a1f2e5d2bb3d97e7ab6893d46c72c5e5545f224f55c997878f232be89f6edd38

Analysis

max time kernel
145s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2024 05:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

images/seccode/font/en/index.htm
Size

1B
MD5

7215ee9c7d9dc229d2921a40e899ec5f
SHA1

b858cb282617fb0956d960215c8e84d1ccf909c6
SHA256

36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
SHA512

f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1508	msedge.exe
1508	msedge.exe
5016	msedge.exe
5016	msedge.exe
4364	identity_helper.exe
4364	identity_helper.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

5016 msedge.exe
5016 msedge.exe
5016 msedge.exe
5016 msedge.exe
5016 msedge.exe
5016 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 5016 wrote to memory of 1924	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 1924	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 872	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 1508	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 1508	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 852	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 852	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 852	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 852	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 852	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 852	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 852	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 852	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 852	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 852	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 852	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 852	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 852	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 852	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 852	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 852	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 852	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 852	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 852	5016	msedge.exe	msedge.exe
PID 5016 wrote to memory of 852	5016	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\images\seccode\font\en\index.htm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdeeba46f8,0x7ffdeeba4708,0x7ffdeeba4718
2⤵
PID:1924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,15463093693739404914,12440509200600191868,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
2⤵
PID:872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,15463093693739404914,12440509200600191868,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,15463093693739404914,12440509200600191868,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
2⤵
PID:852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15463093693739404914,12440509200600191868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
2⤵
PID:4872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15463093693739404914,12440509200600191868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
2⤵
PID:3944

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,15463093693739404914,12440509200600191868,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
2⤵
PID:4172

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,15463093693739404914,12440509200600191868,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15463093693739404914,12440509200600191868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
2⤵
PID:5092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15463093693739404914,12440509200600191868,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
2⤵
PID:4320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15463093693739404914,12440509200600191868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
2⤵
PID:2260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,15463093693739404914,12440509200600191868,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
2⤵
PID:4892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,15463093693739404914,12440509200600191868,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1728

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
584971c8ba88c824fd51a05dddb45a98

SHA1
b7c9489b4427652a9cdd754d1c1b6ac4034be421

SHA256
e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307

SHA512
5dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b28ef7d9f6d74f055cc49876767c886c

SHA1
d6b3267f36c340979f8fc3e012fdd02c468740bf

SHA256
fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37

SHA512
491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
2f6ba89ad1f29b23c41cfd2de9494176

SHA1
ba9eed33d03f35d7f784512bd1df10b813c81d47

SHA256
f02c0bb976f78703a338c061331bb320b3b71116c7a356c6aafa3154c9d4f434

SHA512
769a08709570e7654786dc1a5252089179f750c2f112036348874ab7fc9744ff3a294cef5ee8613566cbe641add517b7cb9a618693aaed1ef8c88617f35b700f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
c2848d7003bc3bbf0701686f1bee854d

SHA1
b11a55d9d0aab798488c24ca36d65f831fa3a8d6

SHA256
ff88d31cfb38f1be9be79cc999ec1164c7e45824ec788501c128ba52dac3f6f8

SHA512
a724b1f12e683087269adf6945af966009986cc91e6384a3cf419daf14bd3dc78d8c1546fc10df31571ca1517dfef5451ab50939f632986f32cc8ade6679573b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
7903ea0ad7e5bd4d63740323c1fdfcf5

SHA1
a5d8498f2b108e30c6d57069351d6809d1ad59bb

SHA256
f68767ab04ba8d31c677077e4df6c46174d9c330ccae1d491a474087bf9c7ce7

SHA512
dc377e3a21fc3f892c339003bf67eb79a16804d00fe7ea9f53e382eeaac3ca213dfff75ac875b1170bda4775b66f6893074164e1afffeb6a084b8cf1e1142632

Download Submit
\??\pipe\LOCAL\crashpad_5016_JREZYVVFLISPIWQM
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit