19e74ffb1c983bac0aa542286c01737cd22131d88275f6c0039752717173396b

Analysis

max time kernel
145s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 10:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

文章系统(自动生成技术标)/UntitledFrame-6.html
Size

615B
MD5

3216ba7b20960a0f8542fa1faaaa2fa4
SHA1

49421fb6c5b635da5cdda16e92a120e6d8b553d2
SHA256

43809bd240bc4bb0f4b86d17085e04b0e32b7cddcd07313643f7be2ead63ada7
SHA512

df751a447f4735251aa1ace606d5b91d5555c08da70fd49db74ad7923c21852c87bf6e5e58e2a42cf6179372ef0400793b89981680c32ee0413aa169fab25e42

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1628	msedge.exe
1628	msedge.exe
2804	msedge.exe
2804	msedge.exe
464	identity_helper.exe
464	identity_helper.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 736	2804	msedge.exe	84
PID 2804 wrote to memory of 736	2804	msedge.exe	84
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 32	2804	msedge.exe	86
PID 2804 wrote to memory of 1628	2804	msedge.exe	87
PID 2804 wrote to memory of 1628	2804	msedge.exe	87
PID 2804 wrote to memory of 1352	2804	msedge.exe	88
PID 2804 wrote to memory of 1352	2804	msedge.exe	88
PID 2804 wrote to memory of 1352	2804	msedge.exe	88
PID 2804 wrote to memory of 1352	2804	msedge.exe	88
PID 2804 wrote to memory of 1352	2804	msedge.exe	88
PID 2804 wrote to memory of 1352	2804	msedge.exe	88
PID 2804 wrote to memory of 1352	2804	msedge.exe	88
PID 2804 wrote to memory of 1352	2804	msedge.exe	88
PID 2804 wrote to memory of 1352	2804	msedge.exe	88
PID 2804 wrote to memory of 1352	2804	msedge.exe	88
PID 2804 wrote to memory of 1352	2804	msedge.exe	88
PID 2804 wrote to memory of 1352	2804	msedge.exe	88
PID 2804 wrote to memory of 1352	2804	msedge.exe	88
PID 2804 wrote to memory of 1352	2804	msedge.exe	88
PID 2804 wrote to memory of 1352	2804	msedge.exe	88
PID 2804 wrote to memory of 1352	2804	msedge.exe	88
PID 2804 wrote to memory of 1352	2804	msedge.exe	88
PID 2804 wrote to memory of 1352	2804	msedge.exe	88
PID 2804 wrote to memory of 1352	2804	msedge.exe	88
PID 2804 wrote to memory of 1352	2804	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\文章系统(自动生成技术标)\UntitledFrame-6.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb70f746f8,0x7ffb70f74708,0x7ffb70f74718
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,12433682938069109571,12280233352138045648,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,12433682938069109571,12280233352138045648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,12433682938069109571,12280233352138045648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12433682938069109571,12280233352138045648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12433682938069109571,12280233352138045648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,12433682938069109571,12280233352138045648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,12433682938069109571,12280233352138045648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12433682938069109571,12280233352138045648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12433682938069109571,12280233352138045648,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12433682938069109571,12280233352138045648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,12433682938069109571,12280233352138045648,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,12433682938069109571,12280233352138045648,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3076 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ffd7011b011cc8c926762a8439246665

SHA1
e9f49a6814d8c85260a75bc0e0a131d95bcc7e3e

SHA256
7cc9abb75315fbac9293996a3d0b0d57f8c5e4a939ab69856e322c918f6a4a02

SHA512
b9a3ef7bd0cc3da3c30c0588ccfd656fd2269d92a02f71001b5fa5b57a67f112341a786b8ab677226445582f932702e5ad8e645a5451e6c5348bb41d52e0003f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7c9efc06d015df4232f74cd2e3b85c88

SHA1
212ec4fa122fc1ea2c1a05340fb708f7b828685a

SHA256
eaafb366ad4b4fa5a337468fb6e7f0166c296c4e5dae632d4d9d26cfcb573f59

SHA512
8ef7115b9e924978d6ff6967f577c839e52cb4151234fba828976ffc57cecb4ca7f35af13416dfa23c18eb3806f04ad7bd526f0733a703ed6ca24b31735fcf3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fbca6ef32c9cb38c2c7812b83bf25269

SHA1
b4f7d46f8fafc8e63e58cce056aeb289b538e479

SHA256
efbaf160427e1680004cbe1420f75be2d736bb6d1bec7647282e116ed7795488

SHA512
517af8bb3ad7ead6e813b3c83bcfb00cfe784ce1a9316d28fea174e5abf573f79eab1b20719207742ccf7b873c868faf4482b835a0da8ebf32e87e5022969cd4

Download Submit