f3613f5434d874490f600424a5c226cb36de3d8ce41a319f9321f4f845501ae0

Analysis

max time kernel
145s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10-07-2024 13:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$APPDATA/seemao/config/map/www.amazon.cn.html
Size

3B
MD5

9e73f8411a70e1bceefc15ac312a362b
SHA1

21c4340e3a66a7bc00e5805bc1ebe30d3f2e218e
SHA256

c69684c471706da34b39b2994be39294926dc543e51aea5f4ce0f06091a00ebd
SHA512

59bb8b649fad3c2c990881eeb177ca0a751eb64b57b111da5300e5025753c9f642297d8c71b0b9ac0712f33af31a853d6174c1648f56ccadc66cf23e4130f538

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
816	msedge.exe
816	msedge.exe
3356	msedge.exe
3356	msedge.exe
3848	identity_helper.exe
3848	identity_helper.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe
3356	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 3164	3356	msedge.exe	84
PID 3356 wrote to memory of 3164	3356	msedge.exe	84
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 1432	3356	msedge.exe	85
PID 3356 wrote to memory of 816	3356	msedge.exe	86
PID 3356 wrote to memory of 816	3356	msedge.exe	86
PID 3356 wrote to memory of 452	3356	msedge.exe	87
PID 3356 wrote to memory of 452	3356	msedge.exe	87
PID 3356 wrote to memory of 452	3356	msedge.exe	87
PID 3356 wrote to memory of 452	3356	msedge.exe	87
PID 3356 wrote to memory of 452	3356	msedge.exe	87
PID 3356 wrote to memory of 452	3356	msedge.exe	87
PID 3356 wrote to memory of 452	3356	msedge.exe	87
PID 3356 wrote to memory of 452	3356	msedge.exe	87
PID 3356 wrote to memory of 452	3356	msedge.exe	87
PID 3356 wrote to memory of 452	3356	msedge.exe	87
PID 3356 wrote to memory of 452	3356	msedge.exe	87
PID 3356 wrote to memory of 452	3356	msedge.exe	87
PID 3356 wrote to memory of 452	3356	msedge.exe	87
PID 3356 wrote to memory of 452	3356	msedge.exe	87
PID 3356 wrote to memory of 452	3356	msedge.exe	87
PID 3356 wrote to memory of 452	3356	msedge.exe	87
PID 3356 wrote to memory of 452	3356	msedge.exe	87
PID 3356 wrote to memory of 452	3356	msedge.exe	87
PID 3356 wrote to memory of 452	3356	msedge.exe	87
PID 3356 wrote to memory of 452	3356	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\$APPDATA\seemao\config\map\www.amazon.cn.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9531446f8,0x7ff953144708,0x7ff953144718
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,17110297898544722538,8158532945214046679,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,17110297898544722538,8158532945214046679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,17110297898544722538,8158532945214046679,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17110297898544722538,8158532945214046679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17110297898544722538,8158532945214046679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,17110297898544722538,8158532945214046679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,17110297898544722538,8158532945214046679,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17110297898544722538,8158532945214046679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17110297898544722538,8158532945214046679,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17110297898544722538,8158532945214046679,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3792 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17110297898544722538,8158532945214046679,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,17110297898544722538,8158532945214046679,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
584971c8ba88c824fd51a05dddb45a98

SHA1
b7c9489b4427652a9cdd754d1c1b6ac4034be421

SHA256
e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307

SHA512
5dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b28ef7d9f6d74f055cc49876767c886c

SHA1
d6b3267f36c340979f8fc3e012fdd02c468740bf

SHA256
fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37

SHA512
491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2a30b70d30554910f8af2c90ce7368c3

SHA1
7b587897def59f3af8762dc3863ff4aaae114ec4

SHA256
e074aefa515278aa345b647f340604feacc91e53b4d385f5eb90454a1d3b08bd

SHA512
8724a93d9b3708025df06c387023272e2d4ffaec83867f2ed9f2b12f22768ed8fade320d4d02b9aa5fb9a7bcd46b841fcfc8ed20d85a1532482725146f5bd38a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
93457ca2e48ac474c366c6b9e0a01baf

SHA1
eeaed0f593467c2e52ab7d7dd0afeb30a3f49009

SHA256
826ba3cd40032c5a69cce155f4767effe18e30720ff79f2a53f276e799c85522

SHA512
f25500a1616052a7cca6800f6aa287cfef12bbec0d9a71c705943df4c2a0dcf3f586651f9fadfab537eb633494b32a6b5e17114f93773613157ff1eeec221546

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c841df70608a2d361851a1051930511f

SHA1
73ae3d56d65664a36696e5079d5f81e17fe0c95f

SHA256
cb9472703d3c40506327a6af45980a6cbac08542cda4ca709bb781002cd2d792

SHA512
89221cd93332e837ec40c014ad943abd2d3ade70e41660ec85c80cc0bebdbe06e0fc3abc9a86ef4d5a85c625cd684f423292f30eb216cf69f4398651d9877c8c

Download Submit