661324fbbc8c41a7a2c1cb6fa8430ed60bde6d032b871b1a56586948a990e197

Analysis

max time kernel
41s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 00:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

monaco/Monaco.html
Size

47KB
MD5

d65261c2e83ae0319cb5e931d3cd813b
SHA1

b13189b8e6c82f9db00985483867e2ec27c99ccf
SHA256

520aa43d592bb8171d7cb015cdf6b8a2f5ae007be9a7a154c8f7c48b6f33b54a
SHA512

3e6e544d3947fa7b5a0391e84f6157b155f7a67cccff81b892a8d3c2f2303bf9003bf6ad3033df6cfcb809cf22a8208a8dbfb804a01d1b1b3def8322d14ababa
SSDEEP

768:TWi2Np6OXoy/21rxzD80kShCTrw4mkMXQnb1fqKTr5q4QVGQ6riAT+e3N9vnwJV3:d2Npdoy/21lkSMw4mkMXQnb1fqir5q4I

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1060	msedge.exe
1060	msedge.exe
2448	msedge.exe
2448	msedge.exe
1916	identity_helper.exe
1916	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 1840	2448	msedge.exe	84
PID 2448 wrote to memory of 1840	2448	msedge.exe	84
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 2632	2448	msedge.exe	85
PID 2448 wrote to memory of 1060	2448	msedge.exe	86
PID 2448 wrote to memory of 1060	2448	msedge.exe	86
PID 2448 wrote to memory of 1848	2448	msedge.exe	87
PID 2448 wrote to memory of 1848	2448	msedge.exe	87
PID 2448 wrote to memory of 1848	2448	msedge.exe	87
PID 2448 wrote to memory of 1848	2448	msedge.exe	87
PID 2448 wrote to memory of 1848	2448	msedge.exe	87
PID 2448 wrote to memory of 1848	2448	msedge.exe	87
PID 2448 wrote to memory of 1848	2448	msedge.exe	87
PID 2448 wrote to memory of 1848	2448	msedge.exe	87
PID 2448 wrote to memory of 1848	2448	msedge.exe	87
PID 2448 wrote to memory of 1848	2448	msedge.exe	87
PID 2448 wrote to memory of 1848	2448	msedge.exe	87
PID 2448 wrote to memory of 1848	2448	msedge.exe	87
PID 2448 wrote to memory of 1848	2448	msedge.exe	87
PID 2448 wrote to memory of 1848	2448	msedge.exe	87
PID 2448 wrote to memory of 1848	2448	msedge.exe	87
PID 2448 wrote to memory of 1848	2448	msedge.exe	87
PID 2448 wrote to memory of 1848	2448	msedge.exe	87
PID 2448 wrote to memory of 1848	2448	msedge.exe	87
PID 2448 wrote to memory of 1848	2448	msedge.exe	87
PID 2448 wrote to memory of 1848	2448	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\monaco\Monaco.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbd45c46f8,0x7ffbd45c4708,0x7ffbd45c4718
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13411599786538842940,17972489273895278180,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,13411599786538842940,17972489273895278180,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,13411599786538842940,17972489273895278180,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13411599786538842940,17972489273895278180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13411599786538842940,17972489273895278180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,13411599786538842940,17972489273895278180,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,13411599786538842940,17972489273895278180,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13411599786538842940,17972489273895278180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13411599786538842940,17972489273895278180,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13411599786538842940,17972489273895278180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13411599786538842940,17972489273895278180,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:4024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
92bb093511bbb7c559e2f028c7410d90

SHA1
c0977104cbb284c4fbdca2336957681849f35bb9

SHA256
2e32e63eaa1b07f521672489bedac174eb0cdde60140a3c5b99efab685f7de7d

SHA512
a66c2d632470d3fb2ec1c339b005be83255bc0412d744587f5fb9e88aef3c824de7c684ee01e8daaf1f47046ea47934f79cca320a22b56f21fcea932c836dcba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
73a1875c2ddd2bff0cde9dbecb7b8995

SHA1
6d569a003bf75e4757cee76729e454a71d85f5d2

SHA256
ab8bb7233c2271056f0a2420b1ba7f0a2a9988a4557bced6a9836e0b4f70e6dc

SHA512
75a4a42314a49644f7693fb0f4a120dc6b4f0b03dd7199c0de4bdf66b9ca8f4e9de6c04aa89a05b36e94fd29e3e0e2ff4f69d86545fd6acdbcf601ba4a91ac22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
42fce90a494828e6feeb2b26c67b835a

SHA1
192c50307eca069a2943de7cabf88f4971d50c53

SHA256
2bf5965a52fad7711f86e5b7d0ea8f319a937b8bb6e574a0f1940422cf3385e1

SHA512
cff730900120fa40acd548fca250556353b90cdcc8093ec0ee4a114c176715107e1afef7222d02447e2d658284c6e6759d785d4d52616a7ad0aed621ec7350ab

Download Submit