hxxps://github[.]com/barracudanetworks/ngf-aws-templates/blob/master/ELB%20Sandwich/NGF_ELB_Sandwich[.]json

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 09:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/barracudanetworks/ngf-aws-templates/blob/master/ELB%20Sandwich/NGF_ELB_Sandwich.json

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
3940	msedge.exe
3940	msedge.exe
636	identity_helper.exe
636	identity_helper.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 760	3940	msedge.exe	84
PID 3940 wrote to memory of 760	3940	msedge.exe	84
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2644	3940	msedge.exe	85
PID 3940 wrote to memory of 2400	3940	msedge.exe	86
PID 3940 wrote to memory of 2400	3940	msedge.exe	86
PID 3940 wrote to memory of 3040	3940	msedge.exe	87
PID 3940 wrote to memory of 3040	3940	msedge.exe	87
PID 3940 wrote to memory of 3040	3940	msedge.exe	87
PID 3940 wrote to memory of 3040	3940	msedge.exe	87
PID 3940 wrote to memory of 3040	3940	msedge.exe	87
PID 3940 wrote to memory of 3040	3940	msedge.exe	87
PID 3940 wrote to memory of 3040	3940	msedge.exe	87
PID 3940 wrote to memory of 3040	3940	msedge.exe	87
PID 3940 wrote to memory of 3040	3940	msedge.exe	87
PID 3940 wrote to memory of 3040	3940	msedge.exe	87
PID 3940 wrote to memory of 3040	3940	msedge.exe	87
PID 3940 wrote to memory of 3040	3940	msedge.exe	87
PID 3940 wrote to memory of 3040	3940	msedge.exe	87
PID 3940 wrote to memory of 3040	3940	msedge.exe	87
PID 3940 wrote to memory of 3040	3940	msedge.exe	87
PID 3940 wrote to memory of 3040	3940	msedge.exe	87
PID 3940 wrote to memory of 3040	3940	msedge.exe	87
PID 3940 wrote to memory of 3040	3940	msedge.exe	87
PID 3940 wrote to memory of 3040	3940	msedge.exe	87
PID 3940 wrote to memory of 3040	3940	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/barracudanetworks/ngf-aws-templates/blob/master/ELB%20Sandwich/NGF_ELB_Sandwich.json
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8470446f8,0x7ff847044708,0x7ff847044718
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,11910546022843960675,2695572531611320035,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,11910546022843960675,2695572531611320035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,11910546022843960675,2695572531611320035,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11910546022843960675,2695572531611320035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11910546022843960675,2695572531611320035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,11910546022843960675,2695572531611320035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,11910546022843960675,2695572531611320035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11910546022843960675,2695572531611320035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11910546022843960675,2695572531611320035,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11910546022843960675,2695572531611320035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11910546022843960675,2695572531611320035,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,11910546022843960675,2695572531611320035,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
04b60a51907d399f3685e03094b603cb

SHA1
228d18888782f4e66ca207c1a073560e0a4cc6e7

SHA256
87a9d9f1bd99313295b2ce703580b9d37c3a68b9b33026fdda4c2530f562e6a3

SHA512
2a8e3da94eaf0a6c4a2f29da6fec2796ba6a13cad6425bb650349a60eb3204643fc2fd1ab425f0251610cb9cce65e7dba459388b4e00c12ba3434a1798855c91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9622e603d436ca747f3a4407a6ca952e

SHA1
297d9aed5337a8a7290ea436b61458c372b1d497

SHA256
ace0e47e358fba0831b508cd23949a503ae0e6a5c857859e720d1b6479ff2261

SHA512
f774c5c44f0fcdfb45847626f6808076dccabfbcb8a37d00329ec792e2901dc59636ef15c95d84d0080272571542d43b473ce11c2209ac251bee13bd611b200a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
74a184e5c49c70835fc47f27a8f54d62

SHA1
f115908109c032d51d4ce1eaa29423f16a570bad

SHA256
da708cea965fa912e7c8350b97bbe62b2e1e333797e2d4c7389706116f6769c0

SHA512
aa004a609996b9dae1e8a1d892abd56fc17731f892497681f791279b03659fed28310ca9a32a34982546ca34b5dd7ba4b5e0e9a673939090809e970f4790e130

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
c4897aa78d9edac4710b6abd9081210d

SHA1
82fff6d6a6c64af2e1e64a0a56c46cfc2a3470bf

SHA256
1c2dbad9b7fe623f7907fe8875ae1df241de6ea09e8dbb063b885983420fc005

SHA512
207439940f16c3a029f465c4f4b6d290f15deea00c5d46365d2bbe5a27c48371315a7a5e39366638a4d256c843470b6e9acd6fc7c0b85aac10dde6176aba026c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ed35b715fcd32bcc0e3536a5da4bd009

SHA1
4b3fb353079f80217979b2dbda16e975e3d47d8c

SHA256
cab9bb664ffbf09905e82e97683ab51371d74b3ad224f2851e5bd0bc08ffd251

SHA512
6e44ca7526e0a85ff3a8778d2da64143bd0b39b6b46d4f01287a253009da2629f9bf93482ebaebb1d8318a72571040334d8f8bf2b31af52402ad91d0decffcb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
be04a290c2602e28d78387385ed6c613

SHA1
15d25b9898732ec34fd4029b0ccd97e6cf62025c

SHA256
2af4802ce66f04b84487a6c56995fb0fb5530898d43b42444f09fd5807b89a04

SHA512
9f121ec95cfb3a8871cca3fc1708a16a0d49dec862f25a825d9f2f17d326b6b73720cf45fda33c35c0939ef2ced1316f679801ddb0461d4097abcfea33f834ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
381b849479ca2db897a20a375522ec72

SHA1
06a7c1924980e2e354999b97694d0b20122b2af8

SHA256
45287dedb3692d3b758f5b322a3b8ef273c9a01a994f4e10da618b6f779bd181

SHA512
896002dafc673976890808c438307d8b0a4f556e197d863da43bdd6c337ad1b491e1e48611560f219a6dbd112cfa5759e6910f7967bc61e7903ba0f8fe6b7d23

Download Submit