5a029c8866637cdd037ce33b507bd8477da4f80a7d3ccdd2261548a049b49b33

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01-08-2024 08:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

docs/install.html
Size

3KB
MD5

43ddacac4e0de3b949a1526cb5e0f84c
SHA1

988b9fa2e2219fda0f9be26df12c2e594c6720c6
SHA256

c37377d10378b65e81d30c1caa47526498959fd59e092bdeb8d4d5ca27efe856
SHA512

4bcc7276dfa7ec25daf0e2813d48b4f8ab50e76b288e581aef68de01eff9dae260ab4b3111795c715a25f41516d9e9049f61ccc94c77e36bbe717cae9d3012d3

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2160	msedge.exe
2160	msedge.exe
3012	msedge.exe
3012	msedge.exe
4512	identity_helper.exe
4512	identity_helper.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe
4964	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

3012 msedge.exe
3012 msedge.exe
3012 msedge.exe
3012 msedge.exe
3012 msedge.exe
3012 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3012 wrote to memory of 1196	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1196	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 1596	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 2160	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 2160	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3696	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3696	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3696	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3696	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3696	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3696	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3696	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3696	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3696	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3696	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3696	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3696	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3696	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3696	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3696	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3696	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3696	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3696	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3696	3012	msedge.exe	msedge.exe
PID 3012 wrote to memory of 3696	3012	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\docs\install.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe021146f8,0x7ffe02114708,0x7ffe02114718
2⤵
PID:1196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,10451966385863423387,14973726623835875737,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
2⤵
PID:1596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,10451966385863423387,14973726623835875737,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,10451966385863423387,14973726623835875737,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
2⤵
PID:3696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10451966385863423387,14973726623835875737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
2⤵
PID:3292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10451966385863423387,14973726623835875737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
2⤵
PID:3968

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,10451966385863423387,14973726623835875737,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4156 /prefetch:8
2⤵
PID:2456

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,10451966385863423387,14973726623835875737,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4156 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10451966385863423387,14973726623835875737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
2⤵
PID:3512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10451966385863423387,14973726623835875737,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
2⤵
PID:2408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10451966385863423387,14973726623835875737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
2⤵
PID:4596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,10451966385863423387,14973726623835875737,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
2⤵
PID:1576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,10451966385863423387,14973726623835875737,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5364 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4176

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
336e632142966bb5b1555731fdae58b9

SHA1
df21896206cb41e55caef4082b8d402435de5389

SHA256
bf03fb88aee2f97c7757c4d05b84f3873ba82c16de2a537679f521bb42d2a3d8

SHA512
f7cc58005811b16b1842307d473d379a0444269936ab2c0bbd58d827ad5383e0400e2a7e863f59215412a2f84924b1f8758b155b1b7eb83d045d1b6883c92173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
dd3fc896ff3b0d6ebf2ed72827fd3aa3

SHA1
8c8a9bcb355d3fddca81c5a0b7c85a094fbe9b5f

SHA256
7d083e4431e3faf959c6c5f74d0319e5c7b199407b6a36c7adc980376e6da72e

SHA512
5950639d09cd39676d2277efd11e4e21fcb6431cd67f7f2ba900def9d25fc4d56015ae2a0e32fa9f599e71f1ffd0f1b3981c57a30d73095915f975e783633619

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
996a593b98496443a17bcfb76b688aaf

SHA1
a4427325b305d9c4465d8bf7f80b226e8a5dbd78

SHA256
6e350023170180b862d52a2c522acf6e74ef03f94f46d353a34b9dbf6f470e0c

SHA512
dae9558e9eaa413a6cc585c371d1527d954acff2d1512af0bf5675c27490af07f3f89e1122df98fa8f79cba1ab70289bc122b6d1c5a570432ebcdaa67fa84fba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
f9997289e9ff05c9f55fd6f8ee125a4e

SHA1
ff088b040eaba1d5d6b3f41846d8c38dd01318de

SHA256
aa215761cdb6ed55f253ff5a1f7730247f413ad0131d6d3080ae0598d8176e15

SHA512
ba93d7fbfe55986daeea241cf09a90e4d63f17ce19c7f239c557e2017623bcaf79569412f96f358ec27d169f85109b8b00794887b16acc2750ea553ea7b03f80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
d5c199551b52350c535e93d5a0065213

SHA1
c9d73790cbd8c18111fb099d18e2bf89d7bb8f1e

SHA256
96daa578145b66508817f2bec0ff48dfb62a6013f357993246c5bc789468aa9e

SHA512
08d26caa2eab5c1a2c1b7cfc3fbdba76596cb9a3e01b09b046145174fb23dab6f8074f19e039575ef3aad380543da4ed05b12e05f7d8b094c8680048dcfbf264

Download Submit
\??\pipe\LOCAL\crashpad_3012_DQGKLRNRMICGTQDX
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit