6b8785d7d3dc581d1cfa19fbcd2b9fd11a914be94a85692f5c78b3984a1ce027

Analysis

max time kernel
481s
max time network
489s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05/07/2024, 20:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PROGRAMFILES/RocketDock/Help/German/index.html
Size

23KB
MD5

c74865449c952377532bc1afad5807a0
SHA1

6d8980e5eda855129c5630a4648b0b8023337018
SHA256

46b8472d8ef58ba39e5ef55447af3575946dadc383dc888d4961e21e6d46f652
SHA512

6229c3eb628d297519632750a0a51f70ccfffc63b4e865b6ccf2b8500d24aa9a8de064ff8d21d04dd3657f69891d2d849cd52c20329257ad543e9dd68e247641
SSDEEP

384:NPZ9ALRorYuehhG4P9zMpOxHHOpCPtxuCOUbY9L5o30pdCLEG+kAVkF65P:NP8LRaYuehhG4P9zMYxHHOpC1xdY9Fo8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2872	msedge.exe
2872	msedge.exe
3128	msedge.exe
3128	msedge.exe
2072	identity_helper.exe
2072	identity_helper.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 3452	3128	msedge.exe	83
PID 3128 wrote to memory of 3452	3128	msedge.exe	83
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 5000	3128	msedge.exe	84
PID 3128 wrote to memory of 2872	3128	msedge.exe	85
PID 3128 wrote to memory of 2872	3128	msedge.exe	85
PID 3128 wrote to memory of 1288	3128	msedge.exe	86
PID 3128 wrote to memory of 1288	3128	msedge.exe	86
PID 3128 wrote to memory of 1288	3128	msedge.exe	86
PID 3128 wrote to memory of 1288	3128	msedge.exe	86
PID 3128 wrote to memory of 1288	3128	msedge.exe	86
PID 3128 wrote to memory of 1288	3128	msedge.exe	86
PID 3128 wrote to memory of 1288	3128	msedge.exe	86
PID 3128 wrote to memory of 1288	3128	msedge.exe	86
PID 3128 wrote to memory of 1288	3128	msedge.exe	86
PID 3128 wrote to memory of 1288	3128	msedge.exe	86
PID 3128 wrote to memory of 1288	3128	msedge.exe	86
PID 3128 wrote to memory of 1288	3128	msedge.exe	86
PID 3128 wrote to memory of 1288	3128	msedge.exe	86
PID 3128 wrote to memory of 1288	3128	msedge.exe	86
PID 3128 wrote to memory of 1288	3128	msedge.exe	86
PID 3128 wrote to memory of 1288	3128	msedge.exe	86
PID 3128 wrote to memory of 1288	3128	msedge.exe	86
PID 3128 wrote to memory of 1288	3128	msedge.exe	86
PID 3128 wrote to memory of 1288	3128	msedge.exe	86
PID 3128 wrote to memory of 1288	3128	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\RocketDock\Help\German\index.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb487846f8,0x7ffb48784708,0x7ffb48784718
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,14860785196886537300,15907432259489938275,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,14860785196886537300,15907432259489938275,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,14860785196886537300,15907432259489938275,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14860785196886537300,15907432259489938275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14860785196886537300,15907432259489938275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,14860785196886537300,15907432259489938275,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,14860785196886537300,15907432259489938275,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14860785196886537300,15907432259489938275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14860785196886537300,15907432259489938275,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14860785196886537300,15907432259489938275,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14860785196886537300,15907432259489938275,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,14860785196886537300,15907432259489938275,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fbc957a83b42f65c351e04ce810c1c11

SHA1
78dcdf88beec5a9c112c145f239aefb1203d55ad

SHA256
7bb59b74f42792a15762a77ca69f52bf5cc4506261a67f78cd673a2d398e6128

SHA512
efad54eb0bd521c30bc4a96b9d4cb474c4ca42b4c108e08983a60c880817f61bc19d97538cc09a54b2db95ab9c8996f790672e19fb3851a5d93f174acdfac0ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5b6ff6669a863812dff3a9e76cb311e4

SHA1
355f7587ad1759634a95ae191b48b8dbaa2f1631

SHA256
c7fb7eea8bea4488bd4605df51aa560c0e1b11660e9228863eb4ad1be0a07906

SHA512
d153b1412fadda28c0582984e135b819ba330e01d3299bb4887062ffd6d3303da4f2c4b64a3de277773f4756da361e7bc5885c226ae2a5cfdd16ee60512e2e5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
df085d40e923bf015aa5f0ba74d35e7a

SHA1
6c7f0ce649d841d826695b52c01aaf1c2c92e54c

SHA256
bc4cca2419629c335b30a9074dea6351049e04813bdfb256e22a08d062202ee3

SHA512
33c5f0117e243014d7b12497b8b2535b59d884f967d6e81b41a3898833abce90c663c207860253e717aa2db8518a42cd555d3e3e0e9a8621397457194e86253b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
82bb158b0e366ec3913b35246aea10ba

SHA1
8a7bab012a7e39862858a50ff9f5a3e93b0ff571

SHA256
a65fdb76f2856b84e9a0b09b9611ffb1374c8ef06b450f6cbe91e672a40f881e

SHA512
46ad0d031d2d59d7bacf0cfd71407c8459a6d543cf6d63e0784a97e10f050b526ae5d156dd2222b4e7ab2b02d626dfc2c4ccbf5a5399a080275487f112457ffb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e1d8d5dfad9a9a06b45af10f4aab4bac

SHA1
91efdef7e04773cbc6bf9c649948b815bf2fe6a2

SHA256
bda3faaf01a96ec7afc3cc7be235d46b5aab175faac02ec9d816743e0a31d755

SHA512
98842db1275bb55be5843dc1e2575a4ee34b39ce2d542b9fbda372f45c829bd6a26ec7194e0d56f64d6889c6f3df3f7437069cc79adebbdb8b0f5d84fcda7503

Download Submit