dea137b7286f22ec0e69d7d85dc14ebacc4951d70d2303bd2b4f201cf4a52334

Analysis

max time kernel
145s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
28-07-2024 23:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

server[php]/theme/small.html
Size

529B
MD5

4a37792461cfe27187b5d9f9a29ae43c
SHA1

97c04b747c2e11e24c7fee0f93cb0c98e7803325
SHA256

ad945266a275784cc8c711ff9fe2650da6587d851245e04a45db8af46b34db58
SHA512

10ebf4a1935f076ae9faba0434eb6dc9253bc3b96ad3ec8e0dda8d3de30bc20d674a10d0f4feefed1c6924145834349ae33efd33f0e9853d1721b864083b698f

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3876	msedge.exe
3876	msedge.exe
3324	msedge.exe
3324	msedge.exe
4920	identity_helper.exe
4920	identity_helper.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 1440	3324	msedge.exe	82
PID 3324 wrote to memory of 1440	3324	msedge.exe	82
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 1992	3324	msedge.exe	84
PID 3324 wrote to memory of 3876	3324	msedge.exe	85
PID 3324 wrote to memory of 3876	3324	msedge.exe	85
PID 3324 wrote to memory of 4256	3324	msedge.exe	86
PID 3324 wrote to memory of 4256	3324	msedge.exe	86
PID 3324 wrote to memory of 4256	3324	msedge.exe	86
PID 3324 wrote to memory of 4256	3324	msedge.exe	86
PID 3324 wrote to memory of 4256	3324	msedge.exe	86
PID 3324 wrote to memory of 4256	3324	msedge.exe	86
PID 3324 wrote to memory of 4256	3324	msedge.exe	86
PID 3324 wrote to memory of 4256	3324	msedge.exe	86
PID 3324 wrote to memory of 4256	3324	msedge.exe	86
PID 3324 wrote to memory of 4256	3324	msedge.exe	86
PID 3324 wrote to memory of 4256	3324	msedge.exe	86
PID 3324 wrote to memory of 4256	3324	msedge.exe	86
PID 3324 wrote to memory of 4256	3324	msedge.exe	86
PID 3324 wrote to memory of 4256	3324	msedge.exe	86
PID 3324 wrote to memory of 4256	3324	msedge.exe	86
PID 3324 wrote to memory of 4256	3324	msedge.exe	86
PID 3324 wrote to memory of 4256	3324	msedge.exe	86
PID 3324 wrote to memory of 4256	3324	msedge.exe	86
PID 3324 wrote to memory of 4256	3324	msedge.exe	86
PID 3324 wrote to memory of 4256	3324	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\server[php]\theme\small.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffefbb746f8,0x7ffefbb74708,0x7ffefbb74718
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,13202734270015835896,15933347575132333058,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1984,13202734270015835896,15933347575132333058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1984,13202734270015835896,15933347575132333058,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13202734270015835896,15933347575132333058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13202734270015835896,15933347575132333058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,13202734270015835896,15933347575132333058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,13202734270015835896,15933347575132333058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13202734270015835896,15933347575132333058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13202734270015835896,15933347575132333058,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13202734270015835896,15933347575132333058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13202734270015835896,15933347575132333058,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,13202734270015835896,15933347575132333058,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5448 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0b29ce8c-9427-44f1-abc6-bd9fe8b5a098.tmp

Filesize
11KB

MD5
affed1cd4dcc11dee1a443ca703eba39

SHA1
a27a3cffe1c4bdc407b702c1d313d4feab477dc4

SHA256
404a3bfa903fe9e5acc274113c01297f06fd3967086287cd03bab2b76d81e08f

SHA512
a547ec03fee2cc5848e08d04cb3469d395faf917158919d69ed5efedd5b9633d78f5a90b7573e60ce14500a5abbc7e6bb092265e5f19850f4311ac6f401570b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0dc31145339977b457eec605c4e1a567

SHA1
deb6ff8183afdaafd849858c821af52f93936e1c

SHA256
4b1ef876e1d4f2c9726b7b966222c336d0be026c588178ad40ab476be4d353ec

SHA512
ef095404247530ade966bae7d6920f0ff060852e3dfb545f4bbca384f88d0e2a4622b55e4b856ab63f6e6c56196a8ad1257711b53a2fcdd89962d1252b6c4e17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
31f5155eeaa8631c1c80614efb4e73cd

SHA1
aac054ba3a9bd71bb2644cc541aad11a5f119017

SHA256
7e0833f04bdc7ed7a88940d793f110d199368d7c2ca55eabb154de84a355d7cf

SHA512
94c43c4e59ae3745fee5157852c279110de2f89dd1562c47627ef960a70790db0b713155817ac7ac636e43f0218f73d35c915f9de61df019ba65c09730a21452

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a95f1ab18c1fb085393f9274e72a8420

SHA1
81a215f68458f3821a13ae3d16ecef9fbeccc4cd

SHA256
449bb3490edc69bd377ab90a1f472dbf950e10dda78981dba5013f1f48bd5453

SHA512
7a59965e185fa693047ef8c7b19a96d30c8f9e0d578ca2beda104a847c719676d488ac2f8b57acb3938a8e9d97c89d9aaf163c923ad741eec4ac83b2ccbc0d37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5b5e5c1ef074115df953f059ff7ef54e

SHA1
63cdbbc2fd1e7950cf60ff7dad297f97e990e53c

SHA256
cee019dd9fcc0292de7b979984e0aa0a6c537a90ddd3978a93ebb4e45b3ab333

SHA512
318696aaaf562783d39eb5bf5f3eee1e4bb8948f861742f47c2383c534cb882fb93e5373b634159b3c62547496e87dae19ba125656c5ca8903eaee89f839adc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit