89e3de1f0073b5782d600743c8e67e02d00ec24d656ad77712a43cc762aa9375

Analysis

max time kernel
719s
max time network
624s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 14:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

image.zip
Size

436KB
MD5

7c8faafdcf018fd32dc02edba3477f56
SHA1

94db0e3104cda0a7fc428fca39d9694cf1af2188
SHA256

89e3de1f0073b5782d600743c8e67e02d00ec24d656ad77712a43cc762aa9375
SHA512

d09f10cde434b153addad2f9c45aed8bf741ebdbb97cc5f43760ed6c2b4d72632e6d7e635e75f1533aff93f508982a07ea51dd22e9275ede985426f0cd3120de
SSDEEP

6144:GMfTVDdMWb/9Y1VKkF7d8v+D/DbqLSwsIF1FNJi6BoMY2DmVyTRo7enE:GMfTxdpCoknPzDbqLSuiko0iGov

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
3908	msedge.exe
3908	msedge.exe
1368	identity_helper.exe
1368	identity_helper.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 3184	3908	msedge.exe	102
PID 3908 wrote to memory of 3184	3908	msedge.exe	102
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 5044	3908	msedge.exe	103
PID 3908 wrote to memory of 4952	3908	msedge.exe	104
PID 3908 wrote to memory of 4952	3908	msedge.exe	104
PID 3908 wrote to memory of 1636	3908	msedge.exe	105
PID 3908 wrote to memory of 1636	3908	msedge.exe	105
PID 3908 wrote to memory of 1636	3908	msedge.exe	105
PID 3908 wrote to memory of 1636	3908	msedge.exe	105
PID 3908 wrote to memory of 1636	3908	msedge.exe	105
PID 3908 wrote to memory of 1636	3908	msedge.exe	105
PID 3908 wrote to memory of 1636	3908	msedge.exe	105
PID 3908 wrote to memory of 1636	3908	msedge.exe	105
PID 3908 wrote to memory of 1636	3908	msedge.exe	105
PID 3908 wrote to memory of 1636	3908	msedge.exe	105
PID 3908 wrote to memory of 1636	3908	msedge.exe	105
PID 3908 wrote to memory of 1636	3908	msedge.exe	105
PID 3908 wrote to memory of 1636	3908	msedge.exe	105
PID 3908 wrote to memory of 1636	3908	msedge.exe	105
PID 3908 wrote to memory of 1636	3908	msedge.exe	105
PID 3908 wrote to memory of 1636	3908	msedge.exe	105
PID 3908 wrote to memory of 1636	3908	msedge.exe	105
PID 3908 wrote to memory of 1636	3908	msedge.exe	105
PID 3908 wrote to memory of 1636	3908	msedge.exe	105
PID 3908 wrote to memory of 1636	3908	msedge.exe	105

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\image.zip
1⤵
PID:1256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff945c846f8,0x7ff945c84708,0x7ff945c84718
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,14004449699235124908,2903201029314683396,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,14004449699235124908,2903201029314683396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,14004449699235124908,2903201029314683396,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3020 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14004449699235124908,2903201029314683396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14004449699235124908,2903201029314683396,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14004449699235124908,2903201029314683396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14004449699235124908,2903201029314683396,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,14004449699235124908,2903201029314683396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3612 /prefetch:8
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,14004449699235124908,2903201029314683396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3612 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14004449699235124908,2903201029314683396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14004449699235124908,2903201029314683396,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14004449699235124908,2903201029314683396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,14004449699235124908,2903201029314683396,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2872 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1fe3a26bd35b84102bb4203f31e74c7

SHA1
45fdfa8433789b575eb64e116718e62e0e0cf4a0

SHA256
26e0d51529de906dd285ba48288e25eaf5213c0f0bab9bc5f119ecbc5e1b93ee

SHA512
d528db2e9b917d4fbe24b1b5c6f4cb274f4f91c84f63e5119e041fa89ae0cd01a370e314f8b6aca9d6fa958e79feabc720f4b54b3d8aed69aab11fa84cad36bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2915233ace3b11bc8898c958f245aa9a

SHA1
68c6aa983da303b825d656ac3284081db682f702

SHA256
b2cb442f2ca27619c8df087f56fcbbb53186c53f8fd131af886ee3712220477e

SHA512
e3f1b70d39b615e212f84d587ee816598236ee6ce144d919593894fcce4a0900343a9e8b837a0d1bd10921fff1c976c84c4a570eda776fe84d374a69e7a54890

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ccfc6624881c71e7d1f0b767618bcac2

SHA1
731b321f19d55f5f71ef68ad8f6650f8d946b11f

SHA256
0b5ef10bc90072ef44d20f5d33c5ca985063400960bdbe92aa713a92bb5b83f9

SHA512
4347808d94b3f61f0d3280d5dbff76db7bc7e873fd353c99c1a29c46ea43991ded17695b7d813e5e72f3e2a846b40d4208f73ee212d0543313bf2e706901b73e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5f93b5a3381da67c427f80ac36a68586

SHA1
e7fb6d469d9647757fb3f135ed0ed9a71ad12407

SHA256
a348101a888fe218cecc2b05a2195598fe6e139722b7c32ac172508b3e485d10

SHA512
ed0e784e0ec8b2ed0122efa4e2a1a6555c2d45de10c49486786a0965b2050fed3f2fd64c2529ffa17bbbe58e40491ef2f66a5c33e997bae8d6569405adf1a43a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
aac080c21c0074d16e9c0bfef3c06b54

SHA1
92a56771ac64a45bc6de792a65feba807be8aed8

SHA256
7bd7c9e5fa49ca2edeaf539a4f6deb70d49b0f691bf9c760f74ef0df5bc0678d

SHA512
0f11dacadbfa09ef60290ef56941dff0d9586f853730e79729fcd04d512ce0f8bebcaa9691a4639e87f2aecfa308f07a63d5af945e4bc47858ad8a98982934aa

Download Submit