88e5ade2ec431b3a7398b1f81dfc4ed6119a9e95657c29a9d6646fb396f3761b

Resubmissions

29/06/2024, 22:21

240629-19544s1epm 7

29/06/2024, 22:13

240629-145amaxfjc 7

Analysis

max time kernel
145s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

8.8MB
MD5

2675b30d524b6c79b6cee41af86fc619
SHA1

407716c1bb83c211bcb51efbbcb6bf2ef1664e5b
SHA256

6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
SHA512

3214341da8bf3347a6874535bb0ff8d059ee604e779491780f2b29172f9963e23acbe3c534d888f7a3b99274f46d0628962e1e72a5d3fc6f18ca2b62343df485
SSDEEP

24576:cpD6826x5kSWSsRinoHnmfm646a6N6z68SH4SApTJ:cHSek

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4872	msedge.exe
4872	msedge.exe
2108	msedge.exe
2108	msedge.exe
408	identity_helper.exe
408	identity_helper.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe
528	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2796	2108	msedge.exe	79
PID 2108 wrote to memory of 2796	2108	msedge.exe	79
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4852	2108	msedge.exe	82
PID 2108 wrote to memory of 4872	2108	msedge.exe	83
PID 2108 wrote to memory of 4872	2108	msedge.exe	83
PID 2108 wrote to memory of 3704	2108	msedge.exe	84
PID 2108 wrote to memory of 3704	2108	msedge.exe	84
PID 2108 wrote to memory of 3704	2108	msedge.exe	84
PID 2108 wrote to memory of 3704	2108	msedge.exe	84
PID 2108 wrote to memory of 3704	2108	msedge.exe	84
PID 2108 wrote to memory of 3704	2108	msedge.exe	84
PID 2108 wrote to memory of 3704	2108	msedge.exe	84
PID 2108 wrote to memory of 3704	2108	msedge.exe	84
PID 2108 wrote to memory of 3704	2108	msedge.exe	84
PID 2108 wrote to memory of 3704	2108	msedge.exe	84
PID 2108 wrote to memory of 3704	2108	msedge.exe	84
PID 2108 wrote to memory of 3704	2108	msedge.exe	84
PID 2108 wrote to memory of 3704	2108	msedge.exe	84
PID 2108 wrote to memory of 3704	2108	msedge.exe	84
PID 2108 wrote to memory of 3704	2108	msedge.exe	84
PID 2108 wrote to memory of 3704	2108	msedge.exe	84
PID 2108 wrote to memory of 3704	2108	msedge.exe	84
PID 2108 wrote to memory of 3704	2108	msedge.exe	84
PID 2108 wrote to memory of 3704	2108	msedge.exe	84
PID 2108 wrote to memory of 3704	2108	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8bfd046f8,0x7ff8bfd04708,0x7ff8bfd04718
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,17608301025932266924,15315948537432449380,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,17608301025932266924,15315948537432449380,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,17608301025932266924,15315948537432449380,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17608301025932266924,15315948537432449380,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17608301025932266924,15315948537432449380,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,17608301025932266924,15315948537432449380,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,17608301025932266924,15315948537432449380,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17608301025932266924,15315948537432449380,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17608301025932266924,15315948537432449380,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17608301025932266924,15315948537432449380,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,17608301025932266924,15315948537432449380,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4372 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,17608301025932266924,15315948537432449380,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4380 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
944d39902e6a6a0b0e39b51dc4c2544a

SHA1
6908eb51c6a90b4e3f35a96d8fcc5ddf263777e4

SHA256
b63572169683de2eb056e076af44304c4d7be312cb73b78763f7caf3fc00eacf

SHA512
52b1f07cf736fc234ce1f0379b13b9922f7b1fdde05574bfa45347d28fabdbeabd80ff1019925ad7982a42493c1ce6a6cc589cff56d0f73386892b8fe52a45df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
af30e4eba1ce6c912277afac54ca1668

SHA1
2f6c57c9ca84e49fea2084f482a6beb4b9cddfa9

SHA256
7465a94c88c65c7e13bc7b98f686d265aef85ccb3b5ae079da7239386a846051

SHA512
232fc2826bbc0a08000283b3930f508fa2e2d304e0fc95ceb457c8df39b8e1ea51a129bcf2d232407a5a20230e1053d2369a78961e158d8913721509f825f6f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2615c29a56a2eb5008cffc4531afb3ba

SHA1
a6bfe87e27e8b105beed5c8b2fbdd83f32d0625a

SHA256
edce11603cd2415cd1c4156d31962642a3a1a3151a2586d6e1ca198a03f49e02

SHA512
b8541d7c28fdefa19853fdbb78f4fff524feac71270e346e1936a79e0d1b36caebc3f6581c1cd4f165d624a51b2a445a6cc21c9abd47edb62de678280595016c

Download Submit