536515ca1e57321c5de664441d3394c4cd63c603183e257275188b3a9e168477

Analysis

max time kernel
146s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
10/07/2024, 20:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1cacert.html
Size

299B
MD5

692cff94e65bda3b28cc904b22fc56f0
SHA1

adf4f7e4f83dd3cf2c3f70cc255ac63f6dfa47a0
SHA256

1d0832d4dfbd52bf038740ee8c62afe0bb948f9e8b6db0a3b98cb620413eff85
SHA512

8aae09c0461f2fc9dadb509603dadc8de93db6cc676fbb81a8b991b25c1bc942706ab202bc38ba81406c500eadfbde2f700334d995e9da54447e8d4beeafe1ea

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1552	msedge.exe
1552	msedge.exe
5848	msedge.exe
5848	msedge.exe
5628	identity_helper.exe
5628	identity_helper.exe
3840	msedge.exe
3840	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe
5848	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5848 wrote to memory of 5016	5848	msedge.exe	78
PID 5848 wrote to memory of 5016	5848	msedge.exe	78
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 2272	5848	msedge.exe	79
PID 5848 wrote to memory of 1552	5848	msedge.exe	80
PID 5848 wrote to memory of 1552	5848	msedge.exe	80
PID 5848 wrote to memory of 3732	5848	msedge.exe	81
PID 5848 wrote to memory of 3732	5848	msedge.exe	81
PID 5848 wrote to memory of 3732	5848	msedge.exe	81
PID 5848 wrote to memory of 3732	5848	msedge.exe	81
PID 5848 wrote to memory of 3732	5848	msedge.exe	81
PID 5848 wrote to memory of 3732	5848	msedge.exe	81
PID 5848 wrote to memory of 3732	5848	msedge.exe	81
PID 5848 wrote to memory of 3732	5848	msedge.exe	81
PID 5848 wrote to memory of 3732	5848	msedge.exe	81
PID 5848 wrote to memory of 3732	5848	msedge.exe	81
PID 5848 wrote to memory of 3732	5848	msedge.exe	81
PID 5848 wrote to memory of 3732	5848	msedge.exe	81
PID 5848 wrote to memory of 3732	5848	msedge.exe	81
PID 5848 wrote to memory of 3732	5848	msedge.exe	81
PID 5848 wrote to memory of 3732	5848	msedge.exe	81
PID 5848 wrote to memory of 3732	5848	msedge.exe	81
PID 5848 wrote to memory of 3732	5848	msedge.exe	81
PID 5848 wrote to memory of 3732	5848	msedge.exe	81
PID 5848 wrote to memory of 3732	5848	msedge.exe	81
PID 5848 wrote to memory of 3732	5848	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1cacert.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd200c3cb8,0x7ffd200c3cc8,0x7ffd200c3cd8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,7186961587885240689,9329926543246854683,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,7186961587885240689,9329926543246854683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,7186961587885240689,9329926543246854683,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7186961587885240689,9329926543246854683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7186961587885240689,9329926543246854683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,7186961587885240689,9329926543246854683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,7186961587885240689,9329926543246854683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7186961587885240689,9329926543246854683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7186961587885240689,9329926543246854683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7186961587885240689,9329926543246854683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,7186961587885240689,9329926543246854683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,7186961587885240689,9329926543246854683,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4848 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c0f062e1807aca2379b4e5a1e7ffbda8

SHA1
076c2f58dfb70eefb6800df6398b7bf34771c82d

SHA256
f80debea5c7924a92b923901cd2f2355086fe0ce4be21e575d3d130cd05957ca

SHA512
24ae4ec0c734ef1e1227a25b8d8c4262b583de1101f2c9b336ac67d0ce9b3de08f2b5d44b0b2da5396860034ff02d401ad739261200ae032daa4f5085c6d669e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6f3725d32588dca62fb31e116345b5eb

SHA1
0229732ae5923f45de70e234bae88023521a9611

SHA256
b81d7e414b2b2d039d3901709a7b8d2f2f27133833ecf80488ba16991ce81140

SHA512
31bacf4f376c5bad364889a16f8ac61e5881c8e45b610cc0c21aa88453644524525fd4ccf85a87f73c0565c072af857e33acffbbca952df92fedddd21f169325

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
724f09a5032d2a05c4f37e07979ac757

SHA1
06248530d31fc95cd7fe82cdbb22a3b351dd2888

SHA256
b9bd313bb39eb995f4732bb686067ef33bf3fd15863c84efb610da11ee7d3fa5

SHA512
678842b480f9deef9e023dad12d05f12c65ec04a20f9e21103b47ed12eb10bd3c51d6379e8899f3a2fa2eb16af5068f15a2374ce55e350582e5e362fbbd99d1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6b6c653935f286d3e553a8e3eeb20e79

SHA1
86e002e7cbff255ba6729f9da86a385fec3bfc54

SHA256
9d8b60e9f6f2efc2812c982b32df81f308af936e8bd7803f0e222d17987a78af

SHA512
99ecb237369283dba820c672b3dd5fafbd608cbb9e0d169439f29138dcf0ebf6d6ee86a1aee394bc31ba7424aae7cb7140b2b03cc6453476a08f54a30a18a2a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
20ffccc3f4640368e56118aa7a1c6dd1

SHA1
2f5abdc844ff3acb96552855436a55e1494eac3e

SHA256
5682a83683314ec39f24e944c9d1af20ff3d5fd8ba64285b0e76440e1573411b

SHA512
2089005682efd78b44ecf03b876b9fc2007f09aba187acafb9650ebc3b77694c6a1689a83035b40d05ce8e0ea7a411ab2fafe0e617f4f295ad933831959c988b

Download Submit