Analysis
-
max time kernel
145s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13-08-2024 17:06
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://nam.safelink.emails.azure.net/trackingfeedback/?p=bT1hMzQ0NThjMy1mNmNhLTQwNjYtOWI1MC1kZjliODc5NWQ2MDgmZj1Qb3NpdGl2ZSZiPWVuLXVzJmE9Ni8xNC8yMDI0IDQ6NTg6NTUgQU0mdT1hZW8%3D
Resource
win10v2004-20240802-en
General
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4496 msedge.exe 4496 msedge.exe 4212 msedge.exe 4212 msedge.exe 4724 identity_helper.exe 4724 identity_helper.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe 2184 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4212 wrote to memory of 1324 4212 msedge.exe 84 PID 4212 wrote to memory of 1324 4212 msedge.exe 84 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 2896 4212 msedge.exe 85 PID 4212 wrote to memory of 4496 4212 msedge.exe 86 PID 4212 wrote to memory of 4496 4212 msedge.exe 86 PID 4212 wrote to memory of 2916 4212 msedge.exe 87 PID 4212 wrote to memory of 2916 4212 msedge.exe 87 PID 4212 wrote to memory of 2916 4212 msedge.exe 87 PID 4212 wrote to memory of 2916 4212 msedge.exe 87 PID 4212 wrote to memory of 2916 4212 msedge.exe 87 PID 4212 wrote to memory of 2916 4212 msedge.exe 87 PID 4212 wrote to memory of 2916 4212 msedge.exe 87 PID 4212 wrote to memory of 2916 4212 msedge.exe 87 PID 4212 wrote to memory of 2916 4212 msedge.exe 87 PID 4212 wrote to memory of 2916 4212 msedge.exe 87 PID 4212 wrote to memory of 2916 4212 msedge.exe 87 PID 4212 wrote to memory of 2916 4212 msedge.exe 87 PID 4212 wrote to memory of 2916 4212 msedge.exe 87 PID 4212 wrote to memory of 2916 4212 msedge.exe 87 PID 4212 wrote to memory of 2916 4212 msedge.exe 87 PID 4212 wrote to memory of 2916 4212 msedge.exe 87 PID 4212 wrote to memory of 2916 4212 msedge.exe 87 PID 4212 wrote to memory of 2916 4212 msedge.exe 87 PID 4212 wrote to memory of 2916 4212 msedge.exe 87 PID 4212 wrote to memory of 2916 4212 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://nam.safelink.emails.azure.net/trackingfeedback/?p=bT1hMzQ0NThjMy1mNmNhLTQwNjYtOWI1MC1kZjliODc5NWQ2MDgmZj1Qb3NpdGl2ZSZiPWVuLXVzJmE9Ni8xNC8yMDI0IDQ6NTg6NTUgQU0mdT1hZW8%3D1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd39046f8,0x7ffdd3904708,0x7ffdd39047182⤵PID:1324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,2481415211624315535,14618822247076450228,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:22⤵PID:2896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,2481415211624315535,14618822247076450228,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,2481415211624315535,14618822247076450228,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:82⤵PID:2916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,2481415211624315535,14618822247076450228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:1052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,2481415211624315535,14618822247076450228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:1240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,2481415211624315535,14618822247076450228,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:82⤵PID:4768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,2481415211624315535,14618822247076450228,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,2481415211624315535,14618822247076450228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:12⤵PID:2768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,2481415211624315535,14618822247076450228,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:12⤵PID:4712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,2481415211624315535,14618822247076450228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:12⤵PID:4836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,2481415211624315535,14618822247076450228,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:12⤵PID:2128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,2481415211624315535,14618822247076450228,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3924 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2184
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4464
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4080
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d7114a6cd851f9bf56cf771c37d664a2
SHA1769c5d04fd83e583f15ab1ef659de8f883ecab8a
SHA256d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e
SHA51233bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8
-
Filesize
152B
MD5719923124ee00fb57378e0ebcbe894f7
SHA1cc356a7d27b8b27dc33f21bd4990f286ee13a9f9
SHA256aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808
SHA512a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc
-
Filesize
197B
MD5901794f5c190f009ed45d8c8b2b7628f
SHA1e9688dba91849ca8e3472d2da1d618f324c14aec
SHA2569a99f4073e7c35a909f42be9dea84220af11f7d8473e105727c67f0af8171c65
SHA51210dcc65d71584dfecffffb111379f0a0c1452db398f94f528de5bf7c37593e329f267550ccc78b1e314e12453b7c94615e44f4258642480c93b2575ef8335d0a
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
6KB
MD57279ed4a3d6980a9caa3182180071d53
SHA1b5b955fe9873e91838c816530f89a77980cb1bc7
SHA2565065f1df86a18d676a1d237b48ed18bd020c4be03aefd90f35fe65242df067f8
SHA51277bf70279de55526ffa17ac53f1cdf44362bd59380292463f8e94f1e652e2b3f422d8f5dcea429000c43a923761489e6106852feefbaf5150f6ed8d6c983f05a
-
Filesize
6KB
MD57a9722f51756153f1c46cbb544a2a3e9
SHA12637b63320c15ab17ca987ec7a595018f4529ca8
SHA256d49d3041c382878490af390933737892fd54d32c0ef4bf58e4129bbbac90174a
SHA512565d5ed8842fc6564972f571f10e29c35b5c821889c888998b4e8e34390947fdf058407cec0c3ea40318ac02e2a6725ddfcc39d6557b64289ed260af82bbd898
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD58249e9491855b294443d4f0bb5fe850e
SHA11a7c03332637b4721966b742b9c3381025a7e9c1
SHA25622a824649f7945d749d751c3438fb76b7f014a3027e09cff8f3f9eb90f0e4090
SHA512b6d6c8caca3a428f70d19ffddce9493fc5cdd7805e43391d9a91d4ef1ed6a4b33569029056edeccf50494f911de63abcbd75570e04b9fea9978ac4d370d4e211