e66c9959bcc4ab913b89e9dabe392b785616f1b5f2039a5757f0dc5d30e76690

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16-06-2024 23:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

blogid=321536463764.html
Size

23KB
MD5

ccc65a8593a809e1b3665dc1ff7c0286
SHA1

f8a7bf2ce9f171771d940568d0b62dbb35881c8e
SHA256

5bb67ce78c62d4f8c2b3867acf7ee24e2b967661a6223ad54f46c48c3b0d82c0
SHA512

294863882d156bc2515c7db73adf63b2bdde85ecefc499af7a09d2b65faf52c2f91000a959bbd5e1df09915f651748316396667fd1fd9ca4ad7ccb4c171a0ca7
SSDEEP

384:azZ6ej63Rwhm4hxQ2hXqhInpheBmAqt8NzzW5JIzw:kQ+hXhxbh6hIhX8NzzW8zw

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4428	msedge.exe
4428	msedge.exe
4268	msedge.exe
4268	msedge.exe
4752	identity_helper.exe
4752	identity_helper.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 2876	4268	msedge.exe	82
PID 4268 wrote to memory of 2876	4268	msedge.exe	82
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 3652	4268	msedge.exe	83
PID 4268 wrote to memory of 4428	4268	msedge.exe	84
PID 4268 wrote to memory of 4428	4268	msedge.exe	84
PID 4268 wrote to memory of 4248	4268	msedge.exe	85
PID 4268 wrote to memory of 4248	4268	msedge.exe	85
PID 4268 wrote to memory of 4248	4268	msedge.exe	85
PID 4268 wrote to memory of 4248	4268	msedge.exe	85
PID 4268 wrote to memory of 4248	4268	msedge.exe	85
PID 4268 wrote to memory of 4248	4268	msedge.exe	85
PID 4268 wrote to memory of 4248	4268	msedge.exe	85
PID 4268 wrote to memory of 4248	4268	msedge.exe	85
PID 4268 wrote to memory of 4248	4268	msedge.exe	85
PID 4268 wrote to memory of 4248	4268	msedge.exe	85
PID 4268 wrote to memory of 4248	4268	msedge.exe	85
PID 4268 wrote to memory of 4248	4268	msedge.exe	85
PID 4268 wrote to memory of 4248	4268	msedge.exe	85
PID 4268 wrote to memory of 4248	4268	msedge.exe	85
PID 4268 wrote to memory of 4248	4268	msedge.exe	85
PID 4268 wrote to memory of 4248	4268	msedge.exe	85
PID 4268 wrote to memory of 4248	4268	msedge.exe	85
PID 4268 wrote to memory of 4248	4268	msedge.exe	85
PID 4268 wrote to memory of 4248	4268	msedge.exe	85
PID 4268 wrote to memory of 4248	4268	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\blogid=321536463764.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb750746f8,0x7ffb75074708,0x7ffb75074718
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,6162032246283004094,5505837985972974547,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,6162032246283004094,5505837985972974547,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,6162032246283004094,5505837985972974547,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6162032246283004094,5505837985972974547,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6162032246283004094,5505837985972974547,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,6162032246283004094,5505837985972974547,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,6162032246283004094,5505837985972974547,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6162032246283004094,5505837985972974547,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6162032246283004094,5505837985972974547,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6162032246283004094,5505837985972974547,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6162032246283004094,5505837985972974547,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,6162032246283004094,5505837985972974547,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5688 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
179B

MD5
3c46cd3d3ceb6f0620f3b84800545728

SHA1
27c2d098ef1b28fcdac7f74015ac857bee2c4bc0

SHA256
6b8b6685aef6bb685bf3309996eab1c7ea9b26585229338ddb4edb84c469719f

SHA512
83b87678ee7be0754a3c66be45333a74dfb4a91d57226092feebee1a65c0188572e1b2d93f3a399f6684a880aa5b8d00f1ba98df4f2ef0408c7915b888ca7f9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e6c2aaf9c58bd8fbb0971fbf7e5b405f

SHA1
de2adbd4c41396002500674c54350280fd784af3

SHA256
feef27dbe39dab845583cf35e8d0a0ec5f96423dd60687b4924e5a172f030360

SHA512
df3879be70fd77f0744687ca4726ba8d23f83c6bbc4c647ff7a83e68f4eab25c7c1c66a1305b376a3fec10ac2d8e07c8326139f6557e1d855b8fc7ae08d9f457

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
949120853860b74d9429ccdd30a2cea4

SHA1
5a49f971fb60acb0ad155b4967f1a0c159a91612

SHA256
16dffdf12d38aff0cf9a549b26f79124c1f0bcdd922a98561298f13889735ee4

SHA512
31d5638847768b7c83b063b9645e3db057689de3032187abeb024e062c06150e628071828f68f5d7629fd30788ec51224e7e9892130b18eae96c2cc0ee71a2d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6893588db4e5e0ad0f77fbe76f058dcc

SHA1
4854d1f227b8f5efd6262a4d25f7ff148d4fb3a1

SHA256
89aef316538754b92c6d4d2fd701b53c35d943f4d043e7fb7fbfddae03cd44cd

SHA512
0880058ee07e594ce274b70d8808cddd04590f0d3dc9ba2e3ae244cb930633ba79b88b0753be1763c280c612a4956eef6288c537846f632b22c653aaeefa290e

Download Submit