47961c394d3b03bd1670e702b2ac59071dc54535657c82772e08e0a2d767b7c4

Analysis

max time kernel
1150s
max time network
1158s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
10/08/2024, 13:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

mineways/docs/textures.html
Size

44KB
MD5

485f286c1f29bbaf44f6ab6d8d24329b
SHA1

64712184125a61db82df47d3920e5eecbe94114f
SHA256

e8a7780a3adde7b59a18d71995f28a56fe3d793ffd6edceb29c4d3b3363ec2c5
SHA512

8263311c5a3e7719f285ead94cfefff838d42532b73b3e984fdb2bfd0bba52dca24a3002b30e408fbcffa1528decdc5fb865e8022287b61f6d45e3cbf1d8d3fe
SSDEEP

768:ZGizZ3lS1/ZFPsoszrSmUJ880f1T8BKhbIj1CrN4Ef5CKXEG7uHdcy:IsZV+3UosHSRC80f1T8ohsjgp4ExCKXW

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3632	msedge.exe
3632	msedge.exe
4016	msedge.exe
4016	msedge.exe
3500	msedge.exe
3500	msedge.exe
4840	identity_helper.exe
4840	identity_helper.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe
856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 4512	4016	msedge.exe	81
PID 4016 wrote to memory of 4512	4016	msedge.exe	81
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3628	4016	msedge.exe	82
PID 4016 wrote to memory of 3632	4016	msedge.exe	83
PID 4016 wrote to memory of 3632	4016	msedge.exe	83
PID 4016 wrote to memory of 1628	4016	msedge.exe	84
PID 4016 wrote to memory of 1628	4016	msedge.exe	84
PID 4016 wrote to memory of 1628	4016	msedge.exe	84
PID 4016 wrote to memory of 1628	4016	msedge.exe	84
PID 4016 wrote to memory of 1628	4016	msedge.exe	84
PID 4016 wrote to memory of 1628	4016	msedge.exe	84
PID 4016 wrote to memory of 1628	4016	msedge.exe	84
PID 4016 wrote to memory of 1628	4016	msedge.exe	84
PID 4016 wrote to memory of 1628	4016	msedge.exe	84
PID 4016 wrote to memory of 1628	4016	msedge.exe	84
PID 4016 wrote to memory of 1628	4016	msedge.exe	84
PID 4016 wrote to memory of 1628	4016	msedge.exe	84
PID 4016 wrote to memory of 1628	4016	msedge.exe	84
PID 4016 wrote to memory of 1628	4016	msedge.exe	84
PID 4016 wrote to memory of 1628	4016	msedge.exe	84
PID 4016 wrote to memory of 1628	4016	msedge.exe	84
PID 4016 wrote to memory of 1628	4016	msedge.exe	84
PID 4016 wrote to memory of 1628	4016	msedge.exe	84
PID 4016 wrote to memory of 1628	4016	msedge.exe	84
PID 4016 wrote to memory of 1628	4016	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\mineways\docs\textures.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff901583cb8,0x7ff901583cc8,0x7ff901583cd8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1812,18056062663964509499,9921368374862019041,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1844 /prefetch:2
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1812,18056062663964509499,9921368374862019041,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1812,18056062663964509499,9921368374862019041,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,18056062663964509499,9921368374862019041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,18056062663964509499,9921368374862019041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,18056062663964509499,9921368374862019041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,18056062663964509499,9921368374862019041,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,18056062663964509499,9921368374862019041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,18056062663964509499,9921368374862019041,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1812,18056062663964509499,9921368374862019041,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1812,18056062663964509499,9921368374862019041,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1812,18056062663964509499,9921368374862019041,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5024 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e681bda746d695b173a54033103efa8

SHA1
ae07be487e65914bb068174b99660fb8deb11a1d

SHA256
fee5f7377e5ca213c1d8d7827b788723d0dd2538e7ce3f35581fc613fde834c2

SHA512
0f4381c769d4ae18ff3ac93fd97e8d879043b8ec825611db27f08bd44c08babc1710672c3f93435a61e40db1ccbf5b74c6363aaaf5f4a7fc95a6a7786d1aced8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f081a02d8bbd5d800828ed8c769f5d9

SHA1
978d807096b7e7a4962a001b7bba6b2e77ce419a

SHA256
a7645e1b16115e9afec86efa139d35d5fecc6c5c7c59174c9901b4213b1fae0e

SHA512
7f3045f276f5bd8d3c65a23592419c3b98f1311c214c8e54a4dfe09122a08afb08ab7967b49bd413bc748ce6363658640bc87958d5e0a78974680a8f9beadf44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
183B

MD5
9e1275231d0007b3a42906cdadb34ea6

SHA1
de552221fd88afa25f6cdeceed2c825d4b40e41e

SHA256
3ac46af51f438f21927049f96db54e3060b81606bc3c1acfae0e125ac5c530e8

SHA512
5db406df1b09a4bc46c299deb653b949ab1dc6701977c5d964d1969333ea620585a5773ab3557ca87d19d18727e040a38285aca132828ff3491bb40a1dbee521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5b7bfd8c878eb5eb5a5cd919003a6c4c

SHA1
c2eb471d5c61bdce8a912079d56b56cd894d894a

SHA256
a08292a6eafb22a3d6e4e75cb3e0bffcf227c692b8a828c03bbb91e54ea4a169

SHA512
8e8c8ae5a2e2deab4f4e90b67e37031b69ff50dd8d2c32c94432d7f14e9f1c4403c9efc01ab047583b2121bda67264691fc0b37bae2f64d1b5472dfa2f98e6ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c4457d15762a2568e9e6e3f81a346ebf

SHA1
4e3d815d1318838fb3ef83bae3b34e374cb93ad6

SHA256
1b242b6f6c8733741dc3199ccc0e7e2dd06bca9b7769acbcb844c03a50c5c930

SHA512
4caf204167883e000092e502336c2f38c3509d8e5cce072a5a725104f709538f037a40ee1aa286f9324f07ac88a98b43ebc547bc0909e061102a54a5907bc674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b1d942b7f21d2a612cec381c0914296b

SHA1
4183d9cba221730f50a61d8ee0721d45c28a3d73

SHA256
e6e30294626cdcae7ffd1adf42b1a8ef61365c9242283794bbc1bc03c76ee0bd

SHA512
2e439721a67a4caacebd72c5c0dfca0703414eb8f1cea249704b056140be9fb837ae044ba85d8429cb723e9e5b829097def8627cf933e8667e79941017e2a8f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f1b286d66fe748d8fd3bbdd5e2b590f0

SHA1
c208c3a4bceb7d345a2574596a4cbde607945528

SHA256
ad4e2828a1cbfc967364e8b4916f2513afbf3ee756068006c9b71d0cb795ffa9

SHA512
81e5b285796090808e00b7ed6ab149bc2d01da8f54d6268cf5f156126c109e87c396690c68025a15a775de221ca6f21e15ffa455331d53db087e521e9b0d9c95

Download Submit