18a919efd1cbc2d3b39bd623827b4bc5fa719dffa538fc53a47e085818a75826

Analysis

max time kernel
147s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
07-07-2024 11:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

1.8MB
MD5

3039c56eaee9a3fc5f5afc4308677621
SHA1

7a086a48f26fb737da3ac5c2ea19d0ea8fa83c9d
SHA256

ab04ac8c6bb2f55557c83f6fe5b004cf6b9e708f2e01afd2a898c3f37d4a872b
SHA512

ef261d1c1136889cf6d64aaf5c00de17406025e73a35be29dde43ca533ee52563379ea9f477667ac259460ca70fb21807bf6019b543988366225a9b716ea437b
SSDEEP

24576:DHmnLiLXkNwOuyZBQrorQKh4czkUnWQqS:DHmLA0dOGhn5qS

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2764	msedge.exe
2764	msedge.exe
1428	msedge.exe
1428	msedge.exe
3404	identity_helper.exe
3404	identity_helper.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe
1428	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 4872	1428	msedge.exe	83
PID 1428 wrote to memory of 4872	1428	msedge.exe	83
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 1604	1428	msedge.exe	84
PID 1428 wrote to memory of 2764	1428	msedge.exe	85
PID 1428 wrote to memory of 2764	1428	msedge.exe	85
PID 1428 wrote to memory of 2336	1428	msedge.exe	86
PID 1428 wrote to memory of 2336	1428	msedge.exe	86
PID 1428 wrote to memory of 2336	1428	msedge.exe	86
PID 1428 wrote to memory of 2336	1428	msedge.exe	86
PID 1428 wrote to memory of 2336	1428	msedge.exe	86
PID 1428 wrote to memory of 2336	1428	msedge.exe	86
PID 1428 wrote to memory of 2336	1428	msedge.exe	86
PID 1428 wrote to memory of 2336	1428	msedge.exe	86
PID 1428 wrote to memory of 2336	1428	msedge.exe	86
PID 1428 wrote to memory of 2336	1428	msedge.exe	86
PID 1428 wrote to memory of 2336	1428	msedge.exe	86
PID 1428 wrote to memory of 2336	1428	msedge.exe	86
PID 1428 wrote to memory of 2336	1428	msedge.exe	86
PID 1428 wrote to memory of 2336	1428	msedge.exe	86
PID 1428 wrote to memory of 2336	1428	msedge.exe	86
PID 1428 wrote to memory of 2336	1428	msedge.exe	86
PID 1428 wrote to memory of 2336	1428	msedge.exe	86
PID 1428 wrote to memory of 2336	1428	msedge.exe	86
PID 1428 wrote to memory of 2336	1428	msedge.exe	86
PID 1428 wrote to memory of 2336	1428	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82ef546f8,0x7ff82ef54708,0x7ff82ef54718
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,12040161724800708153,17244421731069509238,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,12040161724800708153,17244421731069509238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2472 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,12040161724800708153,17244421731069509238,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12040161724800708153,17244421731069509238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12040161724800708153,17244421731069509238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12040161724800708153,17244421731069509238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12040161724800708153,17244421731069509238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12040161724800708153,17244421731069509238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12040161724800708153,17244421731069509238,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,12040161724800708153,17244421731069509238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,12040161724800708153,17244421731069509238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,12040161724800708153,17244421731069509238,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b6c11a2e74ef272858b9bcac8f5ebf97

SHA1
2a06945314ebaa78f3ede1ff2b79f7357c3cb36b

SHA256
f88faeb70e2a7849587be3e49e6884f5159ac76ef72b7077ac36e5fbf332d777

SHA512
d577a5b3a264829494f5520cc975f4c2044648d51438885f319c2c74a080ea5dd719b6a885ed4d3401fd7a32341f88f26da5e3f29214da9afbbbd5ee950e8ec3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9abb787f6c5a61faf4408f694e89b50e

SHA1
914247144868a2ff909207305255ab9bbca33d7e

SHA256
ecfd876b653319de412bf6be83bd824dda753b4d9090007231a335819d29ea07

SHA512
0f8139c45a7efab6de03fd9ebfe152e183ff155f20b03d4fac4a52cbbf8a3779302fed56facc9c7678a2dcf4f1ee89a26efd5bada485214edd9bf6b5cd238a55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
77b818636045fc83f1a59503b65ec685

SHA1
9dfc52ca150b696a1da9ee4a71125d2146236ddb

SHA256
3171bfa49052431ef0d7ae024149624ff5fa61a595c1d3bce1c82a42c90c00b9

SHA512
02e5bfd3449d7bf985f2d8dce36a170e3461575244e3b31e958f72b311c16b3bc54c54672f6b1ec9d37cdac410e2f5903b4da5c8307e43cfd649b392f519bfde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
beb8e9f69f893a1e2b0b1c8460ec32b0

SHA1
b8ae60894d61c54da618a3abd53c5da134bb0085

SHA256
813c808fd9cde7b787876ec40c9a13e253a6714ba4ab93cf4c5d634271b51b38

SHA512
98422b477bc36f1559eb01d0d76f28c47e6844bd0fa7d791cb56270d5152d657fa576f113465c51d740b7609870f8246b79d86b1b9793a722bb06c364a8db17d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4fefa8e47280285e682e2ffe4f4d1dd9

SHA1
3111e7fd94f1fa9043611069e6943d5bc473bda0

SHA256
d21007f714710cec3d2f3d431f427d9116fa0c76ea900c5e5003a672817671d3

SHA512
e7ea3b688ceb4b446cf971c511e887d8e118934b61fa57ff1566cf37409f86e193bd9da61bb6e73aa24a0c6e005ccc6dc6b22c1933b828b8dbe666cb8299bc3d

Download Submit