183160e943a1e0b38a07dc0d6fd775a32180bdee16cc5b5df90330276e95bd44

Analysis

max time kernel
481s
max time network
493s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-09-2024 15:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lib/ace/ace.html
Size

3KB
MD5

79d5cf1e15800d488db989da5b87fdcf
SHA1

ad8d17c3e438a669ec5c5a0c147bf6437fd35051
SHA256

a99c139fe372b396174d194e0f3577ee339f86954ae7416fa010b2a62787cb3a
SHA512

421f7a5519ba5e03aad5458f6773a38c8ccdd7c9be010fd1e5e80e7d76dc0a72299aefd958f55136debfb5d5786d7f3a68e019ec95cc8729f313e7ee78684685

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4556	msedge.exe
4556	msedge.exe
1840	msedge.exe
1840	msedge.exe
4424	identity_helper.exe
4424	identity_helper.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe
1840	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 756	1840	msedge.exe	83
PID 1840 wrote to memory of 756	1840	msedge.exe	83
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 1444	1840	msedge.exe	84
PID 1840 wrote to memory of 4556	1840	msedge.exe	85
PID 1840 wrote to memory of 4556	1840	msedge.exe	85
PID 1840 wrote to memory of 3680	1840	msedge.exe	86
PID 1840 wrote to memory of 3680	1840	msedge.exe	86
PID 1840 wrote to memory of 3680	1840	msedge.exe	86
PID 1840 wrote to memory of 3680	1840	msedge.exe	86
PID 1840 wrote to memory of 3680	1840	msedge.exe	86
PID 1840 wrote to memory of 3680	1840	msedge.exe	86
PID 1840 wrote to memory of 3680	1840	msedge.exe	86
PID 1840 wrote to memory of 3680	1840	msedge.exe	86
PID 1840 wrote to memory of 3680	1840	msedge.exe	86
PID 1840 wrote to memory of 3680	1840	msedge.exe	86
PID 1840 wrote to memory of 3680	1840	msedge.exe	86
PID 1840 wrote to memory of 3680	1840	msedge.exe	86
PID 1840 wrote to memory of 3680	1840	msedge.exe	86
PID 1840 wrote to memory of 3680	1840	msedge.exe	86
PID 1840 wrote to memory of 3680	1840	msedge.exe	86
PID 1840 wrote to memory of 3680	1840	msedge.exe	86
PID 1840 wrote to memory of 3680	1840	msedge.exe	86
PID 1840 wrote to memory of 3680	1840	msedge.exe	86
PID 1840 wrote to memory of 3680	1840	msedge.exe	86
PID 1840 wrote to memory of 3680	1840	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\lib\ace\ace.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdfad146f8,0x7ffdfad14708,0x7ffdfad14718
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,14775166655217068121,17621361984126614523,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,14775166655217068121,17621361984126614523,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,14775166655217068121,17621361984126614523,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14775166655217068121,17621361984126614523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14775166655217068121,17621361984126614523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,14775166655217068121,17621361984126614523,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,14775166655217068121,17621361984126614523,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14775166655217068121,17621361984126614523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14775166655217068121,17621361984126614523,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14775166655217068121,17621361984126614523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14775166655217068121,17621361984126614523,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,14775166655217068121,17621361984126614523,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5796 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5704d2243ff1265aff9ddc4e929b631d

SHA1
80f49cb020cdf59a9218c8e6ca4d3c85bc15cfed

SHA256
7c5c6e6d8eb25f98a5d5cd145dbd0ab6d0a9dc669f120a8ba7708e9a23e69dd8

SHA512
528293fe0e86ecbb41b15519f87eacf41bf997439013daa5d3c84113dc5a7e8d7b3049f70f84f7ce73fcb42ac01fbbc9dc6950f8b6912f64dbe52e657885147a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2cdae0f977344cad7549889e31680506

SHA1
13914118e91c514d291447f4471b0708b054c027

SHA256
11fa9a728458f1fa85f3ec561de03c62e59944882445512c03d2fb7689f7a938

SHA512
04b4e4b643e2da945ae4790fbe12796978b61fe69147a70c629eb832788cbd0a4123836327f5ba1a4f19bf275c5fa2e2521369a7cab6e0a1771d2842a8944bc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c686f8ffbca2aff9977032ff9a2a1ca3

SHA1
16e275310f90567ba4a2f4bda5976b71e648e266

SHA256
36dee21de71958c7bc27d780b904a13ddf39fb62fea4b5ad705d432705dddbbb

SHA512
c79e6ab5e3dde51d5311a40e1264702dce8f173648a141f126d5e2c83c7159d38031bdee6fbccc0bd7b6908fa2678b90aa2619a013c6bb88a865948599d7c0c5

Download Submit