41f8177b4b441a17e91bdcb6f4d95cc0673cf8e71ee522f30cf5e4a44e28b0fe

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 19:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

page - копия.html
Size

3KB
MD5

82757adf4e4045ec624286eeddd5a3fd
SHA1

da87ae9eb975bcf29bdf67794aabdef95d0bd768
SHA256

84bc19d6cac738a89d2ceba04769fe91d52a587254536245d3581372cf82ddc5
SHA512

d5e2c4816aaee8645537c90f6888b039cb93c17896b732bddb6ce86ef21d39de3c83acb17b2657ab87c096288cf1f411dbbb7356c1b6aeef927d7843e7ebbf5b

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2568	msedge.exe
2568	msedge.exe
548	msedge.exe
548	msedge.exe
2236	identity_helper.exe
2236	identity_helper.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 5044	548	msedge.exe	84
PID 548 wrote to memory of 5044	548	msedge.exe	84
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 3688	548	msedge.exe	85
PID 548 wrote to memory of 2568	548	msedge.exe	86
PID 548 wrote to memory of 2568	548	msedge.exe	86
PID 548 wrote to memory of 4880	548	msedge.exe	87
PID 548 wrote to memory of 4880	548	msedge.exe	87
PID 548 wrote to memory of 4880	548	msedge.exe	87
PID 548 wrote to memory of 4880	548	msedge.exe	87
PID 548 wrote to memory of 4880	548	msedge.exe	87
PID 548 wrote to memory of 4880	548	msedge.exe	87
PID 548 wrote to memory of 4880	548	msedge.exe	87
PID 548 wrote to memory of 4880	548	msedge.exe	87
PID 548 wrote to memory of 4880	548	msedge.exe	87
PID 548 wrote to memory of 4880	548	msedge.exe	87
PID 548 wrote to memory of 4880	548	msedge.exe	87
PID 548 wrote to memory of 4880	548	msedge.exe	87
PID 548 wrote to memory of 4880	548	msedge.exe	87
PID 548 wrote to memory of 4880	548	msedge.exe	87
PID 548 wrote to memory of 4880	548	msedge.exe	87
PID 548 wrote to memory of 4880	548	msedge.exe	87
PID 548 wrote to memory of 4880	548	msedge.exe	87
PID 548 wrote to memory of 4880	548	msedge.exe	87
PID 548 wrote to memory of 4880	548	msedge.exe	87
PID 548 wrote to memory of 4880	548	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\page - копия.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe746446f8,0x7ffe74644708,0x7ffe74644718
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,11073177424331966562,4403825412917235755,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,11073177424331966562,4403825412917235755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,11073177424331966562,4403825412917235755,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11073177424331966562,4403825412917235755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11073177424331966562,4403825412917235755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,11073177424331966562,4403825412917235755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4084 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,11073177424331966562,4403825412917235755,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11073177424331966562,4403825412917235755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11073177424331966562,4403825412917235755,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11073177424331966562,4403825412917235755,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,11073177424331966562,4403825412917235755,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,11073177424331966562,4403825412917235755,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4856 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
57be5a361e7e11ede6efed6f3ac3d0fa

SHA1
76909d9941846809ae5b4b480b7c64387acc35b1

SHA256
66aee18f6afe86c9d04fe97546df17548521d8d7877c29215c83e02d2f98ae1d

SHA512
df073ba72279a85746bcfc2ed9f81397196b19775d16f15714ba615f5e03237ae484be2b6f1d78edb6d39da4ae148ffd2ad43a7604ddfac8cf2949b3a50ef7de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2fd61971491a79b35347ac31bdc91225

SHA1
86a122192778bee631fd2c455c8704f12b347d49

SHA256
65788cf166eec0ed21e0ec14bdeff2639cda4d1ffcda224e1bdd69dc93060137

SHA512
10de087790a9c2fe903b0de8a2436bc6e91d3b3a95dd1fbcca10c42813c7469adaa5b2d4875436dac9fbd7df73e86225d52c1e6c8695d56e330a98856430eb01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0a32794c6a89b4c357be22ca14bffd09

SHA1
b4c4f6c6f1e6265fb6bc5d436021530e60b811ab

SHA256
352add943e7ca7c269ed9432d2d0402e409db173e9e798abc5532a7a00f4081a

SHA512
1faad471f5416c585fdf417ab947291cf966247681aeaf26b675a66636629fc2b7d436236fe076dd4e457f8ba1558fd80188574ec07bce9dd18d027618b3946f

Download Submit