08b11c3897eb38d1e6566a17cec5cdf2b3c620444e160e3db200a7e223aabbd8

Analysis

max time kernel
146s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 04:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DISCOVER/COMPATBL/MULTSUPP/IMAGEMAN.htm
Size

1KB
MD5

b523666b0faecab7e38d21e346f3c846
SHA1

d6d0d654649a3b68f2f3b8953addc40993f4ffbd
SHA256

b88f7a3d5b7530511933547fe449db2ac6a561ba16cd99759672a34f3a92545d
SHA512

ebc9801181d995b09154cdb6dae865570c39214503bec77290512854bbc50a98a6bd3b0ed87f5c1592237d75f00e22328c9df169dd28a16073b5d79f9122be65

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
1784	msedge.exe
1784	msedge.exe
1828	identity_helper.exe
1828	identity_helper.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 3752	1784	msedge.exe	88
PID 1784 wrote to memory of 3752	1784	msedge.exe	88
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 1416	1784	msedge.exe	90
PID 1784 wrote to memory of 4792	1784	msedge.exe	91
PID 1784 wrote to memory of 4792	1784	msedge.exe	91
PID 1784 wrote to memory of 4244	1784	msedge.exe	92
PID 1784 wrote to memory of 4244	1784	msedge.exe	92
PID 1784 wrote to memory of 4244	1784	msedge.exe	92
PID 1784 wrote to memory of 4244	1784	msedge.exe	92
PID 1784 wrote to memory of 4244	1784	msedge.exe	92
PID 1784 wrote to memory of 4244	1784	msedge.exe	92
PID 1784 wrote to memory of 4244	1784	msedge.exe	92
PID 1784 wrote to memory of 4244	1784	msedge.exe	92
PID 1784 wrote to memory of 4244	1784	msedge.exe	92
PID 1784 wrote to memory of 4244	1784	msedge.exe	92
PID 1784 wrote to memory of 4244	1784	msedge.exe	92
PID 1784 wrote to memory of 4244	1784	msedge.exe	92
PID 1784 wrote to memory of 4244	1784	msedge.exe	92
PID 1784 wrote to memory of 4244	1784	msedge.exe	92
PID 1784 wrote to memory of 4244	1784	msedge.exe	92
PID 1784 wrote to memory of 4244	1784	msedge.exe	92
PID 1784 wrote to memory of 4244	1784	msedge.exe	92
PID 1784 wrote to memory of 4244	1784	msedge.exe	92
PID 1784 wrote to memory of 4244	1784	msedge.exe	92
PID 1784 wrote to memory of 4244	1784	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\DISCOVER\COMPATBL\MULTSUPP\IMAGEMAN.htm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e69646f8,0x7ff8e6964708,0x7ff8e6964718
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,4445338115233990365,6629119702427906629,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,4445338115233990365,6629119702427906629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,4445338115233990365,6629119702427906629,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4445338115233990365,6629119702427906629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4445338115233990365,6629119702427906629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,4445338115233990365,6629119702427906629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,4445338115233990365,6629119702427906629,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4445338115233990365,6629119702427906629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4445338115233990365,6629119702427906629,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4445338115233990365,6629119702427906629,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4445338115233990365,6629119702427906629,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,4445338115233990365,6629119702427906629,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d406f3135e11b0a0829109c1090a41dc

SHA1
810f00e803c17274f9af074fc6c47849ad6e873e

SHA256
91f57909a10174b06c862089a9c1f3b3aeafea74a70ee1942ce11bb80d9eace4

SHA512
2b9f0f94b1e8a1b62ab38af8df2add0ec9e4c6dfa94d9c84cc24fe86d2d57d4fc0d9ec8a9775cf42a859ddfd130260128185a0e2588992bca8fd4ebf5ee6d409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7f37f119665df6beaa925337bbff0e84

SHA1
c2601d11f8aa77e12ab3508479cbf20c27cbd865

SHA256
1073dbff3ec315ac85361c35c8ba791cc4198149b097c7b287dda1d791925027

SHA512
8e180e41dd27c51e81788564b19b8ff411028890da506fbf767d394b1e73ec53e046c8d07235b2ec7c1c593c976bbf74ed9b7d442d68b526a0a77a9b5b0ab817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
97838c1f8a7c67262627ff1b3d01a967

SHA1
ea7b1a446808dab35885f4d607c2aea7c93eb77f

SHA256
e688a6f23b1792c7a494be405fc74801babdd7d2363d14a00be43a8830cf5c1f

SHA512
4517a71f0e71b7634200a56b4c3c266d38280fcf18f34051c3b399339f0663848ec12f07a0d595502304d0511ca6a5619dbff9ca736b75b628c65d383257c7ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d193cd1d1161c735d9d4b4b21328a3a9

SHA1
71b1dfdacac85f163919436fb1c5ec1148bbf28e

SHA256
addc3a7d3a5a10579d0f6df4a3ba0e2fd3d18e4a9f530158bc055d668b5b40cc

SHA512
9a8589e2881e75477aced27a93bff561ab01554ec53585bd6f159eb342168319a3c7b2e4413c1284c1a4ac228356ddc2644867f9474542c46c81385e665fcdc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
acfafc9692a3e528af199cfec212c8a9

SHA1
503187e95b0698f9b69c860b1b53fe9f73036045

SHA256
dcd47b682475f70c628c1e1f88c690e05b5353f2932dcd819a1f5ae687ed6539

SHA512
da21be374ec9d3c3d1cb7e84c9c7355187da027e6fe581f76652ba3a8c2abb1a028e46f8229d1668e540015c57b29e63eaeeb05849a94519d927042fd25a4ddd

Download Submit