b1865a08154364f00bc4350a99012043bfca5b14734fb8ab505ade40dd6a0cc2

Analysis

max time kernel
147s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 19:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

6.5MB
MD5

60afa16cbc3798cb1352314311e93a07
SHA1

0a9daab3a20586ab2a07cd2857a2f2cd65c25d32
SHA256

ec105b4cf1588e28ebd596b2c354e44b4fe2cce5e6d5abbc7174ec7be3df6a09
SHA512

839905cb7d697ae77beba74a3c82e65d1d6328c62fea6933fd8d490231d1a6bffd692fdbaffee86483ae967e86fd0772fb2bb327b054d08fc0c9177f3c9c26fa
SSDEEP

24576:kP5T5WfWSJbJlAV8gmfwN6i6w6C6g6T9GHpbUBpUY:vuw9

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4088	msedge.exe
4088	msedge.exe
5032	msedge.exe
5032	msedge.exe
4988	identity_helper.exe
4988	identity_helper.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 4712	5032	msedge.exe	84
PID 5032 wrote to memory of 4712	5032	msedge.exe	84
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 3076	5032	msedge.exe	87
PID 5032 wrote to memory of 4088	5032	msedge.exe	88
PID 5032 wrote to memory of 4088	5032	msedge.exe	88
PID 5032 wrote to memory of 4756	5032	msedge.exe	89
PID 5032 wrote to memory of 4756	5032	msedge.exe	89
PID 5032 wrote to memory of 4756	5032	msedge.exe	89
PID 5032 wrote to memory of 4756	5032	msedge.exe	89
PID 5032 wrote to memory of 4756	5032	msedge.exe	89
PID 5032 wrote to memory of 4756	5032	msedge.exe	89
PID 5032 wrote to memory of 4756	5032	msedge.exe	89
PID 5032 wrote to memory of 4756	5032	msedge.exe	89
PID 5032 wrote to memory of 4756	5032	msedge.exe	89
PID 5032 wrote to memory of 4756	5032	msedge.exe	89
PID 5032 wrote to memory of 4756	5032	msedge.exe	89
PID 5032 wrote to memory of 4756	5032	msedge.exe	89
PID 5032 wrote to memory of 4756	5032	msedge.exe	89
PID 5032 wrote to memory of 4756	5032	msedge.exe	89
PID 5032 wrote to memory of 4756	5032	msedge.exe	89
PID 5032 wrote to memory of 4756	5032	msedge.exe	89
PID 5032 wrote to memory of 4756	5032	msedge.exe	89
PID 5032 wrote to memory of 4756	5032	msedge.exe	89
PID 5032 wrote to memory of 4756	5032	msedge.exe	89
PID 5032 wrote to memory of 4756	5032	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaaf0b46f8,0x7ffaaf0b4708,0x7ffaaf0b4718
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,14097263284906370663,2781611213287311788,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,14097263284906370663,2781611213287311788,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,14097263284906370663,2781611213287311788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14097263284906370663,2781611213287311788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14097263284906370663,2781611213287311788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,14097263284906370663,2781611213287311788,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,14097263284906370663,2781611213287311788,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14097263284906370663,2781611213287311788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14097263284906370663,2781611213287311788,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14097263284906370663,2781611213287311788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3776 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14097263284906370663,2781611213287311788,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,14097263284906370663,2781611213287311788,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dabfafd78687947a9de64dd5b776d25f

SHA1
16084c74980dbad713f9d332091985808b436dea

SHA256
c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

SHA512
dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c39b3aa574c0c938c80eb263bb450311

SHA1
f4d11275b63f4f906be7a55ec6ca050c62c18c88

SHA256
66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

SHA512
eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d89bcf6df8c9cbe4e4923ff857c3904c

SHA1
cc3173337fa0e038367371617f38086adc8056f0

SHA256
89bc09d59c3f1bb437c3101042c4aa1e859f3305972bb12043213c9e8e28e25c

SHA512
41bad72af46919e8982f8010764bd0d79e07b59108b775e96b0cf8e96efdf662c65b28a61fb97fcc0374c61e7359a0db81f62cd9d5ae01b909c33af7d068e51e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0286a603f3152237a065cc428c9c1485

SHA1
69fd4329d94d11787ac0013aed9fadd1dd3e292e

SHA256
7f3757e0a35a12d01c0723568adefdf044b9d23017c65be42e3b27c271e0e38e

SHA512
aac8cb517259953399b502f93b12ae8e3ba8c32b280c9133f9da133c83b0d2b34521c9c5fbbb0b5975718af36cd9e26446f917d673055764d7e7365f64e8af4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f65bd7a099085412637942565d1c2e39

SHA1
740cf31d16e7b47da40887dbbef1837f914099c4

SHA256
5b3f36c88c3e8221d5231cdce4fa1de47dea8d371f1c75dc915de0e36657ef8f

SHA512
a6d99063e0e7bb1ea35248efd5cf7f9a394a92c70b9b5e6f0c323ce5c8282dfe0b177b8d008ff0eeda1ab45f7931e73697e81614dc36a25ba38ade17fb9841ff

Download Submit