hxxps://www[.]broninc[.]com/

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23-08-2024 20:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.broninc.com/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4936	msedge.exe
4936	msedge.exe
5020	msedge.exe
5020	msedge.exe
2524	identity_helper.exe
2524	identity_helper.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 1820	5020	msedge.exe	85
PID 5020 wrote to memory of 1820	5020	msedge.exe	85
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 964	5020	msedge.exe	86
PID 5020 wrote to memory of 4936	5020	msedge.exe	87
PID 5020 wrote to memory of 4936	5020	msedge.exe	87
PID 5020 wrote to memory of 928	5020	msedge.exe	88
PID 5020 wrote to memory of 928	5020	msedge.exe	88
PID 5020 wrote to memory of 928	5020	msedge.exe	88
PID 5020 wrote to memory of 928	5020	msedge.exe	88
PID 5020 wrote to memory of 928	5020	msedge.exe	88
PID 5020 wrote to memory of 928	5020	msedge.exe	88
PID 5020 wrote to memory of 928	5020	msedge.exe	88
PID 5020 wrote to memory of 928	5020	msedge.exe	88
PID 5020 wrote to memory of 928	5020	msedge.exe	88
PID 5020 wrote to memory of 928	5020	msedge.exe	88
PID 5020 wrote to memory of 928	5020	msedge.exe	88
PID 5020 wrote to memory of 928	5020	msedge.exe	88
PID 5020 wrote to memory of 928	5020	msedge.exe	88
PID 5020 wrote to memory of 928	5020	msedge.exe	88
PID 5020 wrote to memory of 928	5020	msedge.exe	88
PID 5020 wrote to memory of 928	5020	msedge.exe	88
PID 5020 wrote to memory of 928	5020	msedge.exe	88
PID 5020 wrote to memory of 928	5020	msedge.exe	88
PID 5020 wrote to memory of 928	5020	msedge.exe	88
PID 5020 wrote to memory of 928	5020	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.broninc.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff99b4946f8,0x7ff99b494708,0x7ff99b494718
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,4353842870806122550,4326202024419755791,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,4353842870806122550,4326202024419755791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,4353842870806122550,4326202024419755791,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4353842870806122550,4326202024419755791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4353842870806122550,4326202024419755791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2168,4353842870806122550,4326202024419755791,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4176 /prefetch:8
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,4353842870806122550,4326202024419755791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,4353842870806122550,4326202024419755791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4353842870806122550,4326202024419755791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4353842870806122550,4326202024419755791,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4353842870806122550,4326202024419755791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4353842870806122550,4326202024419755791,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,4353842870806122550,4326202024419755791,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5448 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3548

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4ec 0x4e4
1⤵
PID:1164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
1024KB

MD5
b319cb8750ff92e0748046ffda5c9ec1

SHA1
74d9162da009386b77b38ece3aec336ed13fdb7b

SHA256
4492eef377a3d981cf0dca5bc749317dc90fb0095d5184a6cc50350754d876e1

SHA512
7a0418eb9054e65b6d79f9a9577ba9265ffad67647f7d6589901feb4a202af6de034f4d0c9fa04dbfcceecd99b58e7e5348d72ef2dac8b87f4a303825750628a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
68e687f382a52e0e0a578de36542ae5d

SHA1
6a0070455989067dbe33f06bf0d825afbf090e68

SHA256
1c0bafce78e843d8c4d77e7a7a0ee313e64f110fe39ba76cd41cc5a8647b443a

SHA512
90032520635b929e891857e560ef9c58443f1f1a6fd274172b9c38e10136a2fa10edbc51bbb310ac4b1527f75da679d473d8b8edd839c3c3e814f9fc9f59b648

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
397B

MD5
7e8896a828f0e1abd46f02eb73c8806d

SHA1
a280a1e4dbcf4a5362cb822376d28b738a45287d

SHA256
d49116dd7063187e8df84e7ccf5f7c0a6aa57dc1bd9e0240bffb4d4c22607d74

SHA512
bf5d1c049401a9ff6b4af524c5ea51db4b9e11889ba1129e18c30f1fdb3e837ac00c06874dbb83d28543dbf7447a37a94d60e6c91e7c41c07046b30d0c0f9152

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1a0c298032ed6be3d6bb0da5c2a13612

SHA1
b93abddc4c1db18185b5157d0fee47861a0b7115

SHA256
ea2dd5251a76824ef730603fb5aaa66019aae33faaa9bb8ebfa0e76ac9d0d652

SHA512
f42d62102d5aa1f76c015af6212c737a78c6fe1b0b7491e79edef332ba37306954253b55322f61409d0f128a7022355caa986094c417e322f356fd99824adeac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bb025568c3263a66a96476e54397b511

SHA1
37690ecf768e2bcb31d7a0f320512acbe93724e8

SHA256
9ea3347f2519990ced8fca2e7f71b723236f379fbb3de6b15e6eda76db6144eb

SHA512
9246808cd63f79ad3d1569c4ffb4de3ef4710ec633507a9a82107850f415d7a55f5f1df0ac71757b05edbbec98e5d1a2d6dce693d9f7b0cd12f0b04e7a71ad02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ae4c379345c8756a7bf4a1d5bf0aaa22

SHA1
efdd8f36ca200827e6f6d56a80fdc37bf23f3818

SHA256
5a3dbd58a89ce152d8aff2524a3a94049066f45adaca505e7acc858af81399b6

SHA512
7966cc3bb613e6688552db71a39bd292dbd374129232fe008fa85404ad697d577443985e18506f52f38ba3e736dc59aa7cf064510536c0aabbeb0136987d66ee

Download Submit