5b1673bd41871a3b1d7ddc80f84db0c6be359a068e8b93ec0d03b240bb6dd2bf

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 00:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Softbiz Jokes and Funny Pictures v1.0/admin/fileupload.html
Size

2KB
MD5

f40f5b1330f99c2544609eadcebd91f7
SHA1

7b7c6581b34b86eed94f178d5dd6e099e12853a2
SHA256

772d8fecdbb858244e0629935703d95633c8eeb19ae26b5a6704a08484ef7aae
SHA512

668564da469d5c04560e8b55211f0e9a171e35397feed0d6e3b0c931f48e78aa33d64fdc59a6090e67eb2fb26a13c04aae094bfc4fe995ae42bdb2f67862cee7

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3920	msedge.exe
3920	msedge.exe
620	msedge.exe
620	msedge.exe
3008	identity_helper.exe
3008	identity_helper.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 1344	620	msedge.exe	84
PID 620 wrote to memory of 1344	620	msedge.exe	84
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 2864	620	msedge.exe	86
PID 620 wrote to memory of 3920	620	msedge.exe	87
PID 620 wrote to memory of 3920	620	msedge.exe	87
PID 620 wrote to memory of 3204	620	msedge.exe	88
PID 620 wrote to memory of 3204	620	msedge.exe	88
PID 620 wrote to memory of 3204	620	msedge.exe	88
PID 620 wrote to memory of 3204	620	msedge.exe	88
PID 620 wrote to memory of 3204	620	msedge.exe	88
PID 620 wrote to memory of 3204	620	msedge.exe	88
PID 620 wrote to memory of 3204	620	msedge.exe	88
PID 620 wrote to memory of 3204	620	msedge.exe	88
PID 620 wrote to memory of 3204	620	msedge.exe	88
PID 620 wrote to memory of 3204	620	msedge.exe	88
PID 620 wrote to memory of 3204	620	msedge.exe	88
PID 620 wrote to memory of 3204	620	msedge.exe	88
PID 620 wrote to memory of 3204	620	msedge.exe	88
PID 620 wrote to memory of 3204	620	msedge.exe	88
PID 620 wrote to memory of 3204	620	msedge.exe	88
PID 620 wrote to memory of 3204	620	msedge.exe	88
PID 620 wrote to memory of 3204	620	msedge.exe	88
PID 620 wrote to memory of 3204	620	msedge.exe	88
PID 620 wrote to memory of 3204	620	msedge.exe	88
PID 620 wrote to memory of 3204	620	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Softbiz Jokes and Funny Pictures v1.0\admin\fileupload.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8b47846f8,0x7ff8b4784708,0x7ff8b4784718
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,10494088705727166885,18238743715298953729,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,10494088705727166885,18238743715298953729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,10494088705727166885,18238743715298953729,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494088705727166885,18238743715298953729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494088705727166885,18238743715298953729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,10494088705727166885,18238743715298953729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,10494088705727166885,18238743715298953729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494088705727166885,18238743715298953729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494088705727166885,18238743715298953729,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494088705727166885,18238743715298953729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10494088705727166885,18238743715298953729,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,10494088705727166885,18238743715298953729,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3956 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
584971c8ba88c824fd51a05dddb45a98

SHA1
b7c9489b4427652a9cdd754d1c1b6ac4034be421

SHA256
e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307

SHA512
5dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b28ef7d9f6d74f055cc49876767c886c

SHA1
d6b3267f36c340979f8fc3e012fdd02c468740bf

SHA256
fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37

SHA512
491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
777757e9f650b6453d218c7a4daa2f41

SHA1
4c4a2f0a20014cee9b607506c3f901271d3b5b18

SHA256
182bb84d8baefc6ee4f446795c2d63a9e0660575be35aae74fcd36b40b5a5919

SHA512
762876cbe06f9eecdfffb00359872067521e4c5bc3d0afd4a7554c9f08c5e43e0ef29b5294e093eb00c070437556779a5555143698f6da3ab7be41f66d5beece

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5694b59a9efc51a2a0e1e77d84dc2a68

SHA1
48f1146f316c74e5b870e52a959fb28b69866641

SHA256
3ca1f7a7c163bb0a6a230202f406d9fe6977949b9ff8a20a9d7d2ad3fc286c88

SHA512
15535f5a5404b4c57d825eccbcb26313266b6717def2292d4ad6f6b91448c96385cbe5bb4e0229b5f851e1e77dcf39826b39b55769ff27cf7af0975acf0089da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
070bdba3fe154709fcec8f3c24bd0813

SHA1
8c9190196933698f8d48931d2821c0fbb19e39df

SHA256
9bcf58a621fb9468c0e755ee3f50ef89a24e542e5fe4e0381bb62d10c626c4b2

SHA512
9c0a26326f3bed45f9975a36589697e23f4901fb23c4d362e017116d849559b01673d72256764e9965660b74a24380dd9ddf2d747092bb9e38afa233d2631394

Download Submit