hxxps://github[.]com/MalwareSamples/Malware-Feed

Analysis

max time kernel
42s
max time network
26s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
30/06/2024, 03:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/MalwareSamples/Malware-Feed

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
892	msedge.exe
892	msedge.exe
952	msedge.exe
952	msedge.exe
776	identity_helper.exe
776	identity_helper.exe
1128	msedge.exe
1128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 3516	952	msedge.exe	77
PID 952 wrote to memory of 3516	952	msedge.exe	77
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 3132	952	msedge.exe	78
PID 952 wrote to memory of 892	952	msedge.exe	79
PID 952 wrote to memory of 892	952	msedge.exe	79
PID 952 wrote to memory of 3852	952	msedge.exe	80
PID 952 wrote to memory of 3852	952	msedge.exe	80
PID 952 wrote to memory of 3852	952	msedge.exe	80
PID 952 wrote to memory of 3852	952	msedge.exe	80
PID 952 wrote to memory of 3852	952	msedge.exe	80
PID 952 wrote to memory of 3852	952	msedge.exe	80
PID 952 wrote to memory of 3852	952	msedge.exe	80
PID 952 wrote to memory of 3852	952	msedge.exe	80
PID 952 wrote to memory of 3852	952	msedge.exe	80
PID 952 wrote to memory of 3852	952	msedge.exe	80
PID 952 wrote to memory of 3852	952	msedge.exe	80
PID 952 wrote to memory of 3852	952	msedge.exe	80
PID 952 wrote to memory of 3852	952	msedge.exe	80
PID 952 wrote to memory of 3852	952	msedge.exe	80
PID 952 wrote to memory of 3852	952	msedge.exe	80
PID 952 wrote to memory of 3852	952	msedge.exe	80
PID 952 wrote to memory of 3852	952	msedge.exe	80
PID 952 wrote to memory of 3852	952	msedge.exe	80
PID 952 wrote to memory of 3852	952	msedge.exe	80
PID 952 wrote to memory of 3852	952	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/MalwareSamples/Malware-Feed
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffefc473cb8,0x7ffefc473cc8,0x7ffefc473cd8
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,375125394584027750,15067245028966381841,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1868,375125394584027750,15067245028966381841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1868,375125394584027750,15067245028966381841,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,375125394584027750,15067245028966381841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,375125394584027750,15067245028966381841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1868,375125394584027750,15067245028966381841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1868,375125394584027750,15067245028966381841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,375125394584027750,15067245028966381841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,375125394584027750,15067245028966381841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1240 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,375125394584027750,15067245028966381841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1936 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,375125394584027750,15067245028966381841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e4bf11ed97b6b312e938ca216cf30e

SHA1
ff6b0b475e552dc08a2c81c9eb9230821d3c8290

SHA256
296db8c9361efb62e23be1935fd172cfe9fbcd89a424f34f347ec3cc5ca5afad

SHA512
ce1a05df2619af419ed3058dcbd7254c7159d333356d9f1d5e2591c19e17ab0ac9b6d3e625e36246ad187256bee75b7011370220ef127c4f1171879014d0dd76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
23da8c216a7633c78c347cc80603cd99

SHA1
a378873c9d3484e0c57c1cb6c6895f34fee0ea61

SHA256
03dbdb03799f9e37c38f6d9d498ad09f7f0f9901430ff69d95aa26cae87504d3

SHA512
d34ae684e8462e3f2aba2260f2649dee01b4e2138b50283513c8c19c47faf039701854e1a9cbf21d7a20c28a6306f953b58ffb9144ead067f5f73650a759ff17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
195aedb0ab152b42f42809663ad4ee96

SHA1
034e96b41e1dcb20acd9aa099cccb105325b7821

SHA256
8ca5233e5f35a3be28f38436772535ce6a4f1b971130b4b0431b73c0a79103e8

SHA512
38ded458e8aa2c588a53c65ac4ecef9f9c2d3fe15f6e5583cc6149c660e65a018222d21e33a36cd54dc3f6d45d09c0dea736bda732fc5899ec542669412c04dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5e6eb2be537b959797c267c89f65eba3

SHA1
302f67143494f9fa1fa7730b5f07684d7229312b

SHA256
45b63ca65bf32f08217221c3cf12fe6be2cde7a5f77756b12ac91f6d16fd7b2d

SHA512
c8d2df7933e73239e9bc7748233e02ed7903d1f646f78ffe00227b1731b7417bbc494b1414ad8c16d92b74144d77882725ec60299e5952caae13713e1463c027

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
447e44f87feb7d1ec35975e4b172324c

SHA1
020fc39b27cb4968fe8f3e45e04f0b331458fe07

SHA256
4cb395be8bd9920731519b870a0e3c516ba316955bbbc4ca2f1469a850ef3932

SHA512
5fd419596bde041fa92608215a97d9c124beaebbb9f7b68856a397eb6d5eb17d0acd38de608c8339c1da2d865e1a8de8a23e1ce5137be3031ebeca473d8b7726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5265106df9b48ea95852920175eb3909

SHA1
c2277c5c3d87879e4b1e721d698fab8004ded733

SHA256
ff5c302ea8ebd59e4a9428a9a3240ca6943b42e2df65526b8fe9065d9a128734

SHA512
e259bc82475fe3771b8b15ec0d6cf96a2ffbbe160d0517b292d769925548579626e626ed506e1fea572437bbea088d007acfea91fac46fc16b1fb4e84170ab1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
dd5a10aa41d0383482717e6f5148dc47

SHA1
02517154102092acf4a4dfcdb493ec3bfd6ea3f4

SHA256
f1aafa27d90767c7fe44f78943e3ee10322c21a37e5eb061a1b8466129670b72

SHA512
040428f0e03b884b0022d9941f39830509e11c37e720bb220eea24257e9fb5f621cfbcd4415b8f1e61b3e4cd9127890ce3f90fa2c3e0e204f062926263fc420d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c043.TMP

Filesize
371B

MD5
62fbd65723feaf5f00b3262708c79c69

SHA1
19af51731266a29f38d4574199b66a944d721278

SHA256
11b1868cf7c1cd382a3fe1d71131a9dded7c9b50240e270d35f2efc83b849527

SHA512
dd1403e5e8d46a2c51ee8a5b48e61030d7d6961dbb1deb49e2ed6e2f784b7a4293c136d6c65d7c02f535ab911e0ce5001ec4fd693435318b5aa248f3527cc997

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e5822afcba48c2270d75afd8056900ec

SHA1
0646e33198f79853770e134630394a8274b8edc2

SHA256
bec6d34992e3aca20089804fde27475ab48f56c6b6ed9addfb64769788698167

SHA512
a18738e92350b16b4f8a4e1f332d0412226cd7a098cca85fe531350c20de5543b2c42205eec655471f08ff199e92fa2c5ca22ce63eb4ff2a16f77d5c03080ca4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dc3ca87cf1b06c2dfbf44debb6fd2ede

SHA1
e9a5b5aec6f05480c11f7515970add665d8ed698

SHA256
482540e40fdf27be6cc99538515b5368134bbd76b3ef4e49a5413c4fe12d06b0

SHA512
69974c62afb96ddeec0e68c7a84cdc3e34ed553520cec7800704715324b079b4b0789b74bc45c1ab3b18747334a8e6778b1b3e7f8f75f860b6f3fd04fb8bb042

Download Submit