9c40b517aa64f8bd70157ee733923314f1f515691b2e3a7f52d5ecec055281dc

Analysis

max time kernel
7s
max time network
9s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
09/08/2024, 17:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

redirect.html
Size

6KB
MD5

26183bd8f02f37896b969e878f1109a6
SHA1

38f254baf1084e3644aaadd4953ef3f7b7dfb338
SHA256

9c40b517aa64f8bd70157ee733923314f1f515691b2e3a7f52d5ecec055281dc
SHA512

7bea9b70bc73e1813f9eb597c30615466bbe380b168d14cad2fe449e6a7710f39862cc9de33ba6e78016197c3ba9c65c0d859c4f42b244461e76577870991605
SSDEEP

192:dKHLxX7777/77QF7Eyro0Lod4BYCIkvOnXoPg:dKr5HYY0+CIkvOnXD

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1284	msedge.exe
1284	msedge.exe
3640	msedge.exe
3640	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 3444	3640	msedge.exe	81
PID 3640 wrote to memory of 3444	3640	msedge.exe	81
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 3312	3640	msedge.exe	82
PID 3640 wrote to memory of 1284	3640	msedge.exe	83
PID 3640 wrote to memory of 1284	3640	msedge.exe	83
PID 3640 wrote to memory of 1552	3640	msedge.exe	84
PID 3640 wrote to memory of 1552	3640	msedge.exe	84
PID 3640 wrote to memory of 1552	3640	msedge.exe	84
PID 3640 wrote to memory of 1552	3640	msedge.exe	84
PID 3640 wrote to memory of 1552	3640	msedge.exe	84
PID 3640 wrote to memory of 1552	3640	msedge.exe	84
PID 3640 wrote to memory of 1552	3640	msedge.exe	84
PID 3640 wrote to memory of 1552	3640	msedge.exe	84
PID 3640 wrote to memory of 1552	3640	msedge.exe	84
PID 3640 wrote to memory of 1552	3640	msedge.exe	84
PID 3640 wrote to memory of 1552	3640	msedge.exe	84
PID 3640 wrote to memory of 1552	3640	msedge.exe	84
PID 3640 wrote to memory of 1552	3640	msedge.exe	84
PID 3640 wrote to memory of 1552	3640	msedge.exe	84
PID 3640 wrote to memory of 1552	3640	msedge.exe	84
PID 3640 wrote to memory of 1552	3640	msedge.exe	84
PID 3640 wrote to memory of 1552	3640	msedge.exe	84
PID 3640 wrote to memory of 1552	3640	msedge.exe	84
PID 3640 wrote to memory of 1552	3640	msedge.exe	84
PID 3640 wrote to memory of 1552	3640	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\redirect.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff954383cb8,0x7ff954383cc8,0x7ff954383cd8
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,15519169431810416486,9103499932490127435,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,15519169431810416486,9103499932490127435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,15519169431810416486,9103499932490127435,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 /prefetch:8
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15519169431810416486,9103499932490127435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15519169431810416486,9103499932490127435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15519169431810416486,9103499932490127435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,15519169431810416486,9103499932490127435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e681bda746d695b173a54033103efa8

SHA1
ae07be487e65914bb068174b99660fb8deb11a1d

SHA256
fee5f7377e5ca213c1d8d7827b788723d0dd2538e7ce3f35581fc613fde834c2

SHA512
0f4381c769d4ae18ff3ac93fd97e8d879043b8ec825611db27f08bd44c08babc1710672c3f93435a61e40db1ccbf5b74c6363aaaf5f4a7fc95a6a7786d1aced8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f081a02d8bbd5d800828ed8c769f5d9

SHA1
978d807096b7e7a4962a001b7bba6b2e77ce419a

SHA256
a7645e1b16115e9afec86efa139d35d5fecc6c5c7c59174c9901b4213b1fae0e

SHA512
7f3045f276f5bd8d3c65a23592419c3b98f1311c214c8e54a4dfe09122a08afb08ab7967b49bd413bc748ce6363658640bc87958d5e0a78974680a8f9beadf44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
ee176fe8152b9fc71a5f27f742a735b5

SHA1
0329f334fa97b69da6cab5f31e62abaf4792384e

SHA256
ba9471a14e170d27acf2c6c13ea3c17909b847a1ba0620f3db2db5933d432c3b

SHA512
7299b1eaf2167e46a52e34f8982b8663b07c60bc7f075bd24e268d1cf85f37f647e01b31d3b396abbfc702ba397178d8e3d945028fee28dbcdc6c135415613d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
9a81f3614041b057b9038400c747652b

SHA1
64470a40e71f7aad28667688463e0ab6022e70e1

SHA256
6a52446617eaed7ceb1469d3debded8657288759fb038d6f1c00e40424c30d6a

SHA512
96424e7f0f62abf51bbfe9f4f6f3269a03bf3a21ac54d52c2c62d3d857e05c68cafbdf14069b7f501b87d119ef0af6bc75bed24319b0b2168a175bcf0368e369

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9566eff505962c107921445ed6868354

SHA1
041cab74818b72f02b03fc8d4b81bb2bdfc18b79

SHA256
0f41597cf334a15beed1a540ae705cb627f8844b0b6ab476a49a22bdb17e636f

SHA512
6354e9419948acca953c7b14e6fe5b2a4612f950de66ba820b014ced90fdedbf1d9dc5c8bcfb517bd86b678cac977455edf5705f3cb190d7b0a700be3ea323af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
587f258a9e9df99b652e30e0e74d2755

SHA1
886b1e6fd9a9cd52d9a7ff580553ff27b91b135d

SHA256
ede8360053f6e33cddae9a7bb7077ec6a80c354313a3b5678574aef4e309b9db

SHA512
1e9fc05d42b2f2fd3acf19f178ce538c1076006d8eecbc8f6666c18551e5b16c9102cd87de20e899ee8f68f1199ef940f20cb25c5c8a1b7eb28cb1523c10d814

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7c0c218029196a22cae893f9448a5515

SHA1
1518e540b58213611dc3e33260d7e30fb96973e1

SHA256
23828601f2502a186de466de8edbcc9a127699253ba7b2f822757e97e9e3dd83

SHA512
c9efe004046a35f3e1cc8802db62268807bb379b1c60d1dba5232098229ff57f671c2a6524f5f6bdd22d7fa118026a7941f11807840bce5ab3827b46c2656780

Download Submit