a4f7496d8fd21533829214390b580acbd74031cd33136c40df9a64cc8714c6ad

Analysis

max time kernel
100s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 20:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

安装与配置说明.htm
Size

7KB
MD5

d6bd1ac97ed7a264ee2f3e280925c85d
SHA1

bb2c217de3e132e66643cfb03517522fdd8c04d7
SHA256

463d264595cb88fbf4c79b2a29f47803464fd74ac4db8812b62cd7c93215ce6e
SHA512

551c01603b8f58687a1f3e6625799750e8633590fbe95357433c26bee82fd3f4c51c5b3492646e229190f07f3a9ed37804d6696368dd895a6a2fe40434f82ae8
SSDEEP

96:c2F18SWQEVfTvIiHm7sMR0MoeIiHm7s8a5nPxJoXj3LyWTU1QJIS8yrvmgltMJWa:LFS+IsboX7mgPMJ4Id8Z8CxId8Z8Ub2

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2464	msedge.exe
2464	msedge.exe
1184	msedge.exe
1184	msedge.exe
4804	identity_helper.exe
4804	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 2356	1184	msedge.exe	85
PID 1184 wrote to memory of 2356	1184	msedge.exe	85
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2648	1184	msedge.exe	87
PID 1184 wrote to memory of 2464	1184	msedge.exe	88
PID 1184 wrote to memory of 2464	1184	msedge.exe	88
PID 1184 wrote to memory of 4740	1184	msedge.exe	89
PID 1184 wrote to memory of 4740	1184	msedge.exe	89
PID 1184 wrote to memory of 4740	1184	msedge.exe	89
PID 1184 wrote to memory of 4740	1184	msedge.exe	89
PID 1184 wrote to memory of 4740	1184	msedge.exe	89
PID 1184 wrote to memory of 4740	1184	msedge.exe	89
PID 1184 wrote to memory of 4740	1184	msedge.exe	89
PID 1184 wrote to memory of 4740	1184	msedge.exe	89
PID 1184 wrote to memory of 4740	1184	msedge.exe	89
PID 1184 wrote to memory of 4740	1184	msedge.exe	89
PID 1184 wrote to memory of 4740	1184	msedge.exe	89
PID 1184 wrote to memory of 4740	1184	msedge.exe	89
PID 1184 wrote to memory of 4740	1184	msedge.exe	89
PID 1184 wrote to memory of 4740	1184	msedge.exe	89
PID 1184 wrote to memory of 4740	1184	msedge.exe	89
PID 1184 wrote to memory of 4740	1184	msedge.exe	89
PID 1184 wrote to memory of 4740	1184	msedge.exe	89
PID 1184 wrote to memory of 4740	1184	msedge.exe	89
PID 1184 wrote to memory of 4740	1184	msedge.exe	89
PID 1184 wrote to memory of 4740	1184	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\安装与配置说明.htm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaac3346f8,0x7ffaac334708,0x7ffaac334718
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,14147621817214230890,2625604015336209828,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,14147621817214230890,2625604015336209828,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,14147621817214230890,2625604015336209828,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14147621817214230890,2625604015336209828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14147621817214230890,2625604015336209828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,14147621817214230890,2625604015336209828,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,14147621817214230890,2625604015336209828,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14147621817214230890,2625604015336209828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14147621817214230890,2625604015336209828,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14147621817214230890,2625604015336209828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14147621817214230890,2625604015336209828,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14147621817214230890,2625604015336209828,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,14147621817214230890,2625604015336209828,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:5084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
584971c8ba88c824fd51a05dddb45a98

SHA1
b7c9489b4427652a9cdd754d1c1b6ac4034be421

SHA256
e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307

SHA512
5dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b28ef7d9f6d74f055cc49876767c886c

SHA1
d6b3267f36c340979f8fc3e012fdd02c468740bf

SHA256
fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37

SHA512
491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
851fa8676024a4c6cb2c2f3f97111f48

SHA1
c16da1e4ee59fdb60fff420041b3571e5473b872

SHA256
49c396553c3791c6c01caa532fdae28a091b537faf594c8d2bc15f027b4c3037

SHA512
ddf1bf3ec8f9fe4fc9cf72b1ac0d2f178f7f93677e8f87f24d7700fe42a95f96ffb49441a44d47df80b9640f590bb165ddbd6ce8dbcb89ac627fcea6cdfe3f50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e4bf77cf23077637e6847a0772f26625

SHA1
46304cc07fad3cd5803bac19bddbb7b63e3f963b

SHA256
44b18046e8e99c806b6272aa01f1ad9f1732716c3dcb30d63355bf94c220eda7

SHA512
e82d59e0d4e9f44b1b09e070c5edac8661a3d611a7b4b5546e660ed9640da6e6b8be03723473cd39dd07014e0ea170aa2e88464cb8e7a14afa80d1c77976a3fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
838aec8a6f2a1563392faac5457d222f

SHA1
9c3423a6d8932e1636251608adeed8930e6c0e5d

SHA256
f7acfbf36a46ef1f795678d3574273c5d05323dabbcbff285fa117d65d694cae

SHA512
2d1bbac2e1cbbae4a83bd8d99fb4601320371d2ae06084bb6a5c4eacef4d3d243a04fa08bb5c680b7b845b613bc9ec5173586a029dfe20cfd9a45eecbd299fb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
94a434c3ce7d42c6b31737ee6fb378c8

SHA1
6d9d889a44361bb86caaf69fe4d897eae3ece9ae

SHA256
fa2029c94251eea783636912e60381d244042cebd04eef6f01729b58bd73d932

SHA512
2f4067d5a844fd9245431ad4ba646313f8d65cda2f45bde44bd3c4165e07d069fab273a4b56f4edb2bfeab2a8b8197d0da0df263d57049ea52ca9d51cc02b26e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3df62132c44c256e379cf338589890df

SHA1
2ca2b3e74c146a0072c04bc73d66e296e6467f38

SHA256
e67248a4d4ef52c6c8c3ac8aec31f7a6d6ef13fec9e345e9e191954a9ece9009

SHA512
8d756a5011bc8daf41768780b003e771a66782f9751d6d49fe8f2e3b230d53066995f6ba820bf04e1e369fb7cf1a6add78201d673412294da252e81c54f28b28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
8a2d5aa6ff480b8ed88a5ebe3e195fe0

SHA1
51532f8cbd82f22b3bac47b9fbad1f342108b009

SHA256
389cd33a2b295bc734579b293a0fcc971f0c34049d56b4eafc06cc26facc4c6f

SHA512
933c3a4fcbfbe9e1260a2d623f77accb2858fa0b700040cd9ff0288d61bbd30b07b30cd67a9a9452559e794ed6105bb3027ca4d1b085b5e4822bf716637aebbf

Download Submit