e4d899b71ba483dc9ccf5e66958e98a22efefb22f5c4980220f86679b366cdb4

Analysis

max time kernel
145s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 20:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lvxing360/data/static_title.html
Size

510B
MD5

ec0d0b573e88bbd18dfa309dbfeb4d9f
SHA1

38a3c24638ae42f119f36e20c3846763eb5a0d06
SHA256

533a21b6626eba780d384ad443937328dba73da09e3808f0a74f698f1a963595
SHA512

4b0d9cd9bb730c8cec50199be0b6a7e60774e354ef8ba0d38c4626f9ec20760a4a4019a02c68765cfc6dd07b37a61d59f80dcd9e6670cedbb86ef19cf42db4e8

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
2192	msedge.exe
2192	msedge.exe
3032	identity_helper.exe
3032	identity_helper.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe
2192	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 424	2192	msedge.exe	84
PID 2192 wrote to memory of 424	2192	msedge.exe	84
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 5016	2192	msedge.exe	86
PID 2192 wrote to memory of 4396	2192	msedge.exe	87
PID 2192 wrote to memory of 4396	2192	msedge.exe	87
PID 2192 wrote to memory of 2948	2192	msedge.exe	88
PID 2192 wrote to memory of 2948	2192	msedge.exe	88
PID 2192 wrote to memory of 2948	2192	msedge.exe	88
PID 2192 wrote to memory of 2948	2192	msedge.exe	88
PID 2192 wrote to memory of 2948	2192	msedge.exe	88
PID 2192 wrote to memory of 2948	2192	msedge.exe	88
PID 2192 wrote to memory of 2948	2192	msedge.exe	88
PID 2192 wrote to memory of 2948	2192	msedge.exe	88
PID 2192 wrote to memory of 2948	2192	msedge.exe	88
PID 2192 wrote to memory of 2948	2192	msedge.exe	88
PID 2192 wrote to memory of 2948	2192	msedge.exe	88
PID 2192 wrote to memory of 2948	2192	msedge.exe	88
PID 2192 wrote to memory of 2948	2192	msedge.exe	88
PID 2192 wrote to memory of 2948	2192	msedge.exe	88
PID 2192 wrote to memory of 2948	2192	msedge.exe	88
PID 2192 wrote to memory of 2948	2192	msedge.exe	88
PID 2192 wrote to memory of 2948	2192	msedge.exe	88
PID 2192 wrote to memory of 2948	2192	msedge.exe	88
PID 2192 wrote to memory of 2948	2192	msedge.exe	88
PID 2192 wrote to memory of 2948	2192	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\lvxing360\data\static_title.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe54e446f8,0x7ffe54e44708,0x7ffe54e44718
  2⤵
  PID:424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,17833703045770871446,8217958299534015014,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,17833703045770871446,8217958299534015014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2012 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,17833703045770871446,8217958299534015014,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17833703045770871446,8217958299534015014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17833703045770871446,8217958299534015014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,17833703045770871446,8217958299534015014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,17833703045770871446,8217958299534015014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17833703045770871446,8217958299534015014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17833703045770871446,8217958299534015014,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17833703045770871446,8217958299534015014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17833703045770871446,8217958299534015014,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,17833703045770871446,8217958299534015014,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7bbd312e78a4d26716797a12da833841

SHA1
68c25d474834453e7f5d95f1964a09cff38f52ea

SHA256
30c2d1f52757fb7cc1e799d2484edcd51d9042ff5136eca3e546b4406a715c5a

SHA512
da8806d8423fbbcb89b620c181dfd1303793d965cb8e46d5846a65770542670b56f75f55e60f508b37f4a94983d5f011ac04bec98820fe21e311ffa5b1f76627

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b2f19019339b9407ec1035979127b574

SHA1
07540f3bc27e0ddc192018bf8f38987490de5cd3

SHA256
a6bef83318430b8cb124242cbbe5e55970a3e6262fc7b938f35bc1ba0f4f579e

SHA512
22f6c11b8e38360aaf508567c3c66e27ff66d60b028f09151c965fbc51a3162ce18b5d73427799a338353d33dbafc340acbd19eff6fdceb7fb204cbdbd18d8df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
89bf57de756488bf1c0496513f572073

SHA1
e1ec0cb644d7faa6bbbad093087af0a6f5484607

SHA256
cd64cd82bfc8bc8edef197053c5a877c3d71a5b282df3a68ec1233fd32d99a99

SHA512
8fee628bf58c03f1893b165b06eba6f1eec57c1341c7e39b2407231a93ea4a14e8cdba2ad669ddba272b3b092f1198c51678ba2f9e0a95af1b951bb1643dd164

Download Submit