hxxps://www[.]java[.]com/en/download/

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2024, 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.java.com/en/download/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe
216	msedge.exe
216	msedge.exe
3088	identity_helper.exe
3088	identity_helper.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe
5580	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe
216	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 4972	216	msedge.exe	84
PID 216 wrote to memory of 4972	216	msedge.exe	84
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4252	216	msedge.exe	85
PID 216 wrote to memory of 4180	216	msedge.exe	86
PID 216 wrote to memory of 4180	216	msedge.exe	86
PID 216 wrote to memory of 980	216	msedge.exe	87
PID 216 wrote to memory of 980	216	msedge.exe	87
PID 216 wrote to memory of 980	216	msedge.exe	87
PID 216 wrote to memory of 980	216	msedge.exe	87
PID 216 wrote to memory of 980	216	msedge.exe	87
PID 216 wrote to memory of 980	216	msedge.exe	87
PID 216 wrote to memory of 980	216	msedge.exe	87
PID 216 wrote to memory of 980	216	msedge.exe	87
PID 216 wrote to memory of 980	216	msedge.exe	87
PID 216 wrote to memory of 980	216	msedge.exe	87
PID 216 wrote to memory of 980	216	msedge.exe	87
PID 216 wrote to memory of 980	216	msedge.exe	87
PID 216 wrote to memory of 980	216	msedge.exe	87
PID 216 wrote to memory of 980	216	msedge.exe	87
PID 216 wrote to memory of 980	216	msedge.exe	87
PID 216 wrote to memory of 980	216	msedge.exe	87
PID 216 wrote to memory of 980	216	msedge.exe	87
PID 216 wrote to memory of 980	216	msedge.exe	87
PID 216 wrote to memory of 980	216	msedge.exe	87
PID 216 wrote to memory of 980	216	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.java.com/en/download/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff49446f8,0x7ffff4944708,0x7ffff4944718
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,12655051242061707049,8995988422453494946,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,12655051242061707049,8995988422453494946,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,12655051242061707049,8995988422453494946,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2124 /prefetch:8
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,12655051242061707049,8995988422453494946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,12655051242061707049,8995988422453494946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,12655051242061707049,8995988422453494946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,12655051242061707049,8995988422453494946,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,12655051242061707049,8995988422453494946,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,12655051242061707049,8995988422453494946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,12655051242061707049,8995988422453494946,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,12655051242061707049,8995988422453494946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,12655051242061707049,8995988422453494946,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,12655051242061707049,8995988422453494946,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3040 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
768B

MD5
a7190865f2cb975bacbf4a3a9f0240ca

SHA1
842f3915dbbfa2ac17881c2a3e86dd6d6c6534a9

SHA256
2aae739dcea58fdabf4faf7401d1c6d02aba8405eb6b4271e6f2ed25367b5dc2

SHA512
a0a7169c6847aa5c28312ae24f2db5ed7eeaf98fc7bea1e23854ad4a777a56e041911da59ac912bb750f4d6b19c7d9b66a2b78e83c2a5756554bd21d4d333991

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
654B

MD5
4dcefd3995b38ef0a5f3ad920cf09bfb

SHA1
18db60ecf2de45ed81cfc104e3475a2f6a129ed6

SHA256
27e7b62d4502fab7375b7652292c2fe5029963c8d60ce95d728102a9079e8ccd

SHA512
61a250a75272230cdb40e7645d9292a4a83649b2182c6c61019b661e2c0a628562bcf760b5689d3a0549da79343d360f127a860aa017750d2aff254dd0e8a7c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
56b9ebe96e23aeb21be9c026a97fbcbe

SHA1
8538730e6d6fccb7d5cda9beafbad1c0e74e30c0

SHA256
0ba610b481289541be01064579eab027ce61d60adc20cb22c5e8a7eb5eeaffc4

SHA512
15c1b08905cb5b40bd028671fcb51ea832edcd0ea7e587b60386239dfe5bca5b3beb154338587cbb704504f64e03c85c1cd7f173a0c3ea065d953eee691c415f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fa6af7bda1ccaf7f6b64ee3a74f8ae97

SHA1
5ebf4c852b95830bc61c995dec2c6ef43d740513

SHA256
6b2b0bf5be9504bb14337ff2cddfc92e80d088e17b1ae491486580e88d5d3a46

SHA512
9a21de5dda162c5ee73c89e249b183d2af4121bbec3ca4de1e60c2e155c14dec2b627d93bf8f65a9d52851842fb31f77759d5f16ec93dd67fd807154a502c120

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
df44e58f14c1f351990f89ee4cf4e527

SHA1
15da20fc341d9a9e8a35a40d587526a5f7b0b8b7

SHA256
e771baaabca2b42846d0b5719746eaa480b0ab0b69387976d7b60ba3b2dcb356

SHA512
3fbe65219d7d7c9917ca8f815149a39db62de6c136770e366644637a18039326d58b32b354c085cd3762b005a8d61b6bc635be5ebdbcf94d10fcf69568597de4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cd33.TMP

Filesize
1KB

MD5
d6f626785dab8669e73293adf40987b3

SHA1
a0b845d184b6603d1372f6c51061e75d24b61416

SHA256
583dca0fef6bf207b31d92be0d68a2ec17a8682d7b92847088712d34294fecb9

SHA512
5f1e07a00fb197a8adab5abf476623ff01331ad375f49659f0066687db4c645d2980b4ea1585ebe491c837fc1c38d614943afcf4161d60dcaf2e9b50e971b69e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
80a48ec1387de03320d01f5d8938500f

SHA1
71b430e621b651b7fe01d531ed8cc456f74687e2

SHA256
caea9d569adba66fa60206639337976abbe5b1402b9df3def434f37cd47eb28c

SHA512
fe58e8844b97529e0c926602c824e99153e9591fb6ca4c6cb715c340b373109be03f4ff91f094b234ecbff20c6b521daa4608f5e048566e8bee055207461d132

Download Submit