6b7ff4b60d287c4c91361649b1c1dbca86da8d3089abb57a72cdd005d1a0dab8

Analysis

max time kernel
145s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
09-07-2024 19:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fafatong/data/db_backup/index.html
Size

53B
MD5

968f5932ad8d646f7107b3d7557cb263
SHA1

2046eea65ef55a157690e668c7f53a855d9c27fd
SHA256

acd7778b3075dba7854b8f410c2577b557caa55ef8874d3e59029e73860b23fe
SHA512

bb070043675dcade6a35996764d4f719f102bdfd3ca23b180e96a0da7bc4c7b39d237a17762a6c26eaa27d7811260551c78f332ef09af7fb85d051aa14f84749

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2772	msedge.exe
2772	msedge.exe
1248	msedge.exe
1248	msedge.exe
1112	identity_helper.exe
1112	identity_helper.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1248 msedge.exe
1248 msedge.exe
1248 msedge.exe
1248 msedge.exe
1248 msedge.exe
1248 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1248 wrote to memory of 5076	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 5076	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 3676	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 2772	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 2772	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 4948	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 4948	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 4948	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 4948	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 4948	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 4948	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 4948	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 4948	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 4948	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 4948	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 4948	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 4948	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 4948	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 4948	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 4948	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 4948	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 4948	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 4948	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 4948	1248	msedge.exe	msedge.exe
PID 1248 wrote to memory of 4948	1248	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fafatong\data\db_backup\index.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd248646f8,0x7ffd24864708,0x7ffd24864718
2⤵
PID:5076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,1072734358171098196,978551708685420350,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
2⤵
PID:3676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,1072734358171098196,978551708685420350,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,1072734358171098196,978551708685420350,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
2⤵
PID:4948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1072734358171098196,978551708685420350,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
2⤵
PID:3232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1072734358171098196,978551708685420350,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
2⤵
PID:4856

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,1072734358171098196,978551708685420350,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
2⤵
PID:2304

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,1072734358171098196,978551708685420350,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1072734358171098196,978551708685420350,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4432 /prefetch:1
2⤵
PID:2336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1072734358171098196,978551708685420350,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
2⤵
PID:4964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1072734358171098196,978551708685420350,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
2⤵
PID:1324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,1072734358171098196,978551708685420350,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
2⤵
PID:5084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,1072734358171098196,978551708685420350,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3048 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bafce9e4c53a0cb85310891b6b21791b

SHA1
5d70027cc137a7cbb38f5801b15fd97b05e89ee2

SHA256
71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

SHA512
c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a499254d6b5d91f97eb7a86e5f8ca573

SHA1
03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

SHA256
fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

SHA512
d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6ca3c3912344568f5dc2e77e8694fe94

SHA1
0434801e86178879cd9211b35c48ace4401bedba

SHA256
b460a79c0d043ed506f7f6882903a65f20ae0f3411c981a5d8606a64f6e0179b

SHA512
f6d4924e7955b66bdf91559ec15ee97201bfe156b00081eb38492f98e01352424ab1a771d7f8924ab011dc5e28121cfbc434e3cf376468ed279db011c745d900

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c6d8a54f3bf35f73ceeb04a874114bed

SHA1
a451defd567d29a3ea64f85e9c1d7b14f04cecbb

SHA256
d667db3b20ed4116ec15e193fb99120f9d082630b27011b07eb18bc8a05e1a52

SHA512
901532287938d08a30e5e3a40749549d32357470cd6739eebba317f2e7be4f2221e41f7e7d190ad1e384f3ee44b3deaaf4f1ff12f95f21f403f1501193a4c3f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b65606cecc35452ad6327e5c673b564e

SHA1
58068f106e0a85ad309cb82aeaf308cc30420da3

SHA256
6bbd76d1691eaca0840e8e3552aba2691a613a937c5f5e6777fd56065da07356

SHA512
babbda29d70ce4cfd44f2ac73d95435330c34d63850eacc5ee359ea2a14ea366308e6c1839d67813bc9198b06e4640f5f3c125d1580c6dcf56c438b486727947

Download Submit
\??\pipe\LOCAL\crashpad_1248_EZFRORVUQZYYBJCX

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit