hxxps://github[.]com/volatilityfoundation/volatility

Analysis

max time kernel
150s
max time network
203s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/volatilityfoundation/volatility

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe
744	msedge.exe
744	msedge.exe
3596	identity_helper.exe
3596	identity_helper.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe
3036	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 1828	744	msedge.exe	81
PID 744 wrote to memory of 1828	744	msedge.exe	81
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4712	744	msedge.exe	83
PID 744 wrote to memory of 4180	744	msedge.exe	84
PID 744 wrote to memory of 4180	744	msedge.exe	84
PID 744 wrote to memory of 2620	744	msedge.exe	85
PID 744 wrote to memory of 2620	744	msedge.exe	85
PID 744 wrote to memory of 2620	744	msedge.exe	85
PID 744 wrote to memory of 2620	744	msedge.exe	85
PID 744 wrote to memory of 2620	744	msedge.exe	85
PID 744 wrote to memory of 2620	744	msedge.exe	85
PID 744 wrote to memory of 2620	744	msedge.exe	85
PID 744 wrote to memory of 2620	744	msedge.exe	85
PID 744 wrote to memory of 2620	744	msedge.exe	85
PID 744 wrote to memory of 2620	744	msedge.exe	85
PID 744 wrote to memory of 2620	744	msedge.exe	85
PID 744 wrote to memory of 2620	744	msedge.exe	85
PID 744 wrote to memory of 2620	744	msedge.exe	85
PID 744 wrote to memory of 2620	744	msedge.exe	85
PID 744 wrote to memory of 2620	744	msedge.exe	85
PID 744 wrote to memory of 2620	744	msedge.exe	85
PID 744 wrote to memory of 2620	744	msedge.exe	85
PID 744 wrote to memory of 2620	744	msedge.exe	85
PID 744 wrote to memory of 2620	744	msedge.exe	85
PID 744 wrote to memory of 2620	744	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/volatilityfoundation/volatility
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb9d6946f8,0x7ffb9d694708,0x7ffb9d694718
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,132843943453506578,6224667101591739189,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,132843943453506578,6224667101591739189,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,132843943453506578,6224667101591739189,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,132843943453506578,6224667101591739189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,132843943453506578,6224667101591739189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,132843943453506578,6224667101591739189,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,132843943453506578,6224667101591739189,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,132843943453506578,6224667101591739189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,132843943453506578,6224667101591739189,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,132843943453506578,6224667101591739189,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,132843943453506578,6224667101591739189,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,132843943453506578,6224667101591739189,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4832 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
6d6c635726b1f24e6b56c9802d87e78c

SHA1
063ad25566b9f9f7c1128372e0106af7dd0dc733

SHA256
e0165a4089b75af1615c6bd7d102e1ae6ac3c1b28a62f7876362ef76cdf77386

SHA512
2a76d34f129a11c0381e12267948b3ee131f4aa5e735ff80bf2587523b346812cb0681cf0f8a13a89829581bfa8c9e1ed02a3cb3138f41f1b65c7eb1f3b1cd26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
32a343478aee973ec889ef38dcb3eaf3

SHA1
4bc74c9818c556166d51b2d2d8cea09aa435fb10

SHA256
f7cf7b718bc3785ecf8f679d63ed3fe05b4ea5aa90b4675ad0ddfe0da4de344b

SHA512
d8b9feefdd3af65b418517ea47e764f4ccc5f6b89b886ac0bf7630e47292e5cea478e1cf05796a72f8590ff768eb4b25ce1daf026f117155887fc9d1054c8c4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
54cae5ac4890bd5d6aeb75481c1eca12

SHA1
73c8c6d11879821d548c2ceb4841cf4029da2496

SHA256
b921c61526e45ce3bc3eec839338838b9249a83d21c7a07451cd0c9909994467

SHA512
7d23a7513077cb775488ddc2ac490bc1f832f6339bfcf2a28280188ba89420d2b22a7239d2f344040627aee9e6321d158b87c41e4190689c597a4309a69dafb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fae896337b3b9f492466d7e045075dc9

SHA1
403632bcd02497a1b64f8789c5f2766959900fb1

SHA256
1a05087d0b5c099ee0ac61931185074bd1c6dbfb9b8d12130f2e370317cf1189

SHA512
da47bd6f2e9c988fc0a5622ec61b299f7831ea7857c8bf575e8633c537086f9022855aeda8e4d80a49651b4851761dbf38a2a33ca7ca88f1e3e57cb5ea432cd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5db16705292536b7c91d43db12f10c3d

SHA1
a1977ea28ba2175db14c77b2b1762de113ee0455

SHA256
7b63548e98200e4664ed5dc45afea57ac94489ebc269213b56bcd6b14024b495

SHA512
18976a47470be9f56d1468437416b1f49d40b221b4304a69615d02e6625c05259e74a2219391edd0f443a4075a84b3e70d46ebd1a7f6046b2797cb244e0dc990

Download Submit