dbd3768f5c9bbe98173aceb86602a631f614f5344321d10982262472f4615324

Analysis

max time kernel
145s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/08/2024, 13:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

渣渣房产程序/admins/templates/info_backup.html
Size

1KB
MD5

3b3c9430aa1bfe095a69cdd2e642b823
SHA1

d925ad728f6a850c8a9b8d7171a713883020b96d
SHA256

5949b6bf3c40eb253f756874d5994925b17e7d3af9995879bc8d11284f82139d
SHA512

d6878da95d6ee0844003e8642275b0ddb6bf07b16d37392346ef8f7952f449597e34372eb3861c3b9cda7f0efa1aa425022ef30f7255fb1b92794d95d2ad15ac

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3592	msedge.exe
3592	msedge.exe
1540	msedge.exe
1540	msedge.exe
4548	identity_helper.exe
4548	identity_helper.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 1836	1540	msedge.exe	85
PID 1540 wrote to memory of 1836	1540	msedge.exe	85
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 1636	1540	msedge.exe	86
PID 1540 wrote to memory of 3592	1540	msedge.exe	87
PID 1540 wrote to memory of 3592	1540	msedge.exe	87
PID 1540 wrote to memory of 1000	1540	msedge.exe	88
PID 1540 wrote to memory of 1000	1540	msedge.exe	88
PID 1540 wrote to memory of 1000	1540	msedge.exe	88
PID 1540 wrote to memory of 1000	1540	msedge.exe	88
PID 1540 wrote to memory of 1000	1540	msedge.exe	88
PID 1540 wrote to memory of 1000	1540	msedge.exe	88
PID 1540 wrote to memory of 1000	1540	msedge.exe	88
PID 1540 wrote to memory of 1000	1540	msedge.exe	88
PID 1540 wrote to memory of 1000	1540	msedge.exe	88
PID 1540 wrote to memory of 1000	1540	msedge.exe	88
PID 1540 wrote to memory of 1000	1540	msedge.exe	88
PID 1540 wrote to memory of 1000	1540	msedge.exe	88
PID 1540 wrote to memory of 1000	1540	msedge.exe	88
PID 1540 wrote to memory of 1000	1540	msedge.exe	88
PID 1540 wrote to memory of 1000	1540	msedge.exe	88
PID 1540 wrote to memory of 1000	1540	msedge.exe	88
PID 1540 wrote to memory of 1000	1540	msedge.exe	88
PID 1540 wrote to memory of 1000	1540	msedge.exe	88
PID 1540 wrote to memory of 1000	1540	msedge.exe	88
PID 1540 wrote to memory of 1000	1540	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\渣渣房产程序\admins\templates\info_backup.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe572246f8,0x7ffe57224708,0x7ffe57224718
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,2665901666818338128,6969548750436217193,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,2665901666818338128,6969548750436217193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1968,2665901666818338128,6969548750436217193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,2665901666818338128,6969548750436217193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,2665901666818338128,6969548750436217193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,2665901666818338128,6969548750436217193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,2665901666818338128,6969548750436217193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,2665901666818338128,6969548750436217193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,2665901666818338128,6969548750436217193,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,2665901666818338128,6969548750436217193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,2665901666818338128,6969548750436217193,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,2665901666818338128,6969548750436217193,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4668 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e407ef25f7d3c40fd0b1c361ac0d951f

SHA1
ff9d789e7ca632289ca4a9bb9b6943388b279016

SHA256
d08ccfafe01ae8760e93a168284345ec7f86bee9e4771f62caa06e10b1fcec98

SHA512
4e40993194acd3e4ae898528ea7f956453e1ceb0be1bc0bb880c163d1ec2938ba46e360d538f4ed633f6c1e7bca0e688c0ef3ba75c8349a9c88cd64a2cbdb3b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a213d72385dfc968d7868f62e51e6004

SHA1
b951ac30ee785b5a90aece68894a5344a42a7b2f

SHA256
19c50687a1232216a14ae8289dae6296eba5e34716447cce5604ad5aeb53a028

SHA512
4adf69b03abf3583759ef35866e0fe53acb2c9201f4fc6df63790955c95b0e7a127226dbb30eb1fd62dc073334dc5de329c0b7d315020baac41f360d4268fed7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6a264ffc47d7872e4bcbd291206a907b

SHA1
fffc75a291e5b3a5ddb9a42fd02e080f66a9764c

SHA256
5db097b041061a415ea434a0e69bc26e64571bc6c7e96c034b03c1111d339486

SHA512
dccd63589e88bac715fc58c6ab77f44fdabda247aea8e444d1ba445c056ef23a465ad72165e699ce3b71ec86c4504e07a73c8c7b791f9855d5b1a936af6d28c5

Download Submit