43a0186017502a5b7952ab682e354b29a8c474f4a6208c433fe4d41d08885ec6

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22-08-2024 11:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

php168_sharp_1220/upload/api/member_panel_jumper.html
Size

323B
MD5

736120dc93f6ab155317ddc1fde8c091
SHA1

3bd9130b4a25df8ea8d1c20204952a7852865cef
SHA256

2deca3b1ba296f091c7fc28ccc2f091a8f874e54d49e840e682e461f93c6aac4
SHA512

3e597327a165ee173cfef87f3994a3f34054cc9f02dbf1664843e62acd85bb0b3285d2fc84319b8df1767fdbad583a171fddf5cbc73ddb22593b51a520786841

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4204	msedge.exe
4204	msedge.exe
1072	msedge.exe
1072	msedge.exe
3608	identity_helper.exe
3608	identity_helper.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1072 msedge.exe
1072 msedge.exe
1072 msedge.exe
1072 msedge.exe
1072 msedge.exe
1072 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1072 wrote to memory of 556	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 556	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 1244	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 4204	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 4204	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 3204	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 3204	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 3204	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 3204	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 3204	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 3204	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 3204	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 3204	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 3204	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 3204	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 3204	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 3204	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 3204	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 3204	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 3204	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 3204	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 3204	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 3204	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 3204	1072	msedge.exe	msedge.exe
PID 1072 wrote to memory of 3204	1072	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\php168_sharp_1220\upload\api\member_panel_jumper.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde8c346f8,0x7ffde8c34708,0x7ffde8c34718
2⤵
PID:556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,5284970241658177593,5655206195932321487,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
2⤵
PID:1244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,5284970241658177593,5655206195932321487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,5284970241658177593,5655206195932321487,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
2⤵
PID:3204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5284970241658177593,5655206195932321487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
2⤵
PID:3776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5284970241658177593,5655206195932321487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
2⤵
PID:396

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,5284970241658177593,5655206195932321487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
2⤵
PID:3128

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,5284970241658177593,5655206195932321487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5284970241658177593,5655206195932321487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
2⤵
PID:2260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5284970241658177593,5655206195932321487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
2⤵
PID:2944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5284970241658177593,5655206195932321487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
2⤵
PID:1516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5284970241658177593,5655206195932321487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
2⤵
PID:2552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,5284970241658177593,5655206195932321487,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4596 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:404

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
5fe12a128fe4dfe955745478d6cb66fe

SHA1
9b77c6cac56a503d335354d38e07fbb9dfa6fd69

SHA256
4f92bce3fd80998e7026550523ebc4eb0eb00387e329f84e7bd04b05820f131e

SHA512
9671767ded817ba421ec3589c37ebcd793ae2d97564911035bb5774f4c85dcff01fb8a399594a4cb3d68266bf45ecb41611c450c4dc05d78b8d83ae0fe4fa5c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
470ee9020afeb6c560aad2e40dee7e99

SHA1
e032d9cd9643fc869657b73c256682485fc1f6fb

SHA256
df2f1f523e4655a93ef25a4392af4008a06c3b3ba357496ea55eddc056a35987

SHA512
d6e4b27358e4f5420bc807378920e6a0572c0ddcfbe5bd595c25cad9539b351443df3730c3368d7b1ef54778b613947c20321060568e2f17f32a771b44eff78b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
244c785ea6ff5c81733e579274e87c44

SHA1
5440a0a5e4c689da44bd535df89edfb0c231c9fd

SHA256
c4024349224b3d6d9e19f4b6c459757a3aa4d1b585e07cc3c7e210258f5bd7b7

SHA512
a67e1b3d01c7edae2a2b7e5ae75819d5b1ab86cf3b7e963d414c157e4685269b20c7e8b71efc547a352f0a8054a9576afb7645bf5ddc71312043a5d956dcb6d5

Download Submit
\??\pipe\LOCAL\crashpad_1072_AKUKUDMUPMDGSDYA
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit