e8f4c775fae9142fbd5d05be825c412f95df7c19cf93b3bac543a746fba0aa07

Resubmissions

13/09/2024, 18:55

240913-xk562asfln 10

13/09/2024, 18:44

240913-xdq4jasgjd 10

Analysis

max time kernel
146s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 18:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Wave/LICENSES.chromium.html
Size

9.0MB
MD5

aaea51a605688fcb2f178fd60e4ca64c
SHA1

69d4791bf3cfedb68bc4d8f766878103578171cb
SHA256

96837a4a521a61bd3d34f2f660e29902d228aaec501eeb2a84403f1926c3df9d
SHA512

d328bf2f9ff7372a716a09e5882b9e3c0051b0135412b3258453085db1de2c7699c8aae24edfaca7798f468802db975977c9976e19fca84fffe884bf8594c33e
SSDEEP

24576:h+QQf6Ox6x5n1nZwReXe1GmfL6k6T6W6r656+eGj/dBIp+:oAZeGLp

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
312	msedge.exe
312	msedge.exe
4268	msedge.exe
4268	msedge.exe
752	identity_helper.exe
752	identity_helper.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 1300	4268	msedge.exe	84
PID 4268 wrote to memory of 1300	4268	msedge.exe	84
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 4768	4268	msedge.exe	87
PID 4268 wrote to memory of 312	4268	msedge.exe	88
PID 4268 wrote to memory of 312	4268	msedge.exe	88
PID 4268 wrote to memory of 3244	4268	msedge.exe	89
PID 4268 wrote to memory of 3244	4268	msedge.exe	89
PID 4268 wrote to memory of 3244	4268	msedge.exe	89
PID 4268 wrote to memory of 3244	4268	msedge.exe	89
PID 4268 wrote to memory of 3244	4268	msedge.exe	89
PID 4268 wrote to memory of 3244	4268	msedge.exe	89
PID 4268 wrote to memory of 3244	4268	msedge.exe	89
PID 4268 wrote to memory of 3244	4268	msedge.exe	89
PID 4268 wrote to memory of 3244	4268	msedge.exe	89
PID 4268 wrote to memory of 3244	4268	msedge.exe	89
PID 4268 wrote to memory of 3244	4268	msedge.exe	89
PID 4268 wrote to memory of 3244	4268	msedge.exe	89
PID 4268 wrote to memory of 3244	4268	msedge.exe	89
PID 4268 wrote to memory of 3244	4268	msedge.exe	89
PID 4268 wrote to memory of 3244	4268	msedge.exe	89
PID 4268 wrote to memory of 3244	4268	msedge.exe	89
PID 4268 wrote to memory of 3244	4268	msedge.exe	89
PID 4268 wrote to memory of 3244	4268	msedge.exe	89
PID 4268 wrote to memory of 3244	4268	msedge.exe	89
PID 4268 wrote to memory of 3244	4268	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Wave\LICENSES.chromium.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef87b46f8,0x7ffef87b4708,0x7ffef87b4718
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,2522833766317573249,13307300819946786685,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,2522833766317573249,13307300819946786685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,2522833766317573249,13307300819946786685,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2522833766317573249,13307300819946786685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2522833766317573249,13307300819946786685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,2522833766317573249,13307300819946786685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,2522833766317573249,13307300819946786685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2522833766317573249,13307300819946786685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2522833766317573249,13307300819946786685,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2522833766317573249,13307300819946786685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,2522833766317573249,13307300819946786685,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,2522833766317573249,13307300819946786685,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5484 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
53308f952bf2451cea55c2085547f2f8

SHA1
a52d6717643796fdd83d0c13332a98e86fb22d16

SHA256
3e3c138692fa2501cd77e182a7c83f3d629447d9ec31dae874babe7703c48ffb

SHA512
79202a43f5eeb4ec987b6d71bba39216fb63711215ae72758918a9aefc92332d64d89173b5933911d883d47f3e1a771af72a853eb467d0d4ede9a428920f6b7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
92cd9166d6f31a760eee4fe08d24978c

SHA1
8eb24ea287b21b9d217289e1b46f612a49164e0e

SHA256
137b7a8b32445887aa859065d9c7e44eec4e70f4a0ce65846003d48fa7e32a00

SHA512
b0b2492d2d286f699721f72529dad93c5c6ed7a4b1a6bbaa47815d0128e7eedfd5b4e1a2a95345dc21b4de6b516e71135233bd37c04dfc42aee2d92b14495e1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
29ff91b334245ca631d892eda3c8d464

SHA1
1eebe820a1407040ecabca6ae7a7df1932757bb0

SHA256
de909745a28a8601f9782ecd83ebfd21e5e2c535f34be5a511baadacff7379f3

SHA512
8c2c665acaa073ae75842ada906ca3df35f1ef2e4c0c34b1ffdfee576e7b8ad4d22621717c1cbb5f472d538d741333a775717c8eadba3d75344bded5b63ce98e

Download Submit