639c78d0f88dc9ac25b65348bca153c1556f8f0570b2e025850e335fdf736ec7

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

background.html
Size

2KB
MD5

88c3d606e81a68d856b1de54714a50ba
SHA1

a803ea0758d735719de6bc085c1a3426bcb693bb
SHA256

236fa6c710a6dc88f1685573c7c00669419c56f98a795b9926348763570fe7c3
SHA512

4fb6e49d62b98ebeb41cc2e9e42bfa0e14ba62ef970fd5d4e878e390df7094a9619f7528766badc10e9c609eb03923a9fb8d0bc8487c0a46e6bbd4c874231d76

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3824	msedge.exe
3824	msedge.exe
1020	msedge.exe
1020	msedge.exe
4072	identity_helper.exe
4072	identity_helper.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 3608	1020	msedge.exe	83
PID 1020 wrote to memory of 3608	1020	msedge.exe	83
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 4616	1020	msedge.exe	84
PID 1020 wrote to memory of 3824	1020	msedge.exe	85
PID 1020 wrote to memory of 3824	1020	msedge.exe	85
PID 1020 wrote to memory of 428	1020	msedge.exe	86
PID 1020 wrote to memory of 428	1020	msedge.exe	86
PID 1020 wrote to memory of 428	1020	msedge.exe	86
PID 1020 wrote to memory of 428	1020	msedge.exe	86
PID 1020 wrote to memory of 428	1020	msedge.exe	86
PID 1020 wrote to memory of 428	1020	msedge.exe	86
PID 1020 wrote to memory of 428	1020	msedge.exe	86
PID 1020 wrote to memory of 428	1020	msedge.exe	86
PID 1020 wrote to memory of 428	1020	msedge.exe	86
PID 1020 wrote to memory of 428	1020	msedge.exe	86
PID 1020 wrote to memory of 428	1020	msedge.exe	86
PID 1020 wrote to memory of 428	1020	msedge.exe	86
PID 1020 wrote to memory of 428	1020	msedge.exe	86
PID 1020 wrote to memory of 428	1020	msedge.exe	86
PID 1020 wrote to memory of 428	1020	msedge.exe	86
PID 1020 wrote to memory of 428	1020	msedge.exe	86
PID 1020 wrote to memory of 428	1020	msedge.exe	86
PID 1020 wrote to memory of 428	1020	msedge.exe	86
PID 1020 wrote to memory of 428	1020	msedge.exe	86
PID 1020 wrote to memory of 428	1020	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\background.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc372046f8,0x7ffc37204708,0x7ffc37204718
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,9395135328377718201,12475075757685936093,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,9395135328377718201,12475075757685936093,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,9395135328377718201,12475075757685936093,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9395135328377718201,12475075757685936093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9395135328377718201,12475075757685936093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,9395135328377718201,12475075757685936093,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,9395135328377718201,12475075757685936093,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9395135328377718201,12475075757685936093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4556 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9395135328377718201,12475075757685936093,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9395135328377718201,12475075757685936093,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9395135328377718201,12475075757685936093,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,9395135328377718201,12475075757685936093,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
99353cf0ecc1cba941e45a8c8414d00b

SHA1
040a9b9773e56e484e94b2db6eed332d13c01b67

SHA256
fd2cf24df2cf0b78998c748adf97bda0e85d9b057f54fee7100ebdc366ecbbb6

SHA512
925654158c068389591992fd5dbccb235c71ac8dcfd8a82af114c6c2aaa7c2ce10707608e075daaa210d95f357373c739afd9cccae9061d679885c494bccb2ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7042ec9bc887010f09b0eb1f794662aa

SHA1
6c81e808cb42174dbc2ee74449b3bb83d5cf1706

SHA256
5f27e80047f46ae3ba347bac41b7ea00be854233b48618a7e5962eb37c20a0ee

SHA512
7cdd3a602d43f8ed7f9338ea7b50a563d45b49de324a08f610f7fbb5b63d6fbd018259fa6a8703c77e2bac5570112d5d7ed603d77c27fbf3d0d30e80396c033a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dd83c89f1e5f152804e8e0fe5797fc5c

SHA1
a03937420b8dec10b5cf3bb3f2742b316fccf993

SHA256
7a60cce7d0a2e7cea160f8a2142f40087b0d92edf9ceb9d8855cf6080d4e8a88

SHA512
2deafcc2b7c419a8d11ab6f63710cb4451186b5d5eacc1947445617a5cb8fc146968a95f1de548ebb35bced2ad4d5954ca12c3c570716278801f2a61b89b2bdd

Download Submit