661d3f465880ba56d3af8d6fc5d18b807921f1b4f4c4a48a5781ba4ccea2e049

Analysis

max time kernel
600s
max time network
447s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 03:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

9.0MB
MD5

aaea51a605688fcb2f178fd60e4ca64c
SHA1

69d4791bf3cfedb68bc4d8f766878103578171cb
SHA256

96837a4a521a61bd3d34f2f660e29902d228aaec501eeb2a84403f1926c3df9d
SHA512

d328bf2f9ff7372a716a09e5882b9e3c0051b0135412b3258453085db1de2c7699c8aae24edfaca7798f468802db975977c9976e19fca84fffe884bf8594c33e
SSDEEP

24576:h+QQf6Ox6x5n1nZwReXe1GmfL6k6T6W6r656+eGj/dBIp+:oAZeGLp

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
3352	msedge.exe
3352	msedge.exe
4436	identity_helper.exe
4436	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 852	3352	msedge.exe	89
PID 3352 wrote to memory of 852	3352	msedge.exe	89
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 3068	3352	msedge.exe	90
PID 3352 wrote to memory of 4048	3352	msedge.exe	91
PID 3352 wrote to memory of 4048	3352	msedge.exe	91
PID 3352 wrote to memory of 3016	3352	msedge.exe	92
PID 3352 wrote to memory of 3016	3352	msedge.exe	92
PID 3352 wrote to memory of 3016	3352	msedge.exe	92
PID 3352 wrote to memory of 3016	3352	msedge.exe	92
PID 3352 wrote to memory of 3016	3352	msedge.exe	92
PID 3352 wrote to memory of 3016	3352	msedge.exe	92
PID 3352 wrote to memory of 3016	3352	msedge.exe	92
PID 3352 wrote to memory of 3016	3352	msedge.exe	92
PID 3352 wrote to memory of 3016	3352	msedge.exe	92
PID 3352 wrote to memory of 3016	3352	msedge.exe	92
PID 3352 wrote to memory of 3016	3352	msedge.exe	92
PID 3352 wrote to memory of 3016	3352	msedge.exe	92
PID 3352 wrote to memory of 3016	3352	msedge.exe	92
PID 3352 wrote to memory of 3016	3352	msedge.exe	92
PID 3352 wrote to memory of 3016	3352	msedge.exe	92
PID 3352 wrote to memory of 3016	3352	msedge.exe	92
PID 3352 wrote to memory of 3016	3352	msedge.exe	92
PID 3352 wrote to memory of 3016	3352	msedge.exe	92
PID 3352 wrote to memory of 3016	3352	msedge.exe	92
PID 3352 wrote to memory of 3016	3352	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff855eb46f8,0x7ff855eb4708,0x7ff855eb4718
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,17767045244826325891,1900701940521055248,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,17767045244826325891,1900701940521055248,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,17767045244826325891,1900701940521055248,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17767045244826325891,1900701940521055248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17767045244826325891,1900701940521055248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,17767045244826325891,1900701940521055248,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,17767045244826325891,1900701940521055248,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17767045244826325891,1900701940521055248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17767045244826325891,1900701940521055248,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17767045244826325891,1900701940521055248,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17767045244826325891,1900701940521055248,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
43b12329962f9f670103004bf8ee4cde

SHA1
b9ffd944dd06cf1360085a1edbc666898a37fa12

SHA256
5443833dd70c116707d48162fcd13a3ba4f00da93b2cfd1fffdd23f477aac496

SHA512
c4f227fb87bd584665236f02ef62f3901a4c6e47578c5eb29382923ac655e458d7f381428822d521c6157193311fcae9de0af2b360a0fb5ba377fbceea0e9382

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ce3326502609b16c41f98b5d08808421

SHA1
5956157ee8a7a305126ec6ac49184fbd6ca4bec4

SHA256
4afdd052affa5cc6069886661a714ee7180e18d87fc419880741caed6447e086

SHA512
699733dde96189f6b74622dd673c866f2eba0c504bf8eef6234f499134d540186ebad60d1253740c841575bf6e0f865898640a75fc35327d7522cdc10dd56ce4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f5b8cdbf927c5e229b81768811f84ea9

SHA1
17f7db55b99dab32efc5eb8605e6d81f2fb6981e

SHA256
f222d8bb8ee13dbfbedeb65de4d4ec032292c5848ef3503be8d4a5bd1b0380ef

SHA512
652f4cd4c89f0966c56adfcfc8a288500beebe8dd5386f5d4190159fa8dd3b980bcd9c6f0390e950e4d1827ccf353d21159d233f26d654aa814f24f5fe6c4df2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
463f16e919aaaf29ff2ab8e22eead166

SHA1
e736de2119bc29a034baf390ec3f4c71d11e7d1e

SHA256
556f772f6f4e2920d3937f49eaae3599ef8da01b0175c3bdd12dfa548418e1a0

SHA512
e6d1261f9102e3e2691b40c76a7d4ddb834dd3ceb781b52ee7cbd72704658fa3e8ee1017da79be8628d75cd68e1f6d472f55cd04331f291c47430137d92a0c01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7b5bc04caeabe76c19dfb72b9e41f299

SHA1
986c4e999098c46b3b871f94b9e380433aa49662

SHA256
0c1e473c0bb883c7e862e013d862158031977d1ce6476741b908ddcc303ab069

SHA512
f7f41ec41c334ae25a34a7e86cb973222eec99c59fbf7186fd6390c47f6a4f4da98764d5d23814055b5e93c374bc8533d2e5bc6e4ac2f6551c171a15a6a029c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
be13b24be1712c3c37f1325ecfe736bc

SHA1
fae944dcb2ad3936abdaaf0dbeebbd46baf9445b

SHA256
281504c5b32bff0de77d46d373fa233f1e3bde3a57eefb079126d740d3e55e43

SHA512
0f5bdead9f6f163ff66ceb9866ddfac6662c3d0232de309a284d58c17a0b120e4d40bf975a5a2e72443d535d5a83120ffa46a3a3f0b4868c5d0cda47592307f8

Download Submit