f4691e1a3b01a055a0072b819a3e5274f9a1b7c5213b1027e318a6823febf402

Analysis

max time kernel
145s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240729-en
resource tags

arch:x64arch:x86image:win10v2004-20240729-enlocale:en-usos:windows10-2004-x64system
submitted
27-07-2024 17:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

xgcms/upload/caches/index.html
Size

1B
MD5

7215ee9c7d9dc229d2921a40e899ec5f
SHA1

b858cb282617fb0956d960215c8e84d1ccf909c6
SHA256

36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
SHA512

f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
620	msedge.exe
620	msedge.exe
4572	msedge.exe
4572	msedge.exe
3760	identity_helper.exe
3760	identity_helper.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

4572 msedge.exe
4572 msedge.exe
4572 msedge.exe
4572 msedge.exe
4572 msedge.exe
4572 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4572 wrote to memory of 4152	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 4152	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3888	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 620	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 620	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3464	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3464	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3464	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3464	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3464	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3464	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3464	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3464	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3464	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3464	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3464	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3464	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3464	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3464	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3464	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3464	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3464	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3464	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3464	4572	msedge.exe	msedge.exe
PID 4572 wrote to memory of 3464	4572	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\xgcms\upload\caches\index.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f54c46f8,0x7ff8f54c4708,0x7ff8f54c4718
2⤵
PID:4152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,16122511408895202140,5209932926162746214,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
2⤵
PID:3888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,16122511408895202140,5209932926162746214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,16122511408895202140,5209932926162746214,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
2⤵
PID:3464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16122511408895202140,5209932926162746214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
2⤵
PID:4952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16122511408895202140,5209932926162746214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
2⤵
PID:3472

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,16122511408895202140,5209932926162746214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
2⤵
PID:2156

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,16122511408895202140,5209932926162746214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16122511408895202140,5209932926162746214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
2⤵
PID:2756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16122511408895202140,5209932926162746214,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
2⤵
PID:3392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16122511408895202140,5209932926162746214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4404 /prefetch:1
2⤵
PID:1612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,16122511408895202140,5209932926162746214,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
2⤵
PID:4460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,16122511408895202140,5209932926162746214,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1848 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3080

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
8004d5759305b326cebfa4d67dee5f25

SHA1
36b9a94959977f79dd0a14380ba0516d09f8fcaa

SHA256
21f35e2ac53a817389d7027e99018450993fc66e37f916e454bff9eed95562d7

SHA512
7afba827395c1a5438091bd2762a097f6ea098fcbf3db99f90f9bc442afee7a7841a6e0e83f9cbf017cda0e52d35da93f8efd60cec73638baea5eaf1c85b7089

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
368c244e384ff4d49f8c2e7b8bea96d2

SHA1
69ce5a9daeaf1e26bba509f9569dc68b9a455c51

SHA256
6f8cb8fe96a0e80be05e02f0f504e40d20e7f5db23fd0edee0e56bcffa1059a3

SHA512
ac460f1b35bcdefa89104e26379fc5639499607be6559353665a73ee8dd41822699d767532d48cffc67c755b75042294c29e93062d4eab22ca6bcbe054108a5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
d444436d0764d48f6b5816fac221647d

SHA1
f6ccd881abc11159cee73ff7f5c2a406af4a477d

SHA256
43fc24f0e5f602f929b8f6b3814b4385e522dd0d63d6d446802bf8180feeb10f

SHA512
fb874e6016032b40c3a44e36e7a8c728b9294ae844e4dd1817a39633846f9dcd25e9025a9e1abf66d2c1d5f901db81ed83c456a2635d8d965033e62dd2abc277

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
05fad1e954331192e3071169c38ee576

SHA1
588b152a7f55c343f77ace6b90b18c023d1732b2

SHA256
0f2c7a68d31313739a62c5520e643fbaed2c59162ea5f25c8a2fec9e878a372f

SHA512
c92059a701112bb78f4745d56dd3283743af4e4a0bb7c09afbf7776ab1d1219161b258489fa5c93b38745843022e150eab5a82786eed3a8f2fe45033c8555330

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
d38dd7ad568d86c43a67f51cf8d0de6d

SHA1
9944bc0b652e3edada3a0ee5d04e8b507da1edd3

SHA256
190f21b79794407c98fba247f07c38896e0c21b930500f9fd5fb0c8c5758dfca

SHA512
6dafabbd13db647a7fc52b6b4a7f5cc016a96ad81232e3b3edbd8b4bb06fc478b59a842aa3f190c7cbdfe764d3143ad5d5fc27652dee235753d3c0862d37bf52

Download Submit
\??\pipe\LOCAL\crashpad_4572_ZGKETXGSNEDUEUJO
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit