92e1564bda93d78c41c2c2898bfb3995fd9c2bd58753664231f71475baf69bd3

Analysis

max time kernel
145s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 16:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Kalkulator/B-517/pr2.html
Size

97B
MD5

e01708576230dd7d3a86dbf5aaf09b68
SHA1

c02ac3940c6705fa086d09b56967c144ba290a5e
SHA256

5bd80d73adcd9d7b77c17c799705a1b8189d6870117d8e7ba915a5f000144508
SHA512

354ac3fa87a90f710334e783a0bc9b76e37458a1513d516c75fdd7b15e9df383bfedb8a1abd2c81f8d1a8c363d03b1b4129e86c94b07233025c66b814eb61e6c

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3060	msedge.exe
3060	msedge.exe
2904	msedge.exe
2904	msedge.exe
4116	identity_helper.exe
4116	identity_helper.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2256	2904	msedge.exe	83
PID 2904 wrote to memory of 2256	2904	msedge.exe	83
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3512	2904	msedge.exe	85
PID 2904 wrote to memory of 3060	2904	msedge.exe	86
PID 2904 wrote to memory of 3060	2904	msedge.exe	86
PID 2904 wrote to memory of 3084	2904	msedge.exe	87
PID 2904 wrote to memory of 3084	2904	msedge.exe	87
PID 2904 wrote to memory of 3084	2904	msedge.exe	87
PID 2904 wrote to memory of 3084	2904	msedge.exe	87
PID 2904 wrote to memory of 3084	2904	msedge.exe	87
PID 2904 wrote to memory of 3084	2904	msedge.exe	87
PID 2904 wrote to memory of 3084	2904	msedge.exe	87
PID 2904 wrote to memory of 3084	2904	msedge.exe	87
PID 2904 wrote to memory of 3084	2904	msedge.exe	87
PID 2904 wrote to memory of 3084	2904	msedge.exe	87
PID 2904 wrote to memory of 3084	2904	msedge.exe	87
PID 2904 wrote to memory of 3084	2904	msedge.exe	87
PID 2904 wrote to memory of 3084	2904	msedge.exe	87
PID 2904 wrote to memory of 3084	2904	msedge.exe	87
PID 2904 wrote to memory of 3084	2904	msedge.exe	87
PID 2904 wrote to memory of 3084	2904	msedge.exe	87
PID 2904 wrote to memory of 3084	2904	msedge.exe	87
PID 2904 wrote to memory of 3084	2904	msedge.exe	87
PID 2904 wrote to memory of 3084	2904	msedge.exe	87
PID 2904 wrote to memory of 3084	2904	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Kalkulator\B-517\pr2.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd3ab646f8,0x7ffd3ab64708,0x7ffd3ab64718
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,14185223625099800109,10022555649072747418,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1956,14185223625099800109,10022555649072747418,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1956,14185223625099800109,10022555649072747418,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14185223625099800109,10022555649072747418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14185223625099800109,10022555649072747418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1956,14185223625099800109,10022555649072747418,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1956,14185223625099800109,10022555649072747418,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14185223625099800109,10022555649072747418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14185223625099800109,10022555649072747418,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14185223625099800109,10022555649072747418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,14185223625099800109,10022555649072747418,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,14185223625099800109,10022555649072747418,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b92971be0bd33df4eabff2074ad0b3aa

SHA1
8dd5045a840a5e4d3314b8e5a80d4843cabe9b21

SHA256
8f55aad4fad09fb884a1998b18271f659fb72d66ef35607d2fac118a5308bb7f

SHA512
6e56614b30602334cb5ac3b1278d680c208972562b07a485f9717424f1d1fc367c3f09c60cf3849c5d175c13ff1bc67fc67f9196a8195d1e192d0396e7a3f6d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
de2ab821ca0c5e23a7b05f8052d80b7d

SHA1
00eeffbebb5a4363c4b3625dbe521eecd3ef6867

SHA256
b1046d914f9180d9065014bbee6a9520adde2f571b93f9fef634c37782c246ab

SHA512
733912ce85d9b5e6a0858b6701d29a0f0ff8abc2dfb13f78996a816193e2a14406f9f406b07b5509e803a1a57651b61c37bd5153e5a2a37c62b4abadfe985f03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
75c4762b5e4badbaf5977a30afb56634

SHA1
de8566606af1db169cc29636d1f98a14597d9a51

SHA256
47773999c4fcefa14d524db824ceaf9f0e62fdcc96f8c3b5c6f2184122ac0608

SHA512
231b6fa1c7077ac48ca3a1ebb64f2177ff3e5b38ae587266c6ae23eb3bc5869d058270b14cf27b83c4984bf2cabe06e575479ded77e6f6201bce159345e551b7

Download Submit