f6dea9e303e32a64e1d30893cf904f1017c1742e436e41f118fd8c09cd6730d2

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 04:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/WebApp/Failed.htm
Size

5KB
MD5

1312c82b6bd4d4d0e9fcbdf6273259e3
SHA1

24c8e177b6e92c8647e5df69c33743ec87005552
SHA256

ac864b3a3b4cbe67d91fb7c646649a810b8960992a5ea6487bafad208530faf5
SHA512

4a7e3f77e103e932e3ec3e7f23c2aff3b74535be896832403d0dfaf496035af2bef78005c4dbc8845ecbb2a95c54456d2745534623416c69220d348224c46694
SSDEEP

48:QrA4QWWrR3XcJ3EHn7Q5xBxw7z7ysEfpyyxgQvdvHlbFsGhLh48gpPPeBX4yHu:amQ3EMXyQfpyyxgsHJh48gpyHu

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
2192	msedge.exe
2192	msedge.exe
3968	identity_helper.exe
3968	identity_helper.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 1440	2192	msedge.exe	81
PID 2192 wrote to memory of 1440	2192	msedge.exe	81
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 4848	2192	msedge.exe	83
PID 2192 wrote to memory of 3480	2192	msedge.exe	84
PID 2192 wrote to memory of 3480	2192	msedge.exe	84
PID 2192 wrote to memory of 1232	2192	msedge.exe	85
PID 2192 wrote to memory of 1232	2192	msedge.exe	85
PID 2192 wrote to memory of 1232	2192	msedge.exe	85
PID 2192 wrote to memory of 1232	2192	msedge.exe	85
PID 2192 wrote to memory of 1232	2192	msedge.exe	85
PID 2192 wrote to memory of 1232	2192	msedge.exe	85
PID 2192 wrote to memory of 1232	2192	msedge.exe	85
PID 2192 wrote to memory of 1232	2192	msedge.exe	85
PID 2192 wrote to memory of 1232	2192	msedge.exe	85
PID 2192 wrote to memory of 1232	2192	msedge.exe	85
PID 2192 wrote to memory of 1232	2192	msedge.exe	85
PID 2192 wrote to memory of 1232	2192	msedge.exe	85
PID 2192 wrote to memory of 1232	2192	msedge.exe	85
PID 2192 wrote to memory of 1232	2192	msedge.exe	85
PID 2192 wrote to memory of 1232	2192	msedge.exe	85
PID 2192 wrote to memory of 1232	2192	msedge.exe	85
PID 2192 wrote to memory of 1232	2192	msedge.exe	85
PID 2192 wrote to memory of 1232	2192	msedge.exe	85
PID 2192 wrote to memory of 1232	2192	msedge.exe	85
PID 2192 wrote to memory of 1232	2192	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\WebApp\Failed.htm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff955f646f8,0x7ff955f64708,0x7ff955f64718
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,13197241699521177071,3429498014777639267,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,13197241699521177071,3429498014777639267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,13197241699521177071,3429498014777639267,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13197241699521177071,3429498014777639267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13197241699521177071,3429498014777639267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,13197241699521177071,3429498014777639267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,13197241699521177071,3429498014777639267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13197241699521177071,3429498014777639267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13197241699521177071,3429498014777639267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13197241699521177071,3429498014777639267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,13197241699521177071,3429498014777639267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,13197241699521177071,3429498014777639267,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0d9e81bdd937f066a00d0199bfe4954b

SHA1
b50a52ccd719019700743abe3938a138f664d615

SHA256
4dfb9af62a9862397d550711d213e32f17994634ddcab0f1cd3d79544a59ef68

SHA512
e4350f37c92e5b63dc2d3be21b332c6d976c2ab0122922b5baa2c7738436d117bb01ed34564fd290ae046bc3a2e9d081b44f0411d5f4ae04b0b2c106705d49b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
250d7431b92068412fe786ebe40ec79c

SHA1
6031e9d9561cf93ea0de7f1fbe12ffecfffa18f4

SHA256
a2ac87e6365458a77a43ef421dac577bfa7e22e6096e39d31bcd553c8bf16834

SHA512
15eb9609a92be7cea46f3df6b805cb0512bfd68eeb5f1cf28bfa77dce5199827926ec5384efd24a4b3cf249ebb00a8e5c42076f0b802794c1ba2657636df8b90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
83d6b14fccd329099e2d204bf71ce3e2

SHA1
1d67abf5d2db97e3a00ec64eaddb20eabf8caf9c

SHA256
7bc0630bfb4f3c5df8b6aabcab59270e1b7eb49766d6891a52ffbf2c8db347dc

SHA512
ba47021175026cdbffed9806b2c6474c2d2f1e1b3dfcbbe67dbec371aec2513f9702b8cfcfb3f17f196d9519be1fbe15cc282de61ad690fb528309a6be5ae9f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d8442a7e0604cd163ced2767156ea290

SHA1
3cf3906b8e09d0d26993e087ff3c0b095182ca72

SHA256
4f7a5b180ce6a3e741dd675adbfa84f95ba66f5c9803d59a481fd667bf1aac8b

SHA512
2606e2de923c57c0488fba40c064553fdb094d41f6698471b88cb5439adaf4a9f088eedc84e4cecb07e21967d9a1fc9fc11284c8d9a680d63f89b8e2303f8992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
095cd3eb0f7eb33b8777af619e25cc92

SHA1
bc9fbbcfe504769501deb125ca73aa97c11d3817

SHA256
a30fa7c125828a637ef7e68dbe72eca59bcb91c4effc4337a4f11f82704eafef

SHA512
e115e8b84bc4a24cfa30d9582cf15554f252c20a87b8df95cf80a32da27becf799f8619b075c78d9501d2adbe165ae76eba2c8e12acb1302f66d741749c03107

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a85258b71fa2ca1eb80590fe7fafe00d

SHA1
b11e6b801857729bdfaa01d7d69010044d2eab3a

SHA256
6a61226d243a5499aff65b5331e113a2cbc750cc21a8359690e7956f0faf7fc8

SHA512
bb1e9726c75563d7eacde04cc9940bcaafd78e5ea570265363c92c630bc77d3a85307c5439820869b14e5a4d3de215ae83adf2d21457e277454a4ec170e53d81

Download Submit