2d4df1dec8cf9ca27f8a54a851ce95cffe290f71a88cfa17b34ae92e15297d8e

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01-08-2024 21:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/welcomepage_noadw.html
Size

5KB
MD5

503788b7c7fc1e94d3881697dc0f9455
SHA1

c9710548dd90191732aa428957988039d9014ced
SHA256

bff319cb4251e23c995abc742d926b7c85b9798783ac9dad8e8cdc274ede423c
SHA512

138f60cc8d168004325dcf2452f24fdd29a3fddc6f693326d01c614a6638c1d40ce9f7b1766b9440de8012d05977adc0f2b92eb02aa76d44ee7dfbc99cd24748
SSDEEP

96:SI32bJbWEMkTSf7qOugnffDbhIDbbE5zDbnwEqqc/zIxG1DuspXdNy7Pt:SI0bWEM6Sf75ugffDtIDHEBDzwfF//4r

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
3104	identity_helper.exe
3104	identity_helper.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 1844	1180	msedge.exe	83
PID 1180 wrote to memory of 1844	1180	msedge.exe	83
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 1460	1180	msedge.exe	84
PID 1180 wrote to memory of 4396	1180	msedge.exe	85
PID 1180 wrote to memory of 4396	1180	msedge.exe	85
PID 1180 wrote to memory of 3480	1180	msedge.exe	86
PID 1180 wrote to memory of 3480	1180	msedge.exe	86
PID 1180 wrote to memory of 3480	1180	msedge.exe	86
PID 1180 wrote to memory of 3480	1180	msedge.exe	86
PID 1180 wrote to memory of 3480	1180	msedge.exe	86
PID 1180 wrote to memory of 3480	1180	msedge.exe	86
PID 1180 wrote to memory of 3480	1180	msedge.exe	86
PID 1180 wrote to memory of 3480	1180	msedge.exe	86
PID 1180 wrote to memory of 3480	1180	msedge.exe	86
PID 1180 wrote to memory of 3480	1180	msedge.exe	86
PID 1180 wrote to memory of 3480	1180	msedge.exe	86
PID 1180 wrote to memory of 3480	1180	msedge.exe	86
PID 1180 wrote to memory of 3480	1180	msedge.exe	86
PID 1180 wrote to memory of 3480	1180	msedge.exe	86
PID 1180 wrote to memory of 3480	1180	msedge.exe	86
PID 1180 wrote to memory of 3480	1180	msedge.exe	86
PID 1180 wrote to memory of 3480	1180	msedge.exe	86
PID 1180 wrote to memory of 3480	1180	msedge.exe	86
PID 1180 wrote to memory of 3480	1180	msedge.exe	86
PID 1180 wrote to memory of 3480	1180	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\welcomepage_noadw.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8538d46f8,0x7ff8538d4708,0x7ff8538d4718
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,17317773470862727278,8355673023425887852,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,17317773470862727278,8355673023425887852,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2548 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,17317773470862727278,8355673023425887852,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17317773470862727278,8355673023425887852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17317773470862727278,8355673023425887852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,17317773470862727278,8355673023425887852,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,17317773470862727278,8355673023425887852,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17317773470862727278,8355673023425887852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17317773470862727278,8355673023425887852,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17317773470862727278,8355673023425887852,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17317773470862727278,8355673023425887852,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,17317773470862727278,8355673023425887852,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3012 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:32

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0dc31145339977b457eec605c4e1a567

SHA1
deb6ff8183afdaafd849858c821af52f93936e1c

SHA256
4b1ef876e1d4f2c9726b7b966222c336d0be026c588178ad40ab476be4d353ec

SHA512
ef095404247530ade966bae7d6920f0ff060852e3dfb545f4bbca384f88d0e2a4622b55e4b856ab63f6e6c56196a8ad1257711b53a2fcdd89962d1252b6c4e17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
31f5155eeaa8631c1c80614efb4e73cd

SHA1
aac054ba3a9bd71bb2644cc541aad11a5f119017

SHA256
7e0833f04bdc7ed7a88940d793f110d199368d7c2ca55eabb154de84a355d7cf

SHA512
94c43c4e59ae3745fee5157852c279110de2f89dd1562c47627ef960a70790db0b713155817ac7ac636e43f0218f73d35c915f9de61df019ba65c09730a21452

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cdf1c4d2b9458a16971e35b774679102

SHA1
744b9367555d9b05e8580558942f667a3ebf6e7d

SHA256
7e104219260cf5a736c95007cdf6f103fc5b3cce3f36596d43b8294eeaed6674

SHA512
bad5fd773325cd4f36ab864995d0ff512c86080902f7e4a2b035bdfb7c2067351d089c4e5b502b1c15eb67f3b7e78f44768cc366209db8cf1b50dc552d0fe26c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ec3bf5d76b14392457dda491956e27aa

SHA1
42dc12d153e7430dfecd1afafc18327d7381fe84

SHA256
d4c3e7f983cd7b2c2f696eeaa402b313eed96990a9bbfeab25814b33ab48ba41

SHA512
3f8759534598f87700ac88154dc85de888939c1a62bb639561c3f53129931f54fcacfd056fd1aff25857041fb41e9716737ae75a5aa77e92c33a4a940e8efd67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d545e3dfe0548d32fb9643ca13caf3eb

SHA1
1a01d4fe35f177c4cccbd0df4d2dfbc2097778ac

SHA256
da16a4cc7af87830536f92452c3af1ecdf2d47958b5ad7e51bbd4c98c3fd9b7d

SHA512
5f1e2bb3acc831aaaf8bafe06107eeb3bf8e83fd7358da7bf7f85ccdfdc97ea1126bdde34ee48c984d8a8b90a96f6c576753df43282951079bb0789997e0e1d4

Download Submit