hxxp://fbi[.]gov

Analysis

max time kernel
149s
max time network
158s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
06/07/2024, 16:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://fbi.gov

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3352	msedge.exe
3352	msedge.exe
4924	msedge.exe
4924	msedge.exe
1736	msedge.exe
1736	msedge.exe
4712	identity_helper.exe
4712	identity_helper.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 3864	4924	msedge.exe	80
PID 4924 wrote to memory of 3864	4924	msedge.exe	80
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 4172	4924	msedge.exe	81
PID 4924 wrote to memory of 3352	4924	msedge.exe	82
PID 4924 wrote to memory of 3352	4924	msedge.exe	82
PID 4924 wrote to memory of 840	4924	msedge.exe	83
PID 4924 wrote to memory of 840	4924	msedge.exe	83
PID 4924 wrote to memory of 840	4924	msedge.exe	83
PID 4924 wrote to memory of 840	4924	msedge.exe	83
PID 4924 wrote to memory of 840	4924	msedge.exe	83
PID 4924 wrote to memory of 840	4924	msedge.exe	83
PID 4924 wrote to memory of 840	4924	msedge.exe	83
PID 4924 wrote to memory of 840	4924	msedge.exe	83
PID 4924 wrote to memory of 840	4924	msedge.exe	83
PID 4924 wrote to memory of 840	4924	msedge.exe	83
PID 4924 wrote to memory of 840	4924	msedge.exe	83
PID 4924 wrote to memory of 840	4924	msedge.exe	83
PID 4924 wrote to memory of 840	4924	msedge.exe	83
PID 4924 wrote to memory of 840	4924	msedge.exe	83
PID 4924 wrote to memory of 840	4924	msedge.exe	83
PID 4924 wrote to memory of 840	4924	msedge.exe	83
PID 4924 wrote to memory of 840	4924	msedge.exe	83
PID 4924 wrote to memory of 840	4924	msedge.exe	83
PID 4924 wrote to memory of 840	4924	msedge.exe	83
PID 4924 wrote to memory of 840	4924	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://fbi.gov
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffceac93cb8,0x7ffceac93cc8,0x7ffceac93cd8
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,11522605120187105968,16334743251940542397,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,11522605120187105968,16334743251940542397,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,11522605120187105968,16334743251940542397,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,11522605120187105968,16334743251940542397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,11522605120187105968,16334743251940542397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,11522605120187105968,16334743251940542397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1872,11522605120187105968,16334743251940542397,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,11522605120187105968,16334743251940542397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,11522605120187105968,16334743251940542397,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,11522605120187105968,16334743251940542397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,11522605120187105968,16334743251940542397,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1872,11522605120187105968,16334743251940542397,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,11522605120187105968,16334743251940542397,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2508 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b297afa13018b3e24efaf2b905677172

SHA1
6d6d01d9b35901af0f4976d0819bab393e920f98

SHA256
e810acf7bb28b7577c33ad7b22b3b849858e45e9c16ba316b0ba945ef48337dc

SHA512
72dc4db9a40e9e0947c2d58835a75077d65f1f1939463aad5a81368be891890d8d19d1d9df858c957b5a43998ef6100b29710231496636cabc66a1e3a1cc6c2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3f42f939f0a7c91eef0187527bc7babc

SHA1
66d141ee21ab2de3a37f1d92e327aa184d828fd5

SHA256
64a131bb18bd4844b4ea4b6bc84727c638b94523be764dad0b1407394c457c6d

SHA512
18d62cb1f7d7229c37432e83f2356c865099caa9d43f716b465e8624d9288b1a3024bba84a1e83f6721c31a71eecdadf4118848ce4a63bf1230be4e16ead4178

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
33b4fb9af58ad2d852ce05ab77a5cca8

SHA1
027252d9fcc3fe2c76471874091baf8c205c9098

SHA256
b2da5263d71aadd2b20d9187f5fb74d9f988ee066f9fbb18e747620cc024abb4

SHA512
ac0778e4b3546658e93082890c570e909e9362e30022a59318b4e62de838b25fbd3742fb2e5bc85e8e92528d633ec0ff33df854dd24cee8d08ee3357b7a016f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7cd173606007697d6a3984ff3fc29261

SHA1
a91da9339e5c6146e5640710b44254533df7634c

SHA256
8f678377214c54f3b879e968a1bb42de719cbd4d716c99d93c37e9d5565ee5e1

SHA512
7988f6a0c1490730706bf6dfe2bdcfe306c5fdccca6026674396ba5c6e2ba708e915ab5adf7e0fc6ab1403eeb0380c44807587a0e56e5acd0e69ce0d090da87c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
aff4cc648147c88a0edee28c21dcfa84

SHA1
4c66baa7ef40919b408a5fd8ce6aaa11bd7f1d87

SHA256
f67cfe66ea2fc06acdec048a0953a3195cd307c153fceee22b02e0daa2de59db

SHA512
49c59f16559064bdf43887b7fd60dbd6de57fce24b03ab1743123295876a0e2eb8507c141590fa130263db812e3b2381240409652a9298e21528df703646cef9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
161125102f4c8c6f9ae929795581c3fa

SHA1
59370215f20d425dc27712dd303bb2a5aa268124

SHA256
141200f6b0255d810469dcdfd207ecd6673991b7497b5443e5a092ab3df0600e

SHA512
b67d1f7ba501945df02d7c2f64afab217f0c423a61a1191133dd79909691b57699a5b92b2c98036826138cf974abd2ecfbc4fa81852b114f1e547f7fe56065b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8624e2f7333bd4a091df8892cc97424d

SHA1
6969ff194a25ec8b6c536664742ffd76922a1140

SHA256
07ed3433ab3235eaddadf9ff46741b42bb21a7a560f70f2a84c58468351a0a9a

SHA512
7ac12eb668eb4e2e8d5d928ac48ba58bacae7cc46674821ace94820cc278058f117449ba7868fba7010db2c1a018684787bafa1dee6df9521a13ce71d1d0781e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c9eec8de82eeeab517be9576747093bd

SHA1
852ea6706d6c8d82fb9aeba33b3ba79f723826ba

SHA256
c6b110d03f539a4fd00970e6f4a4add246c849bed0e32f29da333dbeb8649ab9

SHA512
b81873b90f56196cd08fe1834216365e0bb13c63ba39b7f080f8e7e9300e4bcd6cb582da53bf1852766ce70004d0b7b680cfde6383b17619b0277843aa8b7d99

Download Submit