0b96d9af471c99a3672ca155220fc5cb453fc587ed69b68adc0d6d568af0a9d6

Resubmissions

16/06/2024, 18:21

240616-wzfn9avhrn 7

16/06/2024, 17:48

240616-wdm67s1alg 8

Analysis

max time kernel
1772s
max time network
1742s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bin/resources/notification/index.html
Size

303B
MD5

8c14e24c8a9269edfd98e2f0870679e4
SHA1

f1b95772aceb7c2f8c9ab61389fc3706162cd78f
SHA256

dbb88e598b30825ef64ff8e70240303e6c6954e3acb19a983132e521f5362371
SHA512

93787e9332224e921f82f036dcdb840814f5f99d09755d3f1320b259627f133c71582344c7edeefb0b55802378edc750fccb04cc0cc1e090a263b53904420804

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2464	msedge.exe
2464	msedge.exe
520	msedge.exe
520	msedge.exe
972	identity_helper.exe
972	identity_helper.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe
520	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 520 wrote to memory of 536	520	msedge.exe	82
PID 520 wrote to memory of 536	520	msedge.exe	82
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 1192	520	msedge.exe	83
PID 520 wrote to memory of 2464	520	msedge.exe	84
PID 520 wrote to memory of 2464	520	msedge.exe	84
PID 520 wrote to memory of 3240	520	msedge.exe	85
PID 520 wrote to memory of 3240	520	msedge.exe	85
PID 520 wrote to memory of 3240	520	msedge.exe	85
PID 520 wrote to memory of 3240	520	msedge.exe	85
PID 520 wrote to memory of 3240	520	msedge.exe	85
PID 520 wrote to memory of 3240	520	msedge.exe	85
PID 520 wrote to memory of 3240	520	msedge.exe	85
PID 520 wrote to memory of 3240	520	msedge.exe	85
PID 520 wrote to memory of 3240	520	msedge.exe	85
PID 520 wrote to memory of 3240	520	msedge.exe	85
PID 520 wrote to memory of 3240	520	msedge.exe	85
PID 520 wrote to memory of 3240	520	msedge.exe	85
PID 520 wrote to memory of 3240	520	msedge.exe	85
PID 520 wrote to memory of 3240	520	msedge.exe	85
PID 520 wrote to memory of 3240	520	msedge.exe	85
PID 520 wrote to memory of 3240	520	msedge.exe	85
PID 520 wrote to memory of 3240	520	msedge.exe	85
PID 520 wrote to memory of 3240	520	msedge.exe	85
PID 520 wrote to memory of 3240	520	msedge.exe	85
PID 520 wrote to memory of 3240	520	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bin\resources\notification\index.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeb97446f8,0x7ffeb9744708,0x7ffeb9744718
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,12885874183462404125,14908163997848797609,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,12885874183462404125,14908163997848797609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,12885874183462404125,14908163997848797609,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12885874183462404125,14908163997848797609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12885874183462404125,14908163997848797609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,12885874183462404125,14908163997848797609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,12885874183462404125,14908163997848797609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12885874183462404125,14908163997848797609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12885874183462404125,14908163997848797609,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12885874183462404125,14908163997848797609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12885874183462404125,14908163997848797609,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,12885874183462404125,14908163997848797609,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1136 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
477462b6ad8eaaf8d38f5e3a4daf17b0

SHA1
86174e670c44767c08a39cc2a53c09c318326201

SHA256
e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d

SHA512
a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b704c9ca0493bd4548ac9c69dc4a4f27

SHA1
a3e5e54e630dabe55ca18a798d9f5681e0620ba7

SHA256
2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411

SHA512
69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5795b9cdfc3dedef9d054044fe6f2468

SHA1
9b75305b79108b8f0223c320e84d7519b87007d1

SHA256
9ab2f0f79f3738ba56adc024f6e6a9f8c27f91c6521bf0db867aa53af1ceea7f

SHA512
41d0e019bcab235c3d2176a48c892f3d2ae4c049cdea0db6d9bfb4c08fe4cd2992958591226b230bc67d7744f2c78ca5c7e585bfad5df6a2c962304c51779cee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
66bd4293baba95a536a92ce1f5f2d30f

SHA1
dd56b1a67c5771134c5ddf86b265ca82f66d6107

SHA256
597d91e51407deda2f5951f9c17b9b0ca827ecfea76184ff0385f9757f522055

SHA512
c0a38dcc152b76f219c401b5b5ce44d53d56198f8b1b691e1a058fd4c78dde6cab2da60b0c3adf5905d35ec88c51204c8bbe909e0baa91f923b5b8e8829e015f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8fe479e246bb8118478bc393eff68327

SHA1
281b7cc61d6dc658168f4594092f5572eb030ad5

SHA256
f7ff17e45d1a418a300a5e66d0ee0a76fe125f75ddf3c4cfe2bdcc7f326996a2

SHA512
fe79ff17dfdb87b5c134b6e979799cbce2b898532bc98922ea026a6af89e942764abdc0b057372e50c6b332d270fbee4324079f66e723af3343a55aadcc21a20

Download Submit