c5c6d1e51bb99a34eaaa2ed6a0c8dc41c02743

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d9170c733037d0745c371788ba313fa4

SHA1
83f81aff40b706b33fccca53ce73ea29397cbdcc

SHA256
682a94b66df03dfdc68302d3a3527cbac75d53ba9cdaae35aa14e24cad85413c

SHA512
c12956004021d5be6294830c0e55b9b7194241414a1a49b16084353561cc908286d2ab98743f01113b8df5c4769b8191456d266cbb28a0580d04df18306a6d61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dc26e23f3c9079c64070e4b19cefc82f

SHA1
25462a7c944cfb540ec4a21b5f918c41cced8265

SHA256
9465ebf88127454b9747011243d86ac8edb10c2892f2a1d62a98853c9ddf5eb7

SHA512
757804af0a8cea18dee784db2387281946d2f1e742bd257e8b3830e8618e3c7fcb905c948c11d4531a424e187708db507ee628fa5de0ff7652219913f41e959e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3e98e19dc91b1cb93ca2070ecc300e6d

SHA1
28e32bb7e5347539462cc3ea342d8fb9b6e1a3d2

SHA256
5ade4beb043658eaad46db95bbdf55b1fc569f248ccdc164fe0e11d4a0b387a8

SHA512
b5c1408ec8cf23fb8e5d2057cd7fce87a1bb35b12731480d26e8547fb1d6d6902a5e16fee198cf7510784d52b242042ca08003b3ec2d74b37b01e08a739adc33

Download Submit
\??\pipe\LOCAL\crashpad_432_BADRFBEXYRGUYVME

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit