18a919efd1cbc2d3b39bd623827b4bc5fa719dffa538fc53a47e085818a75826

Analysis

max time kernel
148s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
07-07-2024 12:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

1.8MB
MD5

3039c56eaee9a3fc5f5afc4308677621
SHA1

7a086a48f26fb737da3ac5c2ea19d0ea8fa83c9d
SHA256

ab04ac8c6bb2f55557c83f6fe5b004cf6b9e708f2e01afd2a898c3f37d4a872b
SHA512

ef261d1c1136889cf6d64aaf5c00de17406025e73a35be29dde43ca533ee52563379ea9f477667ac259460ca70fb21807bf6019b543988366225a9b716ea437b
SSDEEP

24576:DHmnLiLXkNwOuyZBQrorQKh4czkUnWQqS:DHmLA0dOGhn5qS

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2376	msedge.exe
2376	msedge.exe
1876	msedge.exe
1876	msedge.exe
3844	identity_helper.exe
3844	identity_helper.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 3252	1876	msedge.exe	83
PID 1876 wrote to memory of 3252	1876	msedge.exe	83
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2088	1876	msedge.exe	84
PID 1876 wrote to memory of 2376	1876	msedge.exe	85
PID 1876 wrote to memory of 2376	1876	msedge.exe	85
PID 1876 wrote to memory of 2328	1876	msedge.exe	86
PID 1876 wrote to memory of 2328	1876	msedge.exe	86
PID 1876 wrote to memory of 2328	1876	msedge.exe	86
PID 1876 wrote to memory of 2328	1876	msedge.exe	86
PID 1876 wrote to memory of 2328	1876	msedge.exe	86
PID 1876 wrote to memory of 2328	1876	msedge.exe	86
PID 1876 wrote to memory of 2328	1876	msedge.exe	86
PID 1876 wrote to memory of 2328	1876	msedge.exe	86
PID 1876 wrote to memory of 2328	1876	msedge.exe	86
PID 1876 wrote to memory of 2328	1876	msedge.exe	86
PID 1876 wrote to memory of 2328	1876	msedge.exe	86
PID 1876 wrote to memory of 2328	1876	msedge.exe	86
PID 1876 wrote to memory of 2328	1876	msedge.exe	86
PID 1876 wrote to memory of 2328	1876	msedge.exe	86
PID 1876 wrote to memory of 2328	1876	msedge.exe	86
PID 1876 wrote to memory of 2328	1876	msedge.exe	86
PID 1876 wrote to memory of 2328	1876	msedge.exe	86
PID 1876 wrote to memory of 2328	1876	msedge.exe	86
PID 1876 wrote to memory of 2328	1876	msedge.exe	86
PID 1876 wrote to memory of 2328	1876	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec0c346f8,0x7ffec0c34708,0x7ffec0c34718
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,9073821417017814477,11379945385757711698,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,9073821417017814477,11379945385757711698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,9073821417017814477,11379945385757711698,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9073821417017814477,11379945385757711698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9073821417017814477,11379945385757711698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9073821417017814477,11379945385757711698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9073821417017814477,11379945385757711698,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,9073821417017814477,11379945385757711698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4328 /prefetch:8
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,9073821417017814477,11379945385757711698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9073821417017814477,11379945385757711698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9073821417017814477,11379945385757711698,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,9073821417017814477,11379945385757711698,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a27d8876d0de41d0d8ddfdc4f6fd4b15

SHA1
11f126f8b8bb7b63217f3525c20080f9e969eff3

SHA256
d32983bba248ff7a82cc936342414b06686608013d84ec5c75614e06a9685cfe

SHA512
8298c2435729f5f34bba5b82f31777c07f830076dd7087f07aab4337e679251dc2cfe276aa89a0131755fe946f05e6061ef9080e0fbe120e6c88cf9f3265689c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f060e9a30a0dde4f5e3e80ae94cc7e8e

SHA1
3c0cc8c3a62c00d7210bb2c8f3748aec89009d17

SHA256
c0e69c9f7453ef905de11f65d69b66cf8a5a2d8e42b7f296fa8dfde5c25abc79

SHA512
af97b8775922a2689d391d75defff3afe92842b8ab0bba5ddaa66351f633da83f160522aa39f6c243cb5e8ea543000f06939318bc52cb535103afc6c33e16bc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
18f8893cdd2dcba27467afdbed690898

SHA1
e80d797a80c0d4701c451269f2f4223adb832e2e

SHA256
49f21d9aa2b458e0fc535f45462c90a4e75fafeebc04466d3e2320e879cef54c

SHA512
8f263267d1bb3f0be9e9b34586d9313af51a735907bc7b3ce9d00810666b34a29a92452ebe9b8f6cd8f0d8be25ded1059c894b63783cf748ac3e69d580be67b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
95d3dcae9f74545d8c6b27d6fc198171

SHA1
60cdd74b14afd21a4438694dac99f846add97107

SHA256
f9e6d95e80cc554316494fd2578471dbe967a74afdcf8ddad2fc280c5b02bd50

SHA512
71f27ac0aaff7a34dc44610fa14b2b126d7f8941f91652db4a6de79a98e7c55b016717aa6af98f04810c6ec4b24a621c827ceb52388caa099c36c5eca975bbd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
32517a7158122b4cf6775e438bdaf38e

SHA1
c5d012c3b26a00c941b6159757db58ad2d1d8d1a

SHA256
090e26e59d50a50077f5340ffe9005b14661154f1661438ae1193b1022cef438

SHA512
66326da0715f7eaf553c6a7702d315c8540a44ca64d33b2821a1f5b82f37a2b2ea21926d4e054a57e039776d7a4b040291957a9991bad134c54f34ca2558ab01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
30af47c351529be886b82dd73ed451f7

SHA1
54ed61555b29269591efe1feec133cd5e267441c

SHA256
c770a2695c9d1f5c49ae4c6fb151299191c311e1378b82fdf52f0f6e9f7645b4

SHA512
f6dc4ab50cbc094656c777b593c9ef29ce92f8169b70181abc30833b8978af72adc3963b7d52c6dbb09aa7b472a244e5d063b7a375cac79d5ae449b2b3b1b570

Download Submit