hxxp://zoominfo[.]com

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 08:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://zoominfo.com

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3644	msedge.exe
3644	msedge.exe
3732	msedge.exe
3732	msedge.exe
3904	identity_helper.exe
3904	identity_helper.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3732 wrote to memory of 4856	3732	msedge.exe	84
PID 3732 wrote to memory of 4856	3732	msedge.exe	84
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3164	3732	msedge.exe	85
PID 3732 wrote to memory of 3644	3732	msedge.exe	86
PID 3732 wrote to memory of 3644	3732	msedge.exe	86
PID 3732 wrote to memory of 2780	3732	msedge.exe	87
PID 3732 wrote to memory of 2780	3732	msedge.exe	87
PID 3732 wrote to memory of 2780	3732	msedge.exe	87
PID 3732 wrote to memory of 2780	3732	msedge.exe	87
PID 3732 wrote to memory of 2780	3732	msedge.exe	87
PID 3732 wrote to memory of 2780	3732	msedge.exe	87
PID 3732 wrote to memory of 2780	3732	msedge.exe	87
PID 3732 wrote to memory of 2780	3732	msedge.exe	87
PID 3732 wrote to memory of 2780	3732	msedge.exe	87
PID 3732 wrote to memory of 2780	3732	msedge.exe	87
PID 3732 wrote to memory of 2780	3732	msedge.exe	87
PID 3732 wrote to memory of 2780	3732	msedge.exe	87
PID 3732 wrote to memory of 2780	3732	msedge.exe	87
PID 3732 wrote to memory of 2780	3732	msedge.exe	87
PID 3732 wrote to memory of 2780	3732	msedge.exe	87
PID 3732 wrote to memory of 2780	3732	msedge.exe	87
PID 3732 wrote to memory of 2780	3732	msedge.exe	87
PID 3732 wrote to memory of 2780	3732	msedge.exe	87
PID 3732 wrote to memory of 2780	3732	msedge.exe	87
PID 3732 wrote to memory of 2780	3732	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://zoominfo.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc07546f8,0x7ffcc0754708,0x7ffcc0754718
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,13464057598311851106,10109147477863864888,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,13464057598311851106,10109147477863864888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,13464057598311851106,10109147477863864888,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13464057598311851106,10109147477863864888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13464057598311851106,10109147477863864888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13464057598311851106,10109147477863864888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,13464057598311851106,10109147477863864888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,13464057598311851106,10109147477863864888,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13464057598311851106,10109147477863864888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13464057598311851106,10109147477863864888,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13464057598311851106,10109147477863864888,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13464057598311851106,10109147477863864888,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,13464057598311851106,10109147477863864888,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
98d66b88db3f242c250b4e2ff6827c39

SHA1
218d5e2bf9fd73dc34220ab3a50064f2896ecb46

SHA256
f1c8278281a70014c8c7617116da0c49b2dfd4ea58e95c82519a5ed9ce547ecb

SHA512
baf65e8ab0e3e6d86611a8ef8cacaa3615a33a2bffb395141af1af2f557bf02fd3ad01ce8077982f8977331d630e1324e5b73687df92379b5175419819b22904

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
57c3bf3a70ff2837e2603db35c7ccf8c

SHA1
59511b3b3651e932e6be773028e64bcf7899188c

SHA256
a74207a95d5cbcfe97339fb7b26121b54471f0c2e50d78ea81a8555b1d07da6e

SHA512
af9dcd1a9267ecb7425f1c952f7d1eba5c9e0a714de1c96d325d3762e3ab01dd00cc3270aa9454b0d839a64d164d0f15e77fecccf19f3c701f8592a1ddce83d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d7062c600e60334df816131734c6f978

SHA1
49954812487d90861925d512bab4ba08344f0a2e

SHA256
435294b27313c23a358f3a32881bca6291b7094135e96ca307e3dc623f9316d9

SHA512
a80b64650d538ff484eba42c743fb649a1d43a9f85fb6276cbab688abac20e03a24f756e6700d4f9608f8cdc625b53aa7fe7068b9ab2c0303f2b02765f4fe724

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
afae231661c521ee514e19f4562e597c

SHA1
9d9ef34bd18fdface7f053e00d12649cf17926ce

SHA256
16856c0815b18be67f2e011b82ff59e0e3279ee1cd715876b2a34bc20665b639

SHA512
36896aced800575c3714ba50bc2260328d6bc1da35e68908cfc3baf986d54d6ee66b820435025ec7099c11d8448bfd1692218136a864b60fb1640df8192bc77e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8c8244d53a6523efb37941ed4b4ca074

SHA1
c28c5210a45610de5905d416875d22924c1d2ceb

SHA256
bb13569b06978fc0ccdea6e82ea253b7932c677444a2b00f8510ca391d205ae1

SHA512
6b0f63318e7ac643bf9f23ce0c58d0145d6584fdb993cf8e5667c72b4168e2e08bd8135029c794fa45c6ea3f52e94fc30c56eded60961d867eb400bd759d3ba4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
38b4bb9102103739b2f62077066379b7

SHA1
ee8347d38f1dedcb792be7166bd3007e375e6162

SHA256
420cc161a72544d774f324f0d70eabb580b627230952210e4a4fb59145904a63

SHA512
9a50cba44d48decd599226bee2012c155b19b13dc4a335e66000ab8b914ee8ba37fcc44d71be3ac140e0c7cc283da2c2296334d004927a60ec1d98b61728ec99

Download Submit