30091faafd62ea7ba9868db2ee575dab98fd126a78d39590f57ea7b38b20d966

Analysis

max time kernel
146s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 20:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

8.7MB
MD5

bd0ced1bc275f592b03bafac4b301a93
SHA1

68776b7d9139588c71fbc51fe15243c9835acb67
SHA256

ad35e72893910d6f6ed20f4916457417af05b94ab5204c435c35f66a058d156b
SHA512

5052ae32dae0705cc29ea170bcc5210b48e4af91d4ecec380cb4a57ce1c56bc1d834fc2d96e2a0f5f640fcac8cafe4a4fdd0542f26ca430d76aa8b9212ba77aa
SSDEEP

24576:KPQQ/6MP6P5d1n+wRcXe1Lmfpm6k626D6b6+eGnkywBIpv:Cy8OeG8k

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
4668	msedge.exe
4668	msedge.exe
3700	identity_helper.exe
3700	identity_helper.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 2704	4668	msedge.exe	84
PID 4668 wrote to memory of 2704	4668	msedge.exe	84
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4128	4668	msedge.exe	85
PID 4668 wrote to memory of 4220	4668	msedge.exe	86
PID 4668 wrote to memory of 4220	4668	msedge.exe	86
PID 4668 wrote to memory of 1056	4668	msedge.exe	87
PID 4668 wrote to memory of 1056	4668	msedge.exe	87
PID 4668 wrote to memory of 1056	4668	msedge.exe	87
PID 4668 wrote to memory of 1056	4668	msedge.exe	87
PID 4668 wrote to memory of 1056	4668	msedge.exe	87
PID 4668 wrote to memory of 1056	4668	msedge.exe	87
PID 4668 wrote to memory of 1056	4668	msedge.exe	87
PID 4668 wrote to memory of 1056	4668	msedge.exe	87
PID 4668 wrote to memory of 1056	4668	msedge.exe	87
PID 4668 wrote to memory of 1056	4668	msedge.exe	87
PID 4668 wrote to memory of 1056	4668	msedge.exe	87
PID 4668 wrote to memory of 1056	4668	msedge.exe	87
PID 4668 wrote to memory of 1056	4668	msedge.exe	87
PID 4668 wrote to memory of 1056	4668	msedge.exe	87
PID 4668 wrote to memory of 1056	4668	msedge.exe	87
PID 4668 wrote to memory of 1056	4668	msedge.exe	87
PID 4668 wrote to memory of 1056	4668	msedge.exe	87
PID 4668 wrote to memory of 1056	4668	msedge.exe	87
PID 4668 wrote to memory of 1056	4668	msedge.exe	87
PID 4668 wrote to memory of 1056	4668	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff94c5146f8,0x7ff94c514708,0x7ff94c514718
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,3984795951052935895,2770800169924944513,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,3984795951052935895,2770800169924944513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,3984795951052935895,2770800169924944513,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3984795951052935895,2770800169924944513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3984795951052935895,2770800169924944513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,3984795951052935895,2770800169924944513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,3984795951052935895,2770800169924944513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3984795951052935895,2770800169924944513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3984795951052935895,2770800169924944513,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3984795951052935895,2770800169924944513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2732 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3984795951052935895,2770800169924944513,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,3984795951052935895,2770800169924944513,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\93625380-3c8a-4e1e-8742-659cf5616966.tmp

Filesize
11KB

MD5
f63d895bb5a43f17e09e21962ff8e852

SHA1
8e876ee06e5b492ca3d8895989b1e4f6e8d3513d

SHA256
4c8efbc40fbe17b4040322f490f00ac7c31eb40b1cff73f79c6cca2289fe14d9

SHA512
b70e6677295f9080c6d3cfd514c928cbadc0927e123a18c38357b95087e139aac8feacee2adf6c7b106362ff4c15b582bcff1f7a915387d0e0b0ea6aa610388f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d406f3135e11b0a0829109c1090a41dc

SHA1
810f00e803c17274f9af074fc6c47849ad6e873e

SHA256
91f57909a10174b06c862089a9c1f3b3aeafea74a70ee1942ce11bb80d9eace4

SHA512
2b9f0f94b1e8a1b62ab38af8df2add0ec9e4c6dfa94d9c84cc24fe86d2d57d4fc0d9ec8a9775cf42a859ddfd130260128185a0e2588992bca8fd4ebf5ee6d409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7f37f119665df6beaa925337bbff0e84

SHA1
c2601d11f8aa77e12ab3508479cbf20c27cbd865

SHA256
1073dbff3ec315ac85361c35c8ba791cc4198149b097c7b287dda1d791925027

SHA512
8e180e41dd27c51e81788564b19b8ff411028890da506fbf767d394b1e73ec53e046c8d07235b2ec7c1c593c976bbf74ed9b7d442d68b526a0a77a9b5b0ab817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
999af95ff336f5c0a17cd75a8b719a18

SHA1
fdece27f8a963f09ea33539bc2a287160b219a80

SHA256
f85e31c32e73b8455f469b9b6f29e0b149b0baff35b224caaef20244ebb62aef

SHA512
6e26b8d7be711e3621a198cf7ae93e7ab75f72f51c9bc57f57551e47651954748362a4a363990673fdb9666d01fcb592eeea2f3af518ba04be13462e7185667e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
711c15223d818b232746341ee00eff13

SHA1
b52d37330ec2f6b6660b3e5a69288b2b34e23f70

SHA256
0b146b8695b6e45f21a850ff318cec700f1f3ba879d4f63985b0ab3cef4b95ac

SHA512
7936c553ffd7d9171aa683e3230e3b21b8571076022cd9c4b673566f21249515c710ae3f98877cc052afc7f4229c7244fc4db2a2a646fa02362f2de3c4d7e5f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit