8a98959bd08625a79795b643f3085a26efcb3a0741ca7ec271176592fa8680d8

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2024 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UCenter_Home_1.5RC1_SC_utf8/upload/admin/tpl/cron.htm
Size

2KB
MD5

d865338692ffe79f533bb0241c03e66b
SHA1

9350b11d68ce2bd0ad4f75a87b2daa94b437c87f
SHA256

42750d79e60cc3c19c97e0df8e6db9591d6fee56bad6b4cba8656e710b4260dd
SHA512

39d9691444926a8e15f5651d744635d35082538b05471052c0b82dca864a86334c3f72af0b41bd77c5ffe5dffe435aa45b8f6cbb4b3ced61211a83aae4f26d3b

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1180	msedge.exe
1180	msedge.exe
5020	msedge.exe
5020	msedge.exe
2108	identity_helper.exe
2108	identity_helper.exe
2212	msedge.exe
2212	msedge.exe
2212	msedge.exe
2212	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

5020 msedge.exe
5020 msedge.exe
5020 msedge.exe
5020 msedge.exe
5020 msedge.exe
5020 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 5020 wrote to memory of 1944	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 1944	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 224	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 1180	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 1180	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 2028	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 2028	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 2028	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 2028	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 2028	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 2028	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 2028	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 2028	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 2028	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 2028	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 2028	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 2028	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 2028	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 2028	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 2028	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 2028	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 2028	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 2028	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 2028	5020	msedge.exe	msedge.exe
PID 5020 wrote to memory of 2028	5020	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\UCenter_Home_1.5RC1_SC_utf8\upload\admin\tpl\cron.htm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa617f46f8,0x7ffa617f4708,0x7ffa617f4718
2⤵
PID:1944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,15324906914555470393,12901288271286826165,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
2⤵
PID:224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,15324906914555470393,12901288271286826165,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,15324906914555470393,12901288271286826165,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
2⤵
PID:2028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15324906914555470393,12901288271286826165,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
2⤵
PID:540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15324906914555470393,12901288271286826165,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
2⤵
PID:3208

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,15324906914555470393,12901288271286826165,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4840 /prefetch:8
2⤵
PID:2908

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,15324906914555470393,12901288271286826165,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4840 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15324906914555470393,12901288271286826165,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
2⤵
PID:336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15324906914555470393,12901288271286826165,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
2⤵
PID:2176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15324906914555470393,12901288271286826165,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
2⤵
PID:4804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,15324906914555470393,12901288271286826165,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
2⤵
PID:4040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,15324906914555470393,12901288271286826165,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3552

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b55d2d2ff2a4d5d7eeaff5ebb96f3b4a

SHA1
12d94b9e84142b10d6347a2ff3b634a20f692c7a

SHA256
3d249eae36cfc3837b043e4b8df670724fee5657b302c77d488f1da3d835f776

SHA512
4dc2fe1eeaca5f9c91d548c70a44ffd12b806a385e22a3c5f724b6f749a15c9ccb3ac1a752c63225bd4d1d90f2b25d8004a15d3912ca6a3cb92fcba91248626f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
94c981336abc388ca817dab46e7fc547

SHA1
2d0f8d89a31adb0aad5c599a195ff40ecf4b161f

SHA256
4d44efbb5447fedc3cb21311290fe6a9d0e5a0e682387a1a341bd214df820ef2

SHA512
f1c9c98f6642ea3b90c8667a4871d5a3b8c05eb0c50d5dc31e32704e0eeca1d33add414df485aced130523d6be824c48e37d0022b4d58db60006efe3e337fdbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
15e6366248df75e91968dc13765368ff

SHA1
dd7113fd6cdeeab8305eeb429b8f249f45527583

SHA256
71e86412f129aac3faad5331741f72eb618f233d5b8838a3245fc54d7617ded3

SHA512
d98b8338e8b612b6e332dcfc93f8f2b58e807b3e262daacec76c80cbd2bff0af3870bb38855de4824c8606c2a57d5ad9984bad068e14f8f4cbd8c1185dab1f2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
0582f3659aa813a05690b6fffc5ab1ba

SHA1
7334ec0c32fb04a6bfe15ba42fe0228ea556f340

SHA256
8d3d37e5c66d835ba7218c297384d178c255bbd69f1faec4a335984181f1c7c6

SHA512
86d48b177dc4afada108747e4cf93b8a5b066fb672037495e211a5245cae391f63ff3987eb895e1d2129d409d9bf74cdc69a1bebdb84b6e02b98c6e40c3cf1b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
ff73ceaab3883de77a834fc9309a05e6

SHA1
f8d9695b5a17b5ba9605199a2e0580754fac8955

SHA256
28fa151b2be03c5caf2c373dce973a2718f4083c6e2819a91beb959268a6a2f0

SHA512
b6b481949ceb67d4c16831de1d5d66197b37583624cd159675bc27cc223442a00c55c9b6d0f61063df2049d69689c37b0465b10f074af674dd7514d9758e941e

Download Submit
\??\pipe\LOCAL\crashpad_5020_DCILWVZDWSAAGTMR
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit