e0bddf4eda28563c6ab8cbb5878dd442e0083775147185be731b2b15393c8ae2

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 20:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

edsc21/wwwroot/admins/Editor/Dialog/help.htm
Size

517B
MD5

018ad98743286c320526f278b2484d94
SHA1

21ffec1f244d32f945c0c7844c51ef6309307345
SHA256

bf8d68b9ed15f243acf62b76bbbc44e7dae61768b45f5e19457919e52c4abb93
SHA512

84eb3c3c79e161146a01d082859df32978a1ff70a9c727eaefcb9a09804d08fa9992fda3f0cf182523dd50df3c474a58ca2ba14b44ea0b2877f118982e7c26dc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2212	msedge.exe
2212	msedge.exe
2040	msedge.exe
2040	msedge.exe
4376	identity_helper.exe
4376	identity_helper.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 3440	2040	msedge.exe	85
PID 2040 wrote to memory of 3440	2040	msedge.exe	85
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 1876	2040	msedge.exe	86
PID 2040 wrote to memory of 2212	2040	msedge.exe	87
PID 2040 wrote to memory of 2212	2040	msedge.exe	87
PID 2040 wrote to memory of 1240	2040	msedge.exe	88
PID 2040 wrote to memory of 1240	2040	msedge.exe	88
PID 2040 wrote to memory of 1240	2040	msedge.exe	88
PID 2040 wrote to memory of 1240	2040	msedge.exe	88
PID 2040 wrote to memory of 1240	2040	msedge.exe	88
PID 2040 wrote to memory of 1240	2040	msedge.exe	88
PID 2040 wrote to memory of 1240	2040	msedge.exe	88
PID 2040 wrote to memory of 1240	2040	msedge.exe	88
PID 2040 wrote to memory of 1240	2040	msedge.exe	88
PID 2040 wrote to memory of 1240	2040	msedge.exe	88
PID 2040 wrote to memory of 1240	2040	msedge.exe	88
PID 2040 wrote to memory of 1240	2040	msedge.exe	88
PID 2040 wrote to memory of 1240	2040	msedge.exe	88
PID 2040 wrote to memory of 1240	2040	msedge.exe	88
PID 2040 wrote to memory of 1240	2040	msedge.exe	88
PID 2040 wrote to memory of 1240	2040	msedge.exe	88
PID 2040 wrote to memory of 1240	2040	msedge.exe	88
PID 2040 wrote to memory of 1240	2040	msedge.exe	88
PID 2040 wrote to memory of 1240	2040	msedge.exe	88
PID 2040 wrote to memory of 1240	2040	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\edsc21\wwwroot\admins\Editor\Dialog\help.htm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff817a146f8,0x7ff817a14708,0x7ff817a14718
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,18392916262199309070,5493222905127328230,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,18392916262199309070,5493222905127328230,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,18392916262199309070,5493222905127328230,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,18392916262199309070,5493222905127328230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,18392916262199309070,5493222905127328230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,18392916262199309070,5493222905127328230,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 /prefetch:8
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,18392916262199309070,5493222905127328230,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,18392916262199309070,5493222905127328230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,18392916262199309070,5493222905127328230,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,18392916262199309070,5493222905127328230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,18392916262199309070,5493222905127328230,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,18392916262199309070,5493222905127328230,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4968 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
04b60a51907d399f3685e03094b603cb

SHA1
228d18888782f4e66ca207c1a073560e0a4cc6e7

SHA256
87a9d9f1bd99313295b2ce703580b9d37c3a68b9b33026fdda4c2530f562e6a3

SHA512
2a8e3da94eaf0a6c4a2f29da6fec2796ba6a13cad6425bb650349a60eb3204643fc2fd1ab425f0251610cb9cce65e7dba459388b4e00c12ba3434a1798855c91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9622e603d436ca747f3a4407a6ca952e

SHA1
297d9aed5337a8a7290ea436b61458c372b1d497

SHA256
ace0e47e358fba0831b508cd23949a503ae0e6a5c857859e720d1b6479ff2261

SHA512
f774c5c44f0fcdfb45847626f6808076dccabfbcb8a37d00329ec792e2901dc59636ef15c95d84d0080272571542d43b473ce11c2209ac251bee13bd611b200a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4e9212d115fece047857a3b33a8b62e2

SHA1
ebaf9919086d58bf7633b01c3896d2fc4c74efca

SHA256
af6eabb26741c91c8035e8a46cb5e07230137df571d52ac9bcc409e5f6f016ef

SHA512
01178f08bb86ae162a22271c3be7cf569bd3aa123f136c45e3e6e9eddf0423a98aaeb087c362c388d27fc7b7a373d606775ddd1d815b9a5051feb3a168bcd1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c295a33dbf6fe53b1b450dac22f93e71

SHA1
36f62a821e9726ba8161bfa0cf1ee3323d82ad55

SHA256
08bed179fb6790bb00587360ba7c3687789d7e2f9fcb65720e0649b6639d60a0

SHA512
872dbdbe449799b88a02c72e6d4381c798b4f17a603b67a0d8943399d1b36c25c128ab6a3c6adb427d8c5215a7c1771f40b16033fcd1c6e6790d7571e3ff0da0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
858bef9add943c1d04513a4f5766280a

SHA1
549a13a468e6456d830d79855020173c7ed86592

SHA256
071a377bdcd1fa97aad57bcd445d6d217dc4baa76dcc9fa5efd9f08a44c44446

SHA512
385949b7b6a04604445f232eb5adadf77660b9d44d40f532f091e6dd4e4b9840f6de532c3d16b8c5b24da152d249ea3b1aa6d6c003c2f4e5d5acd08f44ee5f03

Download Submit