4a15862e3e915052a502f2c37459aa5a581855fbf4e35346403992a36ded6a53

Analysis

max time kernel
92s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 17:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WinX/Group2/4 - Control Panel.lnk
Size

1KB
MD5

eb34fbc2cea6bdd695becc79bb33d6f0
SHA1

483d7910d5318a60d7cd4d8d40cc4931d8bb28cc
SHA256

7410d3bfdb7074fc067e2c46a9eeee283460cc988de050b3c51c355b862f1cb8
SHA512

f3f8b8a526c35ac9fda7c2cca4d79bbcbcbab22dd041bed413cabd6465bd62c3c1adc1d95cc700f3b133f3379542804448008414bee273bd952ebf69c1808fc6

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4312	msedge.exe
4312	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 3592	2204	msedge.exe	92
PID 2204 wrote to memory of 3592	2204	msedge.exe	92
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 2888	2204	msedge.exe	93
PID 2204 wrote to memory of 4312	2204	msedge.exe	94
PID 2204 wrote to memory of 4312	2204	msedge.exe	94
PID 2204 wrote to memory of 5020	2204	msedge.exe	95
PID 2204 wrote to memory of 5020	2204	msedge.exe	95
PID 2204 wrote to memory of 5020	2204	msedge.exe	95
PID 2204 wrote to memory of 5020	2204	msedge.exe	95
PID 2204 wrote to memory of 5020	2204	msedge.exe	95
PID 2204 wrote to memory of 5020	2204	msedge.exe	95
PID 2204 wrote to memory of 5020	2204	msedge.exe	95
PID 2204 wrote to memory of 5020	2204	msedge.exe	95
PID 2204 wrote to memory of 5020	2204	msedge.exe	95
PID 2204 wrote to memory of 5020	2204	msedge.exe	95
PID 2204 wrote to memory of 5020	2204	msedge.exe	95
PID 2204 wrote to memory of 5020	2204	msedge.exe	95
PID 2204 wrote to memory of 5020	2204	msedge.exe	95
PID 2204 wrote to memory of 5020	2204	msedge.exe	95
PID 2204 wrote to memory of 5020	2204	msedge.exe	95
PID 2204 wrote to memory of 5020	2204	msedge.exe	95
PID 2204 wrote to memory of 5020	2204	msedge.exe	95
PID 2204 wrote to memory of 5020	2204	msedge.exe	95
PID 2204 wrote to memory of 5020	2204	msedge.exe	95
PID 2204 wrote to memory of 5020	2204	msedge.exe	95

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\WinX\Group2\4 - Control Panel.lnk"
1⤵
- Modifies registry class
PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault4f08caa7h77c9h4a68h81c6h3a3fb7649dab
1⤵
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff8dfa746f8,0x7ff8dfa74708,0x7ff8dfa74718
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,16872285245304573463,17760127903381295654,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,16872285245304573463,17760127903381295654,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1972,16872285245304573463,17760127903381295654,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:5020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
63603e430261744a17ab2fa3b8b2b94b

SHA1
7ffba273c07cdeeba95a499f5bccd50dc3ab8dd0

SHA256
e847c9b2d6149ddbaed08dfd7f5918693110587233e1bae5a07ced2af1d78554

SHA512
ebf36286b866870d1f6a82fd08a28b107f3a6a47467c15e70c8d50996f71fed2dc9cfe560d8928e9d1120462d378e50969fecce890ddab427ae6a9bf3b8ab042

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
edca00864bb5696fdf1ff372975ff0f4

SHA1
fd2b948eab1c61c7a78a04e53191602c73b94d21

SHA256
7becd59fa287a6f1811fb6635a18e9c95b7d5c604aec22f768f58c9952c3201e

SHA512
ff14b83430f9b9f45a49a8774e5bcd46d4fdcc768b59b60670f7e2bc9a4a8d93fce926a01e66585414b6d790e3975832ad084315c05c238fee2c2625d608859b

Download Submit