4ab520bd8bab609a94e8dadf25ce40ed998b1fdfd7609bc1c4de72958a5d5cf2

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09-08-2024 15:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

5.1MB
MD5

6b84319ee8a0a0af690273d3d2dcbaf4
SHA1

857ca353e0582d100dcbc6cb6761bb4430d0cb90
SHA256

fc2a256467fb4d4ff72be6c423e5961e98b418554deeec296aded0e757b9a585
SHA512

26f9842bfdb429ef132cc1a930da9187071a339927eda402e8d54b5eb9e03067612cdadc3a2dad3d0977f8e6af18c05eab6ac91720221c6a0104f96638f85a8a
SSDEEP

24576:yd97B+mnLiLsrDy2VrErjKCqzkU98wwg3QeXuh:0P+mLAqHBCuRoeS

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2172	msedge.exe
2172	msedge.exe
2284	msedge.exe
2284	msedge.exe
4944	identity_helper.exe
4944	identity_helper.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

2284 msedge.exe
2284 msedge.exe
2284 msedge.exe
2284 msedge.exe
2284 msedge.exe
2284 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2284 wrote to memory of 3140	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3140	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 3276	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2172	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2172	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2408	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2408	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2408	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2408	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2408	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2408	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2408	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2408	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2408	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2408	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2408	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2408	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2408	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2408	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2408	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2408	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2408	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2408	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2408	2284	msedge.exe	msedge.exe
PID 2284 wrote to memory of 2408	2284	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc5d2b46f8,0x7ffc5d2b4708,0x7ffc5d2b4718
2⤵
PID:3140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2952781064645390916,8964638656310091416,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
2⤵
PID:3276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,2952781064645390916,8964638656310091416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,2952781064645390916,8964638656310091416,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
2⤵
PID:2408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2952781064645390916,8964638656310091416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
2⤵
PID:1228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2952781064645390916,8964638656310091416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
2⤵
PID:5040

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2952781064645390916,8964638656310091416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
2⤵
PID:1544

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2952781064645390916,8964638656310091416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2952781064645390916,8964638656310091416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
2⤵
PID:2060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2952781064645390916,8964638656310091416,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
2⤵
PID:4280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2952781064645390916,8964638656310091416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
2⤵
PID:1492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2952781064645390916,8964638656310091416,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
2⤵
PID:3720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2952781064645390916,8964638656310091416,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1912 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
021775256cde6b792fc4d9d93dd0ac8c

SHA1
b90e24524c0a61f5a95975e8ed4ce1f9f4883f0f

SHA256
cf45225aeb22132a6ba730b6bc1c1bc85f1fdb56bcae63013f9660fc6aea99d5

SHA512
93c796a9ff7579423d5b07c852d8c1c301dee91518950e179908bc29bdcbe06d1169019c48bbdb4e0487d57985f2519ced8abb41d2ec2ad3be13d584b68c414b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
804c239d051bd59dd771844f7ee7e983

SHA1
363c712f73ba11de7238505a3a8507c0398ef123

SHA256
36d8305db9de6c60abe7bf5de1f4cf39619ba2a24d8be5171f18ebe3b4926d44

SHA512
f91eda9fe2a4e007e68a61def5deced36901e58f84abe43c553b34bc068eb47eae5d922b87ed4297f5dca5a5081c7d57cc3cebf090982aecea9e26a6fae5421c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ef7a0a2e29c876c3632ab7be387a6f62

SHA1
7a21db41c6e7fc289017d57cbd1beb267810f682

SHA256
dbc086684b6b6c8d2b1dd53cf42415328fac902ae44a77fb54612ca9356d3293

SHA512
b3aef53fc0cec30cae54055d727e942858d815c27322c2f555d34f0616dec128abb8f0a1588139ba597b5415adbce249345024ab1ec5367e2be744322af0f4f5

Download Submit
\??\pipe\LOCAL\crashpad_2284_NEVUEHZOEJBIGZCZ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit