0b96d9af471c99a3672ca155220fc5cb453fc587ed69b68adc0d6d568af0a9d6

Resubmissions

16/06/2024, 18:21

240616-wzfn9avhrn 7

16/06/2024, 17:48

240616-wdm67s1alg 8

Analysis

max time kernel
1800s
max time network
1697s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 17:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bin/resources/notification/index.html
Size

303B
MD5

8c14e24c8a9269edfd98e2f0870679e4
SHA1

f1b95772aceb7c2f8c9ab61389fc3706162cd78f
SHA256

dbb88e598b30825ef64ff8e70240303e6c6954e3acb19a983132e521f5362371
SHA512

93787e9332224e921f82f036dcdb840814f5f99d09755d3f1320b259627f133c71582344c7edeefb0b55802378edc750fccb04cc0cc1e090a263b53904420804

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4496	msedge.exe
4496	msedge.exe
3628	msedge.exe
3628	msedge.exe
2476	identity_helper.exe
2476	identity_helper.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 3596	3628	msedge.exe	81
PID 3628 wrote to memory of 3596	3628	msedge.exe	81
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4004	3628	msedge.exe	82
PID 3628 wrote to memory of 4496	3628	msedge.exe	83
PID 3628 wrote to memory of 4496	3628	msedge.exe	83
PID 3628 wrote to memory of 4968	3628	msedge.exe	84
PID 3628 wrote to memory of 4968	3628	msedge.exe	84
PID 3628 wrote to memory of 4968	3628	msedge.exe	84
PID 3628 wrote to memory of 4968	3628	msedge.exe	84
PID 3628 wrote to memory of 4968	3628	msedge.exe	84
PID 3628 wrote to memory of 4968	3628	msedge.exe	84
PID 3628 wrote to memory of 4968	3628	msedge.exe	84
PID 3628 wrote to memory of 4968	3628	msedge.exe	84
PID 3628 wrote to memory of 4968	3628	msedge.exe	84
PID 3628 wrote to memory of 4968	3628	msedge.exe	84
PID 3628 wrote to memory of 4968	3628	msedge.exe	84
PID 3628 wrote to memory of 4968	3628	msedge.exe	84
PID 3628 wrote to memory of 4968	3628	msedge.exe	84
PID 3628 wrote to memory of 4968	3628	msedge.exe	84
PID 3628 wrote to memory of 4968	3628	msedge.exe	84
PID 3628 wrote to memory of 4968	3628	msedge.exe	84
PID 3628 wrote to memory of 4968	3628	msedge.exe	84
PID 3628 wrote to memory of 4968	3628	msedge.exe	84
PID 3628 wrote to memory of 4968	3628	msedge.exe	84
PID 3628 wrote to memory of 4968	3628	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bin\resources\notification\index.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9bfd646f8,0x7ff9bfd64708,0x7ff9bfd64718
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,9648650807539247011,866876429531910529,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1848,9648650807539247011,866876429531910529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1848,9648650807539247011,866876429531910529,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,9648650807539247011,866876429531910529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,9648650807539247011,866876429531910529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1848,9648650807539247011,866876429531910529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1848,9648650807539247011,866876429531910529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,9648650807539247011,866876429531910529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,9648650807539247011,866876429531910529,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,9648650807539247011,866876429531910529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,9648650807539247011,866876429531910529,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,9648650807539247011,866876429531910529,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3436 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
477462b6ad8eaaf8d38f5e3a4daf17b0

SHA1
86174e670c44767c08a39cc2a53c09c318326201

SHA256
e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d

SHA512
a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b704c9ca0493bd4548ac9c69dc4a4f27

SHA1
a3e5e54e630dabe55ca18a798d9f5681e0620ba7

SHA256
2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411

SHA512
69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0d572095511abbd68ceb8f5cc662c2fc

SHA1
fd0e22d7e01eee9b5e33c3e25e603edea2ae2baa

SHA256
c50cec2bf481230e0ed8ddb33849623510d3a671cc9fa55810559a91f1248fe6

SHA512
a869ca6afbdfde54a06a65e7c2b75126c3108e21e05bf23c5afd616178513d0be709f26e6ca77553966e8a4fc01905f7d11f36afc7fdaa6eaf1da122232d8545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6f281729fb95154476365c90cd371714

SHA1
e20669902582353048c2e9a4e66a85dd64a607de

SHA256
db92bded1b73089d87378a6aeaea73805040dcb656965ed19ac585d9726b685e

SHA512
a3752f816638ccbc7b2e8e17c2273aa9c6791116597dbdad34606229a0cca767860f1f1fe040b853a96cc0ab3af223b26ef5a66a0c413823195adac35879c8cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cb2a255aa365b04d3a476431b38f6eba

SHA1
d44c81f1fb060cc52ec65324608b6796c09cd6c0

SHA256
0135fb0cd4073d6e225cb6373b7ad4602c5ab1e3f17d19fe1b5498f0b11fb7f1

SHA512
a56a5c6e863dd93b2b7ddedabc49c14c99a51c5be6ee610e2c0b5e34f5481741e30bafdbf5d336ff89b5f265814ea8268a88b081b654b91624f1760f5f03721a

Download Submit