8ef8fa960a49baa47cf1a375107484dcab379a4f60e50a2be18a215d29a1b0a4

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 00:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

js/kindeditor/plugins/about.html
Size

1KB
MD5

47cc4c2d2408a77307a2da6f1477cec3
SHA1

72b3cdc2e6fe2483b6003846e2f99e7227d9cf89
SHA256

8b89855bbd6763b4e78099ba2dc8b6f1fed1ef882d0902c6e6e6fff4e7178cee
SHA512

36219178af1f5460c1518077e2cc9655af1d0d3d3445c904e7e1649f1f9eaebd1ec0d747f232a173683206537ab54e16743f9419907fc8576ebeb48db5653b53

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2112	msedge.exe
2112	msedge.exe
3500	msedge.exe
3500	msedge.exe
640	identity_helper.exe
640	identity_helper.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

3500 msedge.exe
3500 msedge.exe
3500 msedge.exe
3500 msedge.exe
3500 msedge.exe
3500 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3500 wrote to memory of 4592	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 4592	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 932	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 2112	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 2112	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 3256	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 3256	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 3256	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 3256	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 3256	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 3256	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 3256	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 3256	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 3256	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 3256	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 3256	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 3256	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 3256	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 3256	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 3256	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 3256	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 3256	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 3256	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 3256	3500	msedge.exe	msedge.exe
PID 3500 wrote to memory of 3256	3500	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\js\kindeditor\plugins\about.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff977db46f8,0x7ff977db4708,0x7ff977db4718
2⤵
PID:4592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,7742026169403086667,6913650556342648456,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
2⤵
PID:932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,7742026169403086667,6913650556342648456,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,7742026169403086667,6913650556342648456,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2504 /prefetch:8
2⤵
PID:3256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7742026169403086667,6913650556342648456,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
2⤵
PID:4648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7742026169403086667,6913650556342648456,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
2⤵
PID:3208

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,7742026169403086667,6913650556342648456,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
2⤵
PID:1068

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,7742026169403086667,6913650556342648456,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7742026169403086667,6913650556342648456,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
2⤵
PID:1072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7742026169403086667,6913650556342648456,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
2⤵
PID:4660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7742026169403086667,6913650556342648456,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
2⤵
PID:2560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7742026169403086667,6913650556342648456,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
2⤵
PID:3180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,7742026169403086667,6913650556342648456,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4036 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1804

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
75c9f57baeefeecd6c184627de951c1e

SHA1
52e0468e13cbfc9f15fc62cc27ce14367a996cff

SHA256
648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f

SHA512
c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
10fa19df148444a77ceec60cabd2ce21

SHA1
685b599c497668166ede4945d8885d204fd8d70f

SHA256
c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b

SHA512
3518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
9dc0220f582339e01444bae947372562

SHA1
8517ef327ffae13d355600c3ec26f0718ee6981e

SHA256
f1875c32ded6ab6c3d08cbc1b892202d0de41cc1d5a2675418a96bec39aca3bf

SHA512
8a59f8f477f6fa80d8fab65a4386619bf4c0835c4242dcc967d4a0bd8e90e0e10cb7c3779135db071ca2c1c826f884e06c1ac8c2c6584d4d78d1c8f4619c72f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
038174d08af8caaa8dfb6c0c63ae2516

SHA1
053d8bd74b4cfefc30dd97669b465261587c1880

SHA256
f66f47f1edd9e7f63b2ac1c0b2c0d4659a0ed04a43304490e6a7f8b7e35f815f

SHA512
ad5000d303a504124e4dcafb815eeb56074c3c087d67c8d994e2291f8463f66f72ce1e8bf61f977d17fe00b90fe6fb2c7e61b37e492ee9796a2e72f0599e9a54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
7a657f391b4eb25b0d85c3cac13576ac

SHA1
56b0094e803357171437aaf10c6e8d49bef0bb3a

SHA256
1c232f01f6792001a98b4980e148e73a0ae7caa60507de4af37722f18f8237a9

SHA512
20e4d1a9f59b9ad026a7448202674fff4095ccf361c2f882f1a16ef1b481fbaea1fe9417b286c241975d80f52868aaa9239e8a59dfb33fda0b07382ef29d0fa1

Download Submit
\??\pipe\LOCAL\crashpad_3500_FHDMRCMEWSCKEDPI
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit