9cd7f45620bda9811e200380d3e43a3ea768c48d1240448c279b3321d3ae59b6

Analysis

max time kernel
145s
max time network
159s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
15/09/2024, 23:42 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

resources/app/src/header.html
Size

38KB
MD5

eef60d35e9f75d3c7030d0574250e56f
SHA1

6d29148b90187fa1583652bc8799e65efa10f637
SHA256

3cf434b126e4369ffb8e9f4d489daee1aad9f47828850386984b3c752cdc7042
SHA512

529bf36dacd2fc808e63a8091a8aa92f5d3d39c23077bc72298bf052f1bdcd6fc05282608ce5337643d3c1a794bdde2b8d364f7deb0c4b7ae75810be3bdb165b
SSDEEP

768:Xkos/1jkos/1kQj9U38pO4MftndjyQj9U38pO4Mftndjh6:c/a/OQj+O9MftdjyQj+O9Mftdjh6

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1364	msedge.exe
1364	msedge.exe
2704	msedge.exe
2704	msedge.exe
1772	identity_helper.exe
1772	identity_helper.exe
2148	msedge.exe
2148	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe
1712	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 408	2704	msedge.exe	78
PID 2704 wrote to memory of 408	2704	msedge.exe	78
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 2648	2704	msedge.exe	79
PID 2704 wrote to memory of 1364	2704	msedge.exe	80
PID 2704 wrote to memory of 1364	2704	msedge.exe	80
PID 2704 wrote to memory of 1304	2704	msedge.exe	81
PID 2704 wrote to memory of 1304	2704	msedge.exe	81
PID 2704 wrote to memory of 1304	2704	msedge.exe	81
PID 2704 wrote to memory of 1304	2704	msedge.exe	81
PID 2704 wrote to memory of 1304	2704	msedge.exe	81
PID 2704 wrote to memory of 1304	2704	msedge.exe	81
PID 2704 wrote to memory of 1304	2704	msedge.exe	81
PID 2704 wrote to memory of 1304	2704	msedge.exe	81
PID 2704 wrote to memory of 1304	2704	msedge.exe	81
PID 2704 wrote to memory of 1304	2704	msedge.exe	81
PID 2704 wrote to memory of 1304	2704	msedge.exe	81
PID 2704 wrote to memory of 1304	2704	msedge.exe	81
PID 2704 wrote to memory of 1304	2704	msedge.exe	81
PID 2704 wrote to memory of 1304	2704	msedge.exe	81
PID 2704 wrote to memory of 1304	2704	msedge.exe	81
PID 2704 wrote to memory of 1304	2704	msedge.exe	81
PID 2704 wrote to memory of 1304	2704	msedge.exe	81
PID 2704 wrote to memory of 1304	2704	msedge.exe	81
PID 2704 wrote to memory of 1304	2704	msedge.exe	81
PID 2704 wrote to memory of 1304	2704	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\resources\app\src\header.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffbb0f3cb8,0x7fffbb0f3cc8,0x7fffbb0f3cd8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,10862357208980270837,15539609877214642946,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,10862357208980270837,15539609877214642946,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,10862357208980270837,15539609877214642946,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,10862357208980270837,15539609877214642946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3112 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,10862357208980270837,15539609877214642946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,10862357208980270837,15539609877214642946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,10862357208980270837,15539609877214642946,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,10862357208980270837,15539609877214642946,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1880,10862357208980270837,15539609877214642946,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,10862357208980270837,15539609877214642946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,10862357208980270837,15539609877214642946,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,10862357208980270837,15539609877214642946,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4896 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3056

Network

DNS

172.210.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.210.232.199.in-addr.arpa

IN PTR

Response
DNS

172.214.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.214.232.199.in-addr.arpa

IN PTR

Response

No results found

8.8.8.8:53

172.210.232.199.in-addr.arpa

dns

148 B
256 B
2
2

DNS Request

172.210.232.199.in-addr.arpa

DNS Request

172.214.232.199.in-addr.arpa
224.0.0.251:5353

453 B
7

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9af507866fb23dace6259791c377531f

SHA1
5a5914fc48341ac112bfcd71b946fc0b2619f933

SHA256
5fb3ec65ce1e6f47694e56a07c63e3b8af9876d80387a71f1917deae690d069f

SHA512
c58c963ecd2c53f0c427f91dc41d9b2a9b766f2e04d7dae5236cb3c769d1f048e4a342ea75e4a690f3a207baa1d3add672160c1f317abfe703fd1d2216b1baf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b0177afa818e013394b36a04cb111278

SHA1
dbc5c47e7a7df24259d67edf5fbbfa1b1fae3fe5

SHA256
ffc2c53bfd37576b435309c750a5b81580a076c83019d34172f6635ff20c2a9d

SHA512
d3b9e3a0a99f191edcf33f3658abd3c88afbb12d7b14d3b421b72b74d551b64d2a13d07db94c90b85606198ee6c9e52072e1017f8c8c6144c03acf509793a9db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dbb57bc4ab41c5beb37c15d90be44bba

SHA1
5cd37dce66375ac87095b39fa840963baa8a4303

SHA256
851915351292ab46c31b1507b2f90294f0430aa9db21dbf891dae3c406578cae

SHA512
60432252cb95ab6c179435ab896da9e5858e21eb279a2d067f74c9e99f99d4733386568cc77ffc418c12af036d0baedc123ae34a4209ed243b74c551ebe5c76b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bcfc443e50a1ed0bea1fb986008d322a

SHA1
e3f4ba14ca462e9d03461ce73842980882ae4fd4

SHA256
6b3adefca007aa472233434fdf8a71982958891bca3e404ff4050c6b37f78100

SHA512
5df7a7bbddcc6f57489a3d706637bc9be4a9ed794ebaa29b9f947b021d1a743b175e4dcb9401edd8db089f35e7a17b98b96da3c8ef54c6fc5dcc9520ecf731d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0dbb06719c08537a409b1e9b55242e31

SHA1
faae138db6511884b09d5ab39084f59f82b7ba0c

SHA256
cf0817b040b36b7ea3b185ca576ee3fe4c7f701b0cf812fb2d5a80dabea7e346

SHA512
526afe222c9da02330b80b6c9e815879ca84edfc9f8568d4b392d984df8da3950f76b127848989d1be56ab1bc2150859075bad07e520ee6891e481539fb69314

Download Submit