2e7e2dd5104fb57d8c6de00cc40ef506a23df7e1f794038c44f8f06ffa4f1ec4

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2024 01:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9553下载.htm
Size

861B
MD5

03033cdf475f981a1777c0fef43f8700
SHA1

8ba65dc9adaf9fdcaf86efddc4c626e2cf26668e
SHA256

89439c037b34a0511f794c1f98e8a52a64910dfb8faa93e62522b83a98b327e9
SHA512

edb1b1a710733a2eb236e2d2920884754f88846fac4e6bde1fcf98d719db1211eb9b9f4ee18a560e9a7243b7caabccbe642fb8e02db4fd62c6d7b059717d35f1

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
884	msedge.exe
884	msedge.exe
5004	msedge.exe
5004	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
1948	identity_helper.exe
1948	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 396	5004	msedge.exe	81
PID 5004 wrote to memory of 396	5004	msedge.exe	81
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 3756	5004	msedge.exe	82
PID 5004 wrote to memory of 884	5004	msedge.exe	83
PID 5004 wrote to memory of 884	5004	msedge.exe	83
PID 5004 wrote to memory of 4816	5004	msedge.exe	84
PID 5004 wrote to memory of 4816	5004	msedge.exe	84
PID 5004 wrote to memory of 4816	5004	msedge.exe	84
PID 5004 wrote to memory of 4816	5004	msedge.exe	84
PID 5004 wrote to memory of 4816	5004	msedge.exe	84
PID 5004 wrote to memory of 4816	5004	msedge.exe	84
PID 5004 wrote to memory of 4816	5004	msedge.exe	84
PID 5004 wrote to memory of 4816	5004	msedge.exe	84
PID 5004 wrote to memory of 4816	5004	msedge.exe	84
PID 5004 wrote to memory of 4816	5004	msedge.exe	84
PID 5004 wrote to memory of 4816	5004	msedge.exe	84
PID 5004 wrote to memory of 4816	5004	msedge.exe	84
PID 5004 wrote to memory of 4816	5004	msedge.exe	84
PID 5004 wrote to memory of 4816	5004	msedge.exe	84
PID 5004 wrote to memory of 4816	5004	msedge.exe	84
PID 5004 wrote to memory of 4816	5004	msedge.exe	84
PID 5004 wrote to memory of 4816	5004	msedge.exe	84
PID 5004 wrote to memory of 4816	5004	msedge.exe	84
PID 5004 wrote to memory of 4816	5004	msedge.exe	84
PID 5004 wrote to memory of 4816	5004	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9553下载.htm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc840f46f8,0x7ffc840f4708,0x7ffc840f4718
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,4742767569744276367,17419961476814914359,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,4742767569744276367,17419961476814914359,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,4742767569744276367,17419961476814914359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4742767569744276367,17419961476814914359,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4742767569744276367,17419961476814914359,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4742767569744276367,17419961476814914359,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,4742767569744276367,17419961476814914359,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2508 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,4742767569744276367,17419961476814914359,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,4742767569744276367,17419961476814914359,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4742767569744276367,17419961476814914359,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4742767569744276367,17419961476814914359,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4742767569744276367,17419961476814914359,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4742767569744276367,17419961476814914359,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:4160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
d822ace840b89f929e3201cc144dbc09

SHA1
a033bc1b428daf5bb15d20f13e124e8577d44425

SHA256
b892dca5248432844b660b45820e0f68a2cabd4b7d2fb5458630c3b1e1b936f3

SHA512
56f83fe5d89e52e239197afbdba67174c2c796a458c24b39a9ff967a1b5c7f06eb4bffd5b8217d4e27581474f4366b94146228495dd2923e4f506d32716bcc9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
232e530852a6bb7be2f1ba2a4185b08c

SHA1
6be8919f08df696c3160ef709f63b985a7446b7c

SHA256
0495d971b14096df84e13b79c5041d913d6ffb31a2218dbdf41261b199123748

SHA512
104f0139e909cb1be943ddc8107227e1121716c1a213c9cfa5a3666389c99da36b0bff1814a5451e38406962ef47f890289bc361eb1612ae43e5daa3d665ba51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
43a2bb493174ab764fde694cc846c465

SHA1
0bf8a2eab706b46afb005668e537c75c037985d9

SHA256
67f99714d500cfa5507a8c45fe1027f036e0e0219f6032d315a1b382c5dd1143

SHA512
6b94b38f997285c3b341134fbd2d070be02476487de5d2ea95c93ad1c0bf65f8a4c3cd54ed830d414e99a1573d0281c5ed5fbf6ed20e76500abbcffd5e198939

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fb7265441a3a94b28f0486f21dbe86b7

SHA1
e8aaca5f9f2b60d061a976d3795364ba8f0a2757

SHA256
4971edc58ab81bf033ae8feb244151cd229e336935a57b9064f08f4d5b2890db

SHA512
4d7b1a7902298f3d3c40fcfce0b62522755e82d4c194cbee434a7234922eac5c5fda008d86b52a5cca1e96c4c42a38cf2e274afba97b4ed78a36b6f7287114ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1a5953001916f3e5f628c5f320eba077

SHA1
75cda19156bf76eb4bb3a596d3430273ce62bdc4

SHA256
5f27c8e692a5cf1eea4a3719d5331f8621fa1707c587adb6e5a2228ef06eb711

SHA512
994f5229702ac3c493f8a5a8262bfa657758cd309e1f38b437dead164f0a9062aaa0fce515e9f6f71f4ff6ecd99570d70c039ef809a1eef473aea5203b46b028

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a5bbfa2bf91646a692646c97ba0406ce

SHA1
1d99873b74a5c7d0dec44ec46b4484bd7cbb659f

SHA256
b1c36d8b15345da4f54f8dd6b8a1320fcf42f5f615196975ad54cf834451d26e

SHA512
420b33e1275b560512d4fc67b698210c2f1651928ba9f9175347fb7831faee27658c0a6ddbf1049a31c571247255fff8b62ffe274c963774ba3d1d120f3cdfbc

Download Submit