hxxps://customervoice[.]microsoft[.]com/Pages/ResponsePage[.]aspx?id=cxOgNx1FRkmmGRNu98CzpbW7txlKQX9IhqDTE1KXiIdUOUU0R0sxNk9LN0Q5QUgxRllNMDVYUjdNUi4u

Analysis

max time kernel
145s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/09/2024, 18:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=cxOgNx1FRkmmGRNu98CzpbW7txlKQX9IhqDTE1KXiIdUOUU0R0sxNk9LN0Q5QUgxRllNMDVYUjdNUi4u

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe
368	msedge.exe
368	msedge.exe
4804	identity_helper.exe
4804	identity_helper.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 4844	368	msedge.exe	83
PID 368 wrote to memory of 4844	368	msedge.exe	83
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1840	368	msedge.exe	85
PID 368 wrote to memory of 1852	368	msedge.exe	86
PID 368 wrote to memory of 1852	368	msedge.exe	86
PID 368 wrote to memory of 1372	368	msedge.exe	87
PID 368 wrote to memory of 1372	368	msedge.exe	87
PID 368 wrote to memory of 1372	368	msedge.exe	87
PID 368 wrote to memory of 1372	368	msedge.exe	87
PID 368 wrote to memory of 1372	368	msedge.exe	87
PID 368 wrote to memory of 1372	368	msedge.exe	87
PID 368 wrote to memory of 1372	368	msedge.exe	87
PID 368 wrote to memory of 1372	368	msedge.exe	87
PID 368 wrote to memory of 1372	368	msedge.exe	87
PID 368 wrote to memory of 1372	368	msedge.exe	87
PID 368 wrote to memory of 1372	368	msedge.exe	87
PID 368 wrote to memory of 1372	368	msedge.exe	87
PID 368 wrote to memory of 1372	368	msedge.exe	87
PID 368 wrote to memory of 1372	368	msedge.exe	87
PID 368 wrote to memory of 1372	368	msedge.exe	87
PID 368 wrote to memory of 1372	368	msedge.exe	87
PID 368 wrote to memory of 1372	368	msedge.exe	87
PID 368 wrote to memory of 1372	368	msedge.exe	87
PID 368 wrote to memory of 1372	368	msedge.exe	87
PID 368 wrote to memory of 1372	368	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=cxOgNx1FRkmmGRNu98CzpbW7txlKQX9IhqDTE1KXiIdUOUU0R0sxNk9LN0Q5QUgxRllNMDVYUjdNUi4u
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce08f46f8,0x7ffce08f4708,0x7ffce08f4718
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,7493213999079232368,15149710128590737280,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,7493213999079232368,15149710128590737280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,7493213999079232368,15149710128590737280,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7493213999079232368,15149710128590737280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7493213999079232368,15149710128590737280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,7493213999079232368,15149710128590737280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,7493213999079232368,15149710128590737280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7493213999079232368,15149710128590737280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7493213999079232368,15149710128590737280,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7493213999079232368,15149710128590737280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7493213999079232368,15149710128590737280,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,7493213999079232368,15149710128590737280,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
3558f38f8eec6492cf90a795f133df3c

SHA1
15f46659d0b1aff569dbdc259e164f4a1b980311

SHA256
c666295337eaf3266e707e5e85a1f2ec9397bd3b89e27d4f6eb950f940cde272

SHA512
c57a3ffc9290859d1e430f91bee9f3e0d59a89870aed9bf9b8f0a5fe7c8e7f2e5566718e1d75f9cd7f6c716df2332250e0517c3820fd75424961e82c2519a49f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
581B

MD5
5db6be2746377cf06614ee217486de28

SHA1
590228a9d900e3c761733d16226a57515e765e38

SHA256
4ac65b595637f2b61b521b09ac12b9e066890b1b90bc596b0aa55016d9f9e6b2

SHA512
72f6938b10e17e946919a17a9e069726aa2e442ed72dc2f91bd91e646c3c512f8390d4aa9463ef04396fad87a1846a585a3445f6f7594b8674c68057df385d6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2b1ee20f8015447f33ff2760f2085518

SHA1
f90ab117ad2aede84315f14c5805c1f61d4a4dbe

SHA256
9b0207040abd7e42fc624e110f567b1b57dbbf2f80df1c4fcdfccdfcc7ae7939

SHA512
dbdd093e5104c26ecc392a8a0b735b541fc4733bbf595d8c3301aa48826824faedec4e9be35fba36db4060c5f6231f7151d604b5058071e02f347e6baaa11563

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3d22ff5eaa210d3cbc29915f6b4dba30

SHA1
66bb0357124de4bbcb7e3bea93b7b85bd724cdcf

SHA256
69199b1d17f73cea613d0deac83d21b480f9a36000f79c9989a490943b5dfe23

SHA512
22903f95dfa9edc31c4f241bc62eb6b6ea1525072e25870c7060eed276107d93ce51ae6135df1edba4181bcbd44fd790c6f413059dacf467dd67735b6aac5ee3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
04dc14caf07227506f0d59c718a823d6

SHA1
72704d7e31ba0057e3f0bd9272b7cd8f08b1c22d

SHA256
b6b7327dd35dac74e9d07a6d3227adaf2cc5ccdf6762323111d02314aa4fe979

SHA512
5fc71271c1a6625de55d58437e1a64353bb2cf60bf6d59b6ef2eb9f1679ecc1ad1ad1090d0c3e40e5158cb5d987aedc21dc4dfde61ca955c3d410911ee16ac25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583af1.TMP

Filesize
203B

MD5
053c7b49630a636d722bc35fd911084c

SHA1
016c05c2e2b75a33fd714c468e6fd0ab49acbcb5

SHA256
05375a16074930c4bace0022db90281e37f424a5314b31545e85f135f7c68af9

SHA512
b7137bcd9ae99116d7b0a4db9e19c8ea96491bdbe9844dad00367cb5d86e8a19074e38f4f5044f2e5c38c743f0ebea51e957c740a8003a4072ea7967db6d80d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c061ec9ebabff42a123215009caa57c0

SHA1
fb52dc8417c7a34fd1b592628965c31a4f5098d4

SHA256
ed5d3d0de72111245de3197fabed2c2819a6f3cb4cd789ea9763a682d79f0c26

SHA512
d4f4d972c11dc21a637629c52c9718749753b64538eb964d711ee4184fab94dd3f2f0c3a4c1a86fe508b3318e6e963c8bd778b425458eaf1a3c4a88719b5f915

Download Submit