7738a81df22a500dc1421acc5f6b3943bbe0d0290ccfca90d06983e9800ab82e

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 02:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

upload/data/tplcache/index.html
Size

1B
MD5

7215ee9c7d9dc229d2921a40e899ec5f
SHA1

b858cb282617fb0956d960215c8e84d1ccf909c6
SHA256

36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
SHA512

f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1180	msedge.exe
1180	msedge.exe
1524	msedge.exe
1524	msedge.exe
1240	identity_helper.exe
1240	identity_helper.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe
1252	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 3692	1524	msedge.exe	87
PID 1524 wrote to memory of 3692	1524	msedge.exe	87
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 3284	1524	msedge.exe	88
PID 1524 wrote to memory of 1180	1524	msedge.exe	89
PID 1524 wrote to memory of 1180	1524	msedge.exe	89
PID 1524 wrote to memory of 3760	1524	msedge.exe	90
PID 1524 wrote to memory of 3760	1524	msedge.exe	90
PID 1524 wrote to memory of 3760	1524	msedge.exe	90
PID 1524 wrote to memory of 3760	1524	msedge.exe	90
PID 1524 wrote to memory of 3760	1524	msedge.exe	90
PID 1524 wrote to memory of 3760	1524	msedge.exe	90
PID 1524 wrote to memory of 3760	1524	msedge.exe	90
PID 1524 wrote to memory of 3760	1524	msedge.exe	90
PID 1524 wrote to memory of 3760	1524	msedge.exe	90
PID 1524 wrote to memory of 3760	1524	msedge.exe	90
PID 1524 wrote to memory of 3760	1524	msedge.exe	90
PID 1524 wrote to memory of 3760	1524	msedge.exe	90
PID 1524 wrote to memory of 3760	1524	msedge.exe	90
PID 1524 wrote to memory of 3760	1524	msedge.exe	90
PID 1524 wrote to memory of 3760	1524	msedge.exe	90
PID 1524 wrote to memory of 3760	1524	msedge.exe	90
PID 1524 wrote to memory of 3760	1524	msedge.exe	90
PID 1524 wrote to memory of 3760	1524	msedge.exe	90
PID 1524 wrote to memory of 3760	1524	msedge.exe	90
PID 1524 wrote to memory of 3760	1524	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\upload\data\tplcache\index.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xc4,0x108,0x7ffb17ed46f8,0x7ffb17ed4708,0x7ffb17ed4718
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1533019486854127094,16701113929790848792,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,1533019486854127094,16701113929790848792,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,1533019486854127094,16701113929790848792,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1533019486854127094,16701113929790848792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1533019486854127094,16701113929790848792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,1533019486854127094,16701113929790848792,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,1533019486854127094,16701113929790848792,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1533019486854127094,16701113929790848792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4452 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1533019486854127094,16701113929790848792,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1533019486854127094,16701113929790848792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1533019486854127094,16701113929790848792,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1533019486854127094,16701113929790848792,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5652 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4ddc72e4799c7d1a9141d284b74395e9

SHA1
9a07dd6c48499ee19c2de943ad0b132b5fce21a1

SHA256
6fe2520fc24e30cb2ba263e917bf1ef10b52baafb89e0d9860453e89535a3050

SHA512
31a766108e8fd9ea116e9aa7bda6fbd1437d605746b88e99c398ffd715eaa076b447713aab3e3663ec50731e20fbd1b43ac72d818c31899741a639d39e6d6f4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
95ba47552eadca4de6f756c694f1836a

SHA1
2dbc00c95b4da8872774f79da9dfaacaa63564d1

SHA256
14ff1bb2b9afc14f581e39970cc708900c14f7f55ef3b371a59c5ee40cee6be6

SHA512
d06b2502ee63d6a79c7e57395998f1a5c39653935983b2d876802e2d86344f683ace226659288c78165d065a3b695c0ac25b81380de3fe2b1aa858e111a1c556

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ed9a958c-8233-4934-b489-d2677a21fd4d.tmp

Filesize
11KB

MD5
adb5bb28f273f78f30371e82d183364d

SHA1
ff05cc223c04dcfaacae2cdb9d2902a9e5c02b0f

SHA256
25ea655f64cb15807584aa9a271643b50a83092936133f688b2f00bbf9105af4

SHA512
54aad1693546bbf1747cd7562ebc4a48486ff372ff1e1af1926fda3cb97a81de06aa8c4dd560dccc608b40ef2abdedb7dd5761ec67b5663b321e8ce873c5bdcf

Download Submit