578993fcf8d57252bc34536c01dc853a374e60def68f60b2826c3de0826ea00c

Analysis

max time kernel
145s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

www/plugson_conf_replace.html
Size

11KB
MD5

ab7b0e0ae2c6b2b2b59ded3c7a9e0f12
SHA1

12fa135573590621add9ed6d869bab4dfe07f8c2
SHA256

70c1dda4026cf56c01bdac997a652cee7eda60229dc51c9ec6d3609687a1a3f8
SHA512

620721497f67d4f4346737fe67e20901aca00592067b1d9d873c28360eba58ecc806fac91d9a8332c0e8dc841dc0e10702f96d8bb09d7890bb73d1a699973a3d
SSDEEP

96:Hit2petGVxQBkzoG2pm+0+pntioGQQQQQrYMEpyJJgAZKKqpqWCFKs4UbbpVMhPD:HilzO2pm+qoGQQQQQsMEc/ZKkth4wVQ7

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2328	msedge.exe
2328	msedge.exe
2060	msedge.exe
2060	msedge.exe
1160	identity_helper.exe
1160	identity_helper.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe
1812	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 3828	2060	msedge.exe	82
PID 2060 wrote to memory of 3828	2060	msedge.exe	82
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 1624	2060	msedge.exe	84
PID 2060 wrote to memory of 2328	2060	msedge.exe	85
PID 2060 wrote to memory of 2328	2060	msedge.exe	85
PID 2060 wrote to memory of 4240	2060	msedge.exe	86
PID 2060 wrote to memory of 4240	2060	msedge.exe	86
PID 2060 wrote to memory of 4240	2060	msedge.exe	86
PID 2060 wrote to memory of 4240	2060	msedge.exe	86
PID 2060 wrote to memory of 4240	2060	msedge.exe	86
PID 2060 wrote to memory of 4240	2060	msedge.exe	86
PID 2060 wrote to memory of 4240	2060	msedge.exe	86
PID 2060 wrote to memory of 4240	2060	msedge.exe	86
PID 2060 wrote to memory of 4240	2060	msedge.exe	86
PID 2060 wrote to memory of 4240	2060	msedge.exe	86
PID 2060 wrote to memory of 4240	2060	msedge.exe	86
PID 2060 wrote to memory of 4240	2060	msedge.exe	86
PID 2060 wrote to memory of 4240	2060	msedge.exe	86
PID 2060 wrote to memory of 4240	2060	msedge.exe	86
PID 2060 wrote to memory of 4240	2060	msedge.exe	86
PID 2060 wrote to memory of 4240	2060	msedge.exe	86
PID 2060 wrote to memory of 4240	2060	msedge.exe	86
PID 2060 wrote to memory of 4240	2060	msedge.exe	86
PID 2060 wrote to memory of 4240	2060	msedge.exe	86
PID 2060 wrote to memory of 4240	2060	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\www\plugson_conf_replace.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffc7b446f8,0x7fffc7b44708,0x7fffc7b44718
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,11314416843827368368,2579995630864173617,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,11314416843827368368,2579995630864173617,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,11314416843827368368,2579995630864173617,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11314416843827368368,2579995630864173617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11314416843827368368,2579995630864173617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,11314416843827368368,2579995630864173617,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,11314416843827368368,2579995630864173617,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11314416843827368368,2579995630864173617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11314416843827368368,2579995630864173617,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11314416843827368368,2579995630864173617,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11314416843827368368,2579995630864173617,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,11314416843827368368,2579995630864173617,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5540 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c25b7a419561864f4b72d2d629a7350e

SHA1
93d473513f376f4baf5524a75f681a879e8f18ae

SHA256
1e7c5a5ba2c72e19e695f21eaf75bdbfbeaf88465746720a8d7ddb33bfdf5008

SHA512
d1923920338b5b445342132df65081296a440d24751aab7d8044605f1861dc95d7b9db2acc3ed5331fd4dccd338c7e6f1f29114e45aaf06cc14a79f33db58190

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
71555851fd37655fced696e05f254f0e

SHA1
7418027c071c288749739b229f707ade6dbfa9af

SHA256
acd38df37410be01b2ee5502e285d17a95e7bebc93f0f62b5458662c120190c9

SHA512
a66df35274c08a2637ec9bba9b0050218854805bdab63004161806be6920ad59d60d0ea25a255c7f4bbc45361f7d26cf19165a7f65b82538940bbb3435f2c47d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0eeae7f4a7bb0531eb63732be009e353

SHA1
3eb1bac3849f0a31e8692de1dae022538d4f3a90

SHA256
3fc308b7da80dddb503bc63d6d062efefc209c3fe738b8240f587b614eac8090

SHA512
a16e77546ba1557452f8542da5827defe4974a268fecedc0dea2a296846b85062a8b3a6bf19a1585a6f7f08723ba165c79b9911c82b3030a6bc7e31569afd3b0

Download Submit