c100e9ee244cedf705030e198dc3bfcd1a001edda4de7f0c399b755bbd2f92e7

Analysis

max time kernel
145s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

WorkshopConfigSvc.html
Size

7KB
MD5

369ad00d4c84e38c0ace8daea1efd5ec
SHA1

6585078af624a22c37f2ef2b8a16928b126f49d0
SHA256

c100e9ee244cedf705030e198dc3bfcd1a001edda4de7f0c399b755bbd2f92e7
SHA512

02fbca9991d67c3c621c545eb754312a644bc88151d6c2be538f3a216db31d2fe8f6995233fe3ae7a10dbdb065788778f16a60c601b013a47601a015d4c9d6bf
SSDEEP

192:oSFNVM9OAOUdDs4JAUeRnxTeor1nkSJaGnn:6H4xC09nA+

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3528	msedge.exe
3528	msedge.exe
1336	msedge.exe
1336	msedge.exe
4888	identity_helper.exe
4888	identity_helper.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe
6044	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 4136	1336	msedge.exe	83
PID 1336 wrote to memory of 4136	1336	msedge.exe	83
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 1140	1336	msedge.exe	84
PID 1336 wrote to memory of 3528	1336	msedge.exe	85
PID 1336 wrote to memory of 3528	1336	msedge.exe	85
PID 1336 wrote to memory of 6040	1336	msedge.exe	86
PID 1336 wrote to memory of 6040	1336	msedge.exe	86
PID 1336 wrote to memory of 6040	1336	msedge.exe	86
PID 1336 wrote to memory of 6040	1336	msedge.exe	86
PID 1336 wrote to memory of 6040	1336	msedge.exe	86
PID 1336 wrote to memory of 6040	1336	msedge.exe	86
PID 1336 wrote to memory of 6040	1336	msedge.exe	86
PID 1336 wrote to memory of 6040	1336	msedge.exe	86
PID 1336 wrote to memory of 6040	1336	msedge.exe	86
PID 1336 wrote to memory of 6040	1336	msedge.exe	86
PID 1336 wrote to memory of 6040	1336	msedge.exe	86
PID 1336 wrote to memory of 6040	1336	msedge.exe	86
PID 1336 wrote to memory of 6040	1336	msedge.exe	86
PID 1336 wrote to memory of 6040	1336	msedge.exe	86
PID 1336 wrote to memory of 6040	1336	msedge.exe	86
PID 1336 wrote to memory of 6040	1336	msedge.exe	86
PID 1336 wrote to memory of 6040	1336	msedge.exe	86
PID 1336 wrote to memory of 6040	1336	msedge.exe	86
PID 1336 wrote to memory of 6040	1336	msedge.exe	86
PID 1336 wrote to memory of 6040	1336	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\WorkshopConfigSvc.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa127d46f8,0x7ffa127d4708,0x7ffa127d4718
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,2990605956438229480,17926431393671610117,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,2990605956438229480,17926431393671610117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,2990605956438229480,17926431393671610117,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2990605956438229480,17926431393671610117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2990605956438229480,17926431393671610117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,2990605956438229480,17926431393671610117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,2990605956438229480,17926431393671610117,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2990605956438229480,17926431393671610117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2990605956438229480,17926431393671610117,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2990605956438229480,17926431393671610117,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2990605956438229480,17926431393671610117,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,2990605956438229480,17926431393671610117,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9e06820c856d3776ca3831d77dc04897

SHA1
53a11dd7f8f06fcfab706ffea9508db53bc71f09

SHA256
fe17e0c44f65b15e20af9dab445186371aaec77d90dd55b9bea61effa5c0bb62

SHA512
3a4c5ec2786284eb2d83c0126233bdfad01e9b66c5e62c830b282b44e01663c5b3f584614ca3505fc25b626ecabe6cdb297745b5c00a9e0a23b1a7d9659515cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a47ea4cbb3a5d1b5b9c7bb248bf262de

SHA1
0609dd52fdd93f6b46059870ea0196db5a1e9427

SHA256
8c6150a22f4406faabbffa894d09b9f1e27c79f4b667806a0ea1e8cd5779b2e0

SHA512
9d07d94d0120cbc9a4b21ebd09c1949a740b7a945bdaba78377efa811ed006c30829138672bb41bc6f54f01bc839d5f79330ef8c37085389860f74b293a582df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c9f83338775a7f7a667397c9bcfa576c

SHA1
df69e733da69c5593d53cf55c94be609e1ce5e17

SHA256
177e571b3f3a27bcfd6ba4b004c52fea4c85627535767cd57b26912d31a0b5c6

SHA512
39dbc5b3c7dc61388b7237d858ab4ed6fa2e9b55dcfc7dc02d4c72c1ba4aec8ee55d910840c629bd91d6b5bd1f7e957d3be29ebf351763f4090da2fe2c3fb06a

Download Submit