a6e2ce0c22835a3357434820fa07497c4d3cca96ca24498547702e2538dcc1d6

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/app/cmp.html
Size

5KB
MD5

d7b8b31b190e552677589cfd4cbb5d8e
SHA1

09ffb3c63991d5c932c819393de489268bd3ab88
SHA256

6c21e8c07ce28327dca05f873d73fe85d5473f9b22a751a4d3d28931f5d0c74f
SHA512

32794507a4b9a12e52ceb583222cb93300e38c634a72ea3f51a0189127aba60cf476fb7918942355a4f826185d7071e876cb40348ba34cf5d1ca7e9546ccb310
SSDEEP

48:t9rc0/GLAoShbEHaLKNGiNQtvmolOGR36tgtr/GTvJP8AscaV4LiMt7ByBZXGz+p:4VLjHa2NGiivmmpWsBVutFwAk5vSG

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe
4684	msedge.exe
4684	msedge.exe
2280	identity_helper.exe
2280	identity_helper.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 1760	4684	msedge.exe	81
PID 4684 wrote to memory of 1760	4684	msedge.exe	81
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4816	4684	msedge.exe	82
PID 4684 wrote to memory of 4628	4684	msedge.exe	83
PID 4684 wrote to memory of 4628	4684	msedge.exe	83
PID 4684 wrote to memory of 3068	4684	msedge.exe	84
PID 4684 wrote to memory of 3068	4684	msedge.exe	84
PID 4684 wrote to memory of 3068	4684	msedge.exe	84
PID 4684 wrote to memory of 3068	4684	msedge.exe	84
PID 4684 wrote to memory of 3068	4684	msedge.exe	84
PID 4684 wrote to memory of 3068	4684	msedge.exe	84
PID 4684 wrote to memory of 3068	4684	msedge.exe	84
PID 4684 wrote to memory of 3068	4684	msedge.exe	84
PID 4684 wrote to memory of 3068	4684	msedge.exe	84
PID 4684 wrote to memory of 3068	4684	msedge.exe	84
PID 4684 wrote to memory of 3068	4684	msedge.exe	84
PID 4684 wrote to memory of 3068	4684	msedge.exe	84
PID 4684 wrote to memory of 3068	4684	msedge.exe	84
PID 4684 wrote to memory of 3068	4684	msedge.exe	84
PID 4684 wrote to memory of 3068	4684	msedge.exe	84
PID 4684 wrote to memory of 3068	4684	msedge.exe	84
PID 4684 wrote to memory of 3068	4684	msedge.exe	84
PID 4684 wrote to memory of 3068	4684	msedge.exe	84
PID 4684 wrote to memory of 3068	4684	msedge.exe	84
PID 4684 wrote to memory of 3068	4684	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app\cmp.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1ff746f8,0x7ffe1ff74708,0x7ffe1ff74718
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,2636295430016900737,18292153975733838915,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,2636295430016900737,18292153975733838915,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,2636295430016900737,18292153975733838915,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2636295430016900737,18292153975733838915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2636295430016900737,18292153975733838915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,2636295430016900737,18292153975733838915,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,2636295430016900737,18292153975733838915,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2636295430016900737,18292153975733838915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2636295430016900737,18292153975733838915,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2636295430016900737,18292153975733838915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2636295430016900737,18292153975733838915,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,2636295430016900737,18292153975733838915,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
309B

MD5
357c501b82873ed75dac6cb3059f22bd

SHA1
983df0a8fd232754cd0006d0c2efd89cac29be41

SHA256
fa1d372e628fb02617484f1ee4cea627c62f6930d3d4dbce770b768aa2233cef

SHA512
56c52abb7ef32fb922b3b4af8c86dacf15341bb4170bccb462c88f4c6b5e9f36fe14b3918374e348d83cf482a68c5e81059b5b27edd160722cce1b488ddb9088

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
76056f1353953b4f89ea55e945c980b4

SHA1
c2f011dc594519e8e66ad077f1eebcc303b5b17d

SHA256
48b668cd6be432ed74580a050cff42392ab1f8f5f9efb5067e6649bd9fa1b2e6

SHA512
3328ce9d8a3f6893e319b0909a7e4b9e5444343496460a8b6a9558b172bf469962158b6c4fcda1b2d85882b02e895a0e8a3b98572c3cfa6b3c7a8464385fde73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f9128adf6d6a6ab24b6753ba74b4140a

SHA1
c21b19a30b508c55571ac71b1becbc47f2d5caf9

SHA256
505343deacbf8ddc95902ea89541914514d56c144f0b9bc9b6af4383f02f8d50

SHA512
0fa8aac7e5e185b3a46f9d031bfbdfa5c7191833dd1dbc3ff821e18f518461c0bcf9ac948144a2293a49cfb8064deb0bb803b0ad38050058ed0195d0fc44f600

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3133c4044a8ba3db46f12ade2ad42fcf

SHA1
57de24f71df0015b6d36430fcf84b2e0a313cb2e

SHA256
af9ffb95dd0009219785a32a825f344e3a8035a06671e488c44e99e74eda7ee9

SHA512
878ef6b4c31453eb0aa578c2560c7d57f8c9239fac718751ab224b06edb7217d7777d7421c65af77c2fb217b05a6842bce2fa7263f4be0ff91792c666a787a8b

Download Submit