38d98f73da0983165b96ec388c38d1605255e8da6c41fac15c793ae231ca474f

Analysis

max time kernel
1767s
max time network
1711s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

windows.ps1
Size

152KB
MD5

d337224601527cc5ff021a173d63ca6c
SHA1

3fe51d72e89e3d33e982148485673c45189a5980
SHA256

38d98f73da0983165b96ec388c38d1605255e8da6c41fac15c793ae231ca474f
SHA512

c730606d78f50a0f14ad5fdb47691b922c1c4d097ad95f443ba386937af2232d9249c1c1f16caaf23d2f4cec1f1bc280b48c57fc0150ea26a83bd7d92116a755
SSDEEP

3072:FcLygHKMAqbiwxZweT83alfPfkgo92WaWpcB0R7tZ9HWPF7ixWPtiAIz3sJA+UTq:Lroz+2n9dH5M2vkm0aFRv3pId9RD9Uvr

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4596	powershell.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4596	powershell.exe
4596	powershell.exe
4368	msedge.exe
4368	msedge.exe
3596	msedge.exe
3596	msedge.exe
4040	identity_helper.exe
4040	identity_helper.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4596	powershell.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3596 wrote to memory of 2376	3596	msedge.exe	99
PID 3596 wrote to memory of 2376	3596	msedge.exe	99
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 1540	3596	msedge.exe	100
PID 3596 wrote to memory of 4368	3596	msedge.exe	101
PID 3596 wrote to memory of 4368	3596	msedge.exe	101
PID 3596 wrote to memory of 1940	3596	msedge.exe	102
PID 3596 wrote to memory of 1940	3596	msedge.exe	102
PID 3596 wrote to memory of 1940	3596	msedge.exe	102
PID 3596 wrote to memory of 1940	3596	msedge.exe	102
PID 3596 wrote to memory of 1940	3596	msedge.exe	102
PID 3596 wrote to memory of 1940	3596	msedge.exe	102
PID 3596 wrote to memory of 1940	3596	msedge.exe	102
PID 3596 wrote to memory of 1940	3596	msedge.exe	102
PID 3596 wrote to memory of 1940	3596	msedge.exe	102
PID 3596 wrote to memory of 1940	3596	msedge.exe	102
PID 3596 wrote to memory of 1940	3596	msedge.exe	102
PID 3596 wrote to memory of 1940	3596	msedge.exe	102
PID 3596 wrote to memory of 1940	3596	msedge.exe	102
PID 3596 wrote to memory of 1940	3596	msedge.exe	102
PID 3596 wrote to memory of 1940	3596	msedge.exe	102
PID 3596 wrote to memory of 1940	3596	msedge.exe	102
PID 3596 wrote to memory of 1940	3596	msedge.exe	102
PID 3596 wrote to memory of 1940	3596	msedge.exe	102
PID 3596 wrote to memory of 1940	3596	msedge.exe	102
PID 3596 wrote to memory of 1940	3596	msedge.exe	102

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\windows.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb073e46f8,0x7ffb073e4708,0x7ffb073e4718
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,5885913133926979772,299784938488331340,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,5885913133926979772,299784938488331340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,5885913133926979772,299784938488331340,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5885913133926979772,299784938488331340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5885913133926979772,299784938488331340,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5885913133926979772,299784938488331340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5885913133926979772,299784938488331340,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,5885913133926979772,299784938488331340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3452 /prefetch:8
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,5885913133926979772,299784938488331340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5885913133926979772,299784938488331340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5885913133926979772,299784938488331340,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5885913133926979772,299784938488331340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,5885913133926979772,299784938488331340,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5264 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c39b3aa574c0c938c80eb263bb450311

SHA1
f4d11275b63f4f906be7a55ec6ca050c62c18c88

SHA256
66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

SHA512
eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dabfafd78687947a9de64dd5b776d25f

SHA1
16084c74980dbad713f9d332091985808b436dea

SHA256
c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

SHA512
dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dddb3069b6f060f4f341e906d969026d

SHA1
33ec8fcf8e7ea9533526d8a6ab9f41503862e971

SHA256
41c99d47490e3304c32d8721d885d343a50e657aae37dee622d7723b32e20c78

SHA512
c03b8c65b6eaa90c4fdb8fc7fdd963d507968af0f91927e66ede0e9520b2bd87086c797d27699bd9e7c6165592d2e76b1aff3db5bcbebf996db1b1f1b620abb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7d58c04544ddb757f2e1e0bd2e6bc00c

SHA1
a92a2c22464acbdc24eb0f15216cdcc9115e35dd

SHA256
5943b3f10f10436db02519137ef8a597956ddb27419bcd0b88696268c53f2acd

SHA512
7fd8aa35c6f85e0dba7c81d0103db5084a1a8bebf2df68711c42e1de8135ab504708030fdf2b9fe8c6a00ea35caaa6e0a3226671260ee8cae495e4726f4ba78f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
aa44f5fd603a404b88ce20018d93bc0d

SHA1
9c8d9387138a3325ee49a9ea67d0f4f2d292a989

SHA256
5985f64df14f04625ee4b8a05fffd95132a49fefdb14f03db6c3982854004483

SHA512
fb450ca74b7c6482ce04465220b91eb8aed769e38c7d03495590fbc0060563bfb892f13be5a410cd0018b889809a1379e3fc21c42174918e0fe9f1bdecdce8c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dphxyclr.1ck.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4596-11-0x00007FFB079B0000-0x00007FFB08471000-memory.dmp

Filesize
10.8MB

Download
memory/4596-16-0x00007FFB079B0000-0x00007FFB08471000-memory.dmp

Filesize
10.8MB

Download
memory/4596-13-0x00007FFB079B0000-0x00007FFB08471000-memory.dmp

Filesize
10.8MB

Download
memory/4596-12-0x00007FFB079B0000-0x00007FFB08471000-memory.dmp

Filesize
10.8MB

Download
memory/4596-0-0x00007FFB079B3000-0x00007FFB079B5000-memory.dmp

Filesize
8KB

Download
memory/4596-10-0x0000015BC9170000-0x0000015BC9192000-memory.dmp

Filesize
136KB

Download