48eda05ebc3353d6a9386a9796a76c42395caa2ab9894936ee59484b17369fbf

Analysis

max time kernel
146s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 05:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/Components.html
Size

1KB
MD5

dbe2a173b32bc4132c30a386c8b41237
SHA1

303bf844136af8866f3c2c0901665b1024d71d53
SHA256

02c9a76d1b012a133e4ac5e95a2a29fc1c608c4a7245b4886ce89aa07f2c1797
SHA512

3398710971eaaa44fbdfdbbcfa1fa96f60e6fb7676d6521f853013be17bdb691f1cae6e933b2aa85378b7d30c5a3a0a34e55bdde9e63ac69c6afbb948f127572

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3888	msedge.exe
3888	msedge.exe
3152	msedge.exe
3152	msedge.exe
5028	identity_helper.exe
5028	identity_helper.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 4312	3152	msedge.exe	83
PID 3152 wrote to memory of 4312	3152	msedge.exe	83
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3548	3152	msedge.exe	84
PID 3152 wrote to memory of 3888	3152	msedge.exe	85
PID 3152 wrote to memory of 3888	3152	msedge.exe	85
PID 3152 wrote to memory of 3356	3152	msedge.exe	86
PID 3152 wrote to memory of 3356	3152	msedge.exe	86
PID 3152 wrote to memory of 3356	3152	msedge.exe	86
PID 3152 wrote to memory of 3356	3152	msedge.exe	86
PID 3152 wrote to memory of 3356	3152	msedge.exe	86
PID 3152 wrote to memory of 3356	3152	msedge.exe	86
PID 3152 wrote to memory of 3356	3152	msedge.exe	86
PID 3152 wrote to memory of 3356	3152	msedge.exe	86
PID 3152 wrote to memory of 3356	3152	msedge.exe	86
PID 3152 wrote to memory of 3356	3152	msedge.exe	86
PID 3152 wrote to memory of 3356	3152	msedge.exe	86
PID 3152 wrote to memory of 3356	3152	msedge.exe	86
PID 3152 wrote to memory of 3356	3152	msedge.exe	86
PID 3152 wrote to memory of 3356	3152	msedge.exe	86
PID 3152 wrote to memory of 3356	3152	msedge.exe	86
PID 3152 wrote to memory of 3356	3152	msedge.exe	86
PID 3152 wrote to memory of 3356	3152	msedge.exe	86
PID 3152 wrote to memory of 3356	3152	msedge.exe	86
PID 3152 wrote to memory of 3356	3152	msedge.exe	86
PID 3152 wrote to memory of 3356	3152	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Components.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff977db46f8,0x7ff977db4708,0x7ff977db4718
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,8843719353851429302,5043682029661262248,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,8843719353851429302,5043682029661262248,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,8843719353851429302,5043682029661262248,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8843719353851429302,5043682029661262248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8843719353851429302,5043682029661262248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8843719353851429302,5043682029661262248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2220 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8843719353851429302,5043682029661262248,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,8843719353851429302,5043682029661262248,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3980 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,8843719353851429302,5043682029661262248,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8843719353851429302,5043682029661262248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,8843719353851429302,5043682029661262248,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,8843719353851429302,5043682029661262248,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4760 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
75c9f57baeefeecd6c184627de951c1e

SHA1
52e0468e13cbfc9f15fc62cc27ce14367a996cff

SHA256
648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f

SHA512
c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
10fa19df148444a77ceec60cabd2ce21

SHA1
685b599c497668166ede4945d8885d204fd8d70f

SHA256
c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b

SHA512
3518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8ff7c100e6da1e7f87ea7c877a2a7946

SHA1
42ae112e032dec96fe0ef773a011443ff4a0e4f3

SHA256
227c50cd3da2268f3dc04ec4efcab8e37042f83ff89b4aa1a97082073da34d95

SHA512
fb73661744ed14ea1267def26b003556e6c9cd88f260389c00c1ef6dce7f40b46f302920f8fa51aec7496a66f55ee7602a6ade3cd940521919619b31375cb951

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f828d7c11227e48ef11c13252647c652

SHA1
53922288300505fde31d9e6cde94aa81ba31d417

SHA256
d0082fc3df50431ad4f295566fec8f1ce7e9e20192efc061fd68cfc6b2f5b858

SHA512
452dfeee5b224f3165794cc5486eaeb524071c2e9bd2555f00877cea5fbcc137e7ffbe9eacd5117ac44e1616a68ae2c802ae6a7ae3487890f75cb18009c690b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b4d1deeaac397cee6a0ca71535dc9d58

SHA1
a7698f0a84f24c71d4a0435daf6a7663c5e30c99

SHA256
e4a5665db13911de6195e550a800e4de6035a448d0e6735fc3ecfc92619920e6

SHA512
f7c76c73de1d277f80e0a2980cdc4638456072ecb00f09823a35394fd6eba204f0fe109d76f52d6870fd0d36a2548fad880c9b27971dca3bf637341ba6b5b241

Download Submit