4792a7d94f2c2adfb2e55d477adcecb2b415a0170ca62438bfb4bc349856d6db

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 09:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

nord-external-main/dependencies/glfw-3.3.8.bin.WIN32/docs/html/vulkan_8dox.html
Size

2KB
MD5

7dddb34f16d25fa7f617b82bf786ce45
SHA1

8dc8a0e4b8addf88451b708e6e9aa29baf5cb118
SHA256

61c04961bb874ca7777f75b5961375664ce7e938e0f52bb5690eee7ab07106d2
SHA512

722e4a390968124a019e42763af2adad3a8898851e4b70f6e361f00489b56ff2b07b2af6f194828957b6f526cb612151a80707addb8f7e3a47631afb1e05bbc2

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
460	msedge.exe
460	msedge.exe
2884	msedge.exe
2884	msedge.exe
448	identity_helper.exe
448	identity_helper.exe
5272	msedge.exe
5272	msedge.exe
5272	msedge.exe
5272	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2024	2884	msedge.exe	86
PID 2884 wrote to memory of 2024	2884	msedge.exe	86
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 1472	2884	msedge.exe	87
PID 2884 wrote to memory of 460	2884	msedge.exe	88
PID 2884 wrote to memory of 460	2884	msedge.exe	88
PID 2884 wrote to memory of 3040	2884	msedge.exe	89
PID 2884 wrote to memory of 3040	2884	msedge.exe	89
PID 2884 wrote to memory of 3040	2884	msedge.exe	89
PID 2884 wrote to memory of 3040	2884	msedge.exe	89
PID 2884 wrote to memory of 3040	2884	msedge.exe	89
PID 2884 wrote to memory of 3040	2884	msedge.exe	89
PID 2884 wrote to memory of 3040	2884	msedge.exe	89
PID 2884 wrote to memory of 3040	2884	msedge.exe	89
PID 2884 wrote to memory of 3040	2884	msedge.exe	89
PID 2884 wrote to memory of 3040	2884	msedge.exe	89
PID 2884 wrote to memory of 3040	2884	msedge.exe	89
PID 2884 wrote to memory of 3040	2884	msedge.exe	89
PID 2884 wrote to memory of 3040	2884	msedge.exe	89
PID 2884 wrote to memory of 3040	2884	msedge.exe	89
PID 2884 wrote to memory of 3040	2884	msedge.exe	89
PID 2884 wrote to memory of 3040	2884	msedge.exe	89
PID 2884 wrote to memory of 3040	2884	msedge.exe	89
PID 2884 wrote to memory of 3040	2884	msedge.exe	89
PID 2884 wrote to memory of 3040	2884	msedge.exe	89
PID 2884 wrote to memory of 3040	2884	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\nord-external-main\dependencies\glfw-3.3.8.bin.WIN32\docs\html\vulkan_8dox.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa439e46f8,0x7ffa439e4708,0x7ffa439e4718
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,10408636830254925010,7933412352813258611,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,10408636830254925010,7933412352813258611,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2560 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,10408636830254925010,7933412352813258611,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3052 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10408636830254925010,7933412352813258611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10408636830254925010,7933412352813258611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,10408636830254925010,7933412352813258611,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,10408636830254925010,7933412352813258611,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10408636830254925010,7933412352813258611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10408636830254925010,7933412352813258611,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10408636830254925010,7933412352813258611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10408636830254925010,7933412352813258611,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,10408636830254925010,7933412352813258611,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
91907f502460220c3db756e47c0e07a4

SHA1
e80be32aa0017e96c5d856cf7d4a59dfd6813a5e

SHA256
266b101d48d4b204f2853c24c33a2737566414d4d586e7205f5d1c748498dbd7

SHA512
acf7eeba017fb43cfc85b898e8bcc76632b3494bba90c1962fd3943b8c546c06594a03d40033be8dd4a461952b3e80370ed051d060f22da4f0d6e2b545e1a364

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3f21f7d8cf60ac4bacc3d8625c442208

SHA1
01eb65a6026b8b4d0c1f8eaefcf0d991f2655a23

SHA256
b518f8ec455934c6728661c284cae9cf790096cf15a796131929cef01121b338

SHA512
3715242eeb6f5dc44fc8c0448cb675a4368945daeb7663f4534bf547458f4377f5fe2e570f3c78c250984bd7fb985f423f3a229972f0791a03e86aed99d3af5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6d153cb453bb0a7050b06d40771feaad

SHA1
e147d20af69809d571337d306c915dcc69ad0181

SHA256
678f8eea8b4fcc31862a792ec06bcb6b7cf26268fc7fd2dc43bf96a9912d8d72

SHA512
907ad98abf2ffec1ffbec0438236ce8e93dbd3a0bb9129f2de8ca75771df40c44d2e0e9bf475eb3f2705f8acfb2b3f7d1ba729e576614bc211e1ca2d429f43fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
10a9a275cfe5a6f3cd62fca7a8a40e16

SHA1
791e76aed3e2974cc7911c5eb2719be75e5874f4

SHA256
86af536db97aaf8e1bb77127a8a7a60a78341bf8489338c43576a38375fb497f

SHA512
0936852ae73afa2bbac3fac0f4d5759cfaae64a62dd71a9aab34b48f8229102dceeb589a69e1ccd90e9405c5a5c5bf9c997ab20c966dacfc63d9465870dc1f2e

Download Submit