e9d67a2e057ca30600aa7c21e7026844238265755fc03f78a4fb78f7d0e48883

Analysis

max time kernel
145s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
16-08-2024 21:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$_2_/102.htm
Size

1KB
MD5

b8cb062dd7f8f714f032d926df2bc922
SHA1

cfd52e056e32c1cadf1f56f59d5c29945d16a42a
SHA256

11df7abbbff859eb6a889beca74a260d781b26a8f187fb0307afe786295aee03
SHA512

e324da062d368c974a55e9e35ec360012c015cef23086bedb1e28bfcf12ee94cd411e361dc13d400d3172cf5458c3ce16d2c423fad66cd9d45b4d896153f9607

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe
4124	msedge.exe
4124	msedge.exe
3504	identity_helper.exe
3504	identity_helper.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 3664	4124	msedge.exe	85
PID 4124 wrote to memory of 3664	4124	msedge.exe	85
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4984	4124	msedge.exe	86
PID 4124 wrote to memory of 4448	4124	msedge.exe	87
PID 4124 wrote to memory of 4448	4124	msedge.exe	87
PID 4124 wrote to memory of 1396	4124	msedge.exe	88
PID 4124 wrote to memory of 1396	4124	msedge.exe	88
PID 4124 wrote to memory of 1396	4124	msedge.exe	88
PID 4124 wrote to memory of 1396	4124	msedge.exe	88
PID 4124 wrote to memory of 1396	4124	msedge.exe	88
PID 4124 wrote to memory of 1396	4124	msedge.exe	88
PID 4124 wrote to memory of 1396	4124	msedge.exe	88
PID 4124 wrote to memory of 1396	4124	msedge.exe	88
PID 4124 wrote to memory of 1396	4124	msedge.exe	88
PID 4124 wrote to memory of 1396	4124	msedge.exe	88
PID 4124 wrote to memory of 1396	4124	msedge.exe	88
PID 4124 wrote to memory of 1396	4124	msedge.exe	88
PID 4124 wrote to memory of 1396	4124	msedge.exe	88
PID 4124 wrote to memory of 1396	4124	msedge.exe	88
PID 4124 wrote to memory of 1396	4124	msedge.exe	88
PID 4124 wrote to memory of 1396	4124	msedge.exe	88
PID 4124 wrote to memory of 1396	4124	msedge.exe	88
PID 4124 wrote to memory of 1396	4124	msedge.exe	88
PID 4124 wrote to memory of 1396	4124	msedge.exe	88
PID 4124 wrote to memory of 1396	4124	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\$_2_\102.htm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff07c146f8,0x7fff07c14708,0x7fff07c14718
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,3988028565193215986,955740257940019329,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,3988028565193215986,955740257940019329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,3988028565193215986,955740257940019329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3988028565193215986,955740257940019329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3988028565193215986,955740257940019329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,3988028565193215986,955740257940019329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,3988028565193215986,955740257940019329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3988028565193215986,955740257940019329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3988028565193215986,955740257940019329,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3988028565193215986,955740257940019329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3988028565193215986,955740257940019329,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,3988028565193215986,955740257940019329,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5512 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f97ff452abe714e85e73ffc871e677b7

SHA1
bd4b85f276b77e2e32e2e4daee332821a9bab5a8

SHA256
a7e1d0f04c96c61c3d1f25b0ac1bdbac24ba79bd4d56a8ffae9f1670a6a5e5eb

SHA512
5a98ef52f88080cc3f051995095089f685146da951e4b1cc052d1c436ebb4c7983ef4a758440717d02ed1fa55de70fa25582ec273e22960b51b8f5b72077431a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
77b40e7613c13da359837aad7dee24cc

SHA1
302ad790142175ba7da23c86ec4eaaa58e3c6899

SHA256
303160a5f4ba5ded23611e6c54214a6e71148e319200746396812fde7ee48db8

SHA512
f5d5fd36b4d782852347727f05c8bbb93c06ee45f81045b24084bc00aba4dad8bc9dc35c1fded6f1390e73b255c55d30be9d7de7fae2e8c9e03be20fcd2f04b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8c73403de58ba0e61e4d455753ae5b36

SHA1
3e76831be4ca30c14a980f88df02e8d758986b99

SHA256
feda552597bf72b9079ac5b814eddc6aa0881b2ecd677f18476b0b55d4c5fd9a

SHA512
db47ceccff7991a9147c7af259bc33a2828ec39ce82c558e7cc06c1307bacc63ebcdb2b728de7886b97acee1510f57c9387966e3af74017e3230e2614731332f

Download Submit