3f8455fca4a5d4c59faf94f1bf44c08a561cb67b11f280c9e7785a22ecc42cb2

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-08-2024 12:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$_14326_/Help/help10.html
Size

4KB
MD5

6bbf3fec866f0f1718b99effa5b0c794
SHA1

94836e7ce34a148773b5bb37640a85cf5eb45bd6
SHA256

3ee782caf3f7aa490c5eb202da57d66cdea6c115c4d0127b9cc2d9c7fcbea710
SHA512

cb5c596f0ec2038fa69cab4947a1a773dadbfbf0ab507a212629f32862142203f184970d82382fbb58624c6a2c854380512a40ae767fd283cdcc172b3eb12981
SSDEEP

96:IPHCirYtmPkV6FY15S8vRX2Ic84rpgtMPyCJy:E+AoGraB

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1752	msedge.exe
1752	msedge.exe
1480	msedge.exe
1480	msedge.exe
4848	identity_helper.exe
4848	identity_helper.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 3968	1480	msedge.exe	83
PID 1480 wrote to memory of 3968	1480	msedge.exe	83
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 2104	1480	msedge.exe	84
PID 1480 wrote to memory of 1752	1480	msedge.exe	85
PID 1480 wrote to memory of 1752	1480	msedge.exe	85
PID 1480 wrote to memory of 3376	1480	msedge.exe	86
PID 1480 wrote to memory of 3376	1480	msedge.exe	86
PID 1480 wrote to memory of 3376	1480	msedge.exe	86
PID 1480 wrote to memory of 3376	1480	msedge.exe	86
PID 1480 wrote to memory of 3376	1480	msedge.exe	86
PID 1480 wrote to memory of 3376	1480	msedge.exe	86
PID 1480 wrote to memory of 3376	1480	msedge.exe	86
PID 1480 wrote to memory of 3376	1480	msedge.exe	86
PID 1480 wrote to memory of 3376	1480	msedge.exe	86
PID 1480 wrote to memory of 3376	1480	msedge.exe	86
PID 1480 wrote to memory of 3376	1480	msedge.exe	86
PID 1480 wrote to memory of 3376	1480	msedge.exe	86
PID 1480 wrote to memory of 3376	1480	msedge.exe	86
PID 1480 wrote to memory of 3376	1480	msedge.exe	86
PID 1480 wrote to memory of 3376	1480	msedge.exe	86
PID 1480 wrote to memory of 3376	1480	msedge.exe	86
PID 1480 wrote to memory of 3376	1480	msedge.exe	86
PID 1480 wrote to memory of 3376	1480	msedge.exe	86
PID 1480 wrote to memory of 3376	1480	msedge.exe	86
PID 1480 wrote to memory of 3376	1480	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\$_14326_\Help\help10.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffc7b446f8,0x7fffc7b44708,0x7fffc7b44718
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,17329221114983181388,16643023504627062568,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,17329221114983181388,16643023504627062568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,17329221114983181388,16643023504627062568,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,17329221114983181388,16643023504627062568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,17329221114983181388,16643023504627062568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,17329221114983181388,16643023504627062568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,17329221114983181388,16643023504627062568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,17329221114983181388,16643023504627062568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,17329221114983181388,16643023504627062568,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,17329221114983181388,16643023504627062568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,17329221114983181388,16643023504627062568,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,17329221114983181388,16643023504627062568,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4788 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
652217ad4128533ebe8789c1692ee17e

SHA1
7943933e302acd315acd3fb3a3bd4468eddd643d

SHA256
2439089271e8920fb089d9f217c4ac172fe0163054e19408f51f4fab124f8e50

SHA512
ece5f4cb16a24049dfc6b78f37666ea7d2a3e46a64eb750b80d70883e180a900c60f3c574d2c021130bcd9454f556698997e8281fa4ad662f5bfab957ca07201

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b6223f38-d94f-40d7-841f-cd53ad3863e3.tmp

Filesize
6KB

MD5
6e0ed04d39448a53e3899fc29efa30e6

SHA1
d477d5df6cdfa510c6224edeb541c9b9b00b5b8e

SHA256
2430f65467ba46d9746c07131d565b1f3266d462f1d0c82d628ea23cca7d4102

SHA512
60e7bc21acfc787382b9a6cc03624a6a3a1aebca75a9cd7b5b8c2d0637dd7a1b2442dd6fbbc2aa361339a4a7963ae4cdf2ff1f54c90462907c1af2f862097a67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
af209658a7ff96cf0176b1cf58699155

SHA1
d7e429663969d2edd0ab533a7470b6eae2e4efde

SHA256
884a958ef8a57ab5ed250bca3a96195973564fc76b4c9fc30f9c3eebe1a18ffd

SHA512
cabc04fed3786ac7f1b29a8991ef8d63773ab45a2b3d2efea7454a2dc826f8846f338c2da0006b17c3607a1fe208300015c3cc0457d3a895cfff061d3aaf447e

Download Submit