3606322c109e7f63d25a843ca2a5babe75d93da6692371854d0e4dab5c1e09d9

Resubmissions

08-08-2024 18:00

240808-wljhzswhnm 3

Analysis

max time kernel
145s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-08-2024 18:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Flare X Version 1.1/bin/DebugMonaco/ace.html
Size

3KB
MD5

9082d5805f51212f8628ea0849193818
SHA1

e6a21171b4e61003ee733651deddcefb030058dc
SHA256

97ddcca21e29acb7f39130e1ea0e31627282ae135f44a00ed3bdbaca69430ee9
SHA512

be21ad0d17b3c8d97ff9e9bbbe073bad3d56c25101b5f27346681a441e654c7d2fa340e7fa8dc4724e418683d944448dcf515a31a0843365954558a8d12fd1bf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2240	msedge.exe
2240	msedge.exe
2568	msedge.exe
2568	msedge.exe
1568	identity_helper.exe
1568	identity_helper.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

2568 msedge.exe
2568 msedge.exe
2568 msedge.exe
2568 msedge.exe
2568 msedge.exe
2568 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2568 wrote to memory of 1104	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 1104	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 3672	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 2240	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 2240	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 4536	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 4536	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 4536	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 4536	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 4536	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 4536	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 4536	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 4536	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 4536	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 4536	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 4536	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 4536	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 4536	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 4536	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 4536	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 4536	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 4536	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 4536	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 4536	2568	msedge.exe	msedge.exe
PID 2568 wrote to memory of 4536	2568	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Flare X Version 1.1\bin\DebugMonaco\ace.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xd8,0x110,0x7ffd8f2946f8,0x7ffd8f294708,0x7ffd8f294718
2⤵
PID:1104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,2224595029095320754,12840179006607789722,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
2⤵
PID:3672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,2224595029095320754,12840179006607789722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,2224595029095320754,12840179006607789722,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
2⤵
PID:4536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2224595029095320754,12840179006607789722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
2⤵
PID:2152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2224595029095320754,12840179006607789722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
2⤵
PID:4792

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,2224595029095320754,12840179006607789722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8
2⤵
PID:4320

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,2224595029095320754,12840179006607789722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2224595029095320754,12840179006607789722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
2⤵
PID:4596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2224595029095320754,12840179006607789722,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
2⤵
PID:2504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2224595029095320754,12840179006607789722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:1
2⤵
PID:3932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2224595029095320754,12840179006607789722,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
2⤵
PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,2224595029095320754,12840179006607789722,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5472 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
188B

MD5
9e60751db3c2c5b6a54f6cb18f9a387e

SHA1
c3815742501bd3eb5456958d253c57fa48f14451

SHA256
376006f8fffee91ede6e6367fc46a81ad97568e59ede6bfdc1aba6420294d6d1

SHA512
e25d565bc4a56dcdb10bb2eb9daf4b031746652cfa55658f35331bc72b0dce59861fbb0a3923857a0382e1b0ef6f38022b13f34e84133567f37872738b12aa96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
970f5acfa09e3a02582d430ca847b673

SHA1
72edb12f30675b26b4bb4705c8d99265510577a8

SHA256
fa63d86184de965cc40a61fea311ae4cee0abfedfec61b1bbc95a5c1bffc3357

SHA512
6f33099af06648fe6f3472405da9bd772dbccaaed9590e1507ce520088572320e0e86d4e5746ac88c59269c1b2465bfe9ba0cb06d0654981f67dbbe522f55ac3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
81602cdd8d1c0a3df3dd54feb06cb38a

SHA1
411caf2d5f188094dca0b7c596e46d31bf7d7b65

SHA256
ca5ec7c81f38a9e1d1f719359ca22c711c0d0202ad493459191272e119357caa

SHA512
a9005404c0f72c07be6630fee8efe1a914e1752e616b6d95d6db35933948ab629799b4047e1b3f956a6d893200ab3a324797d609300787f566cbafcca155f609

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
2fab06486d2eb46e7d43af952e3c465b

SHA1
f3b59f29cf08e52a420dfb9dc0e0c7031c1a4fed

SHA256
cbfc5c45b774c7201df939041ec468223d6c2318a277586ec1ed76be8e017b21

SHA512
ccc6197254f4cc81f86973f7bb06656ea886ee4b79ae4a2fdbf79f6facf1826a9e457ad8e8a5925d0c923f3c411f7b056b8a6afcc4116eab9f1b213dab74a5b6

Download Submit
\??\pipe\LOCAL\crashpad_2568_KPHNYZXOAYDGPRWG
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit