e1e69f5eb3d6533bb0444e04c8cf2f2866606c2a1072b2a1231ced158d397c28

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2024 21:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$APPDATA/seemao/config/map/www.3dbuy.com.cn.html
Size

1B
MD5

c9f0f895fb98ab9159f51fd0297e236d
SHA1

fe5dbbcea5ce7e2988b8c69bcfdfde8904aabc1f
SHA256

2c624232cdd221771294dfbb310aca000a0df6ac8b66b696d90ef06fdefb64a3
SHA512

bc23b8b01772d2dd67efb8fe1a5e6bd0f44b97c36101be6cc09f253b53e68d67a22e4643068dfd1341980134ea57570acf65e306e4d96cef4d560384894c88a4

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3892	msedge.exe
3892	msedge.exe
4944	msedge.exe
4944	msedge.exe
1084	identity_helper.exe
1084	identity_helper.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 4144	4944	msedge.exe	82
PID 4944 wrote to memory of 4144	4944	msedge.exe	82
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 4804	4944	msedge.exe	83
PID 4944 wrote to memory of 3892	4944	msedge.exe	84
PID 4944 wrote to memory of 3892	4944	msedge.exe	84
PID 4944 wrote to memory of 3616	4944	msedge.exe	85
PID 4944 wrote to memory of 3616	4944	msedge.exe	85
PID 4944 wrote to memory of 3616	4944	msedge.exe	85
PID 4944 wrote to memory of 3616	4944	msedge.exe	85
PID 4944 wrote to memory of 3616	4944	msedge.exe	85
PID 4944 wrote to memory of 3616	4944	msedge.exe	85
PID 4944 wrote to memory of 3616	4944	msedge.exe	85
PID 4944 wrote to memory of 3616	4944	msedge.exe	85
PID 4944 wrote to memory of 3616	4944	msedge.exe	85
PID 4944 wrote to memory of 3616	4944	msedge.exe	85
PID 4944 wrote to memory of 3616	4944	msedge.exe	85
PID 4944 wrote to memory of 3616	4944	msedge.exe	85
PID 4944 wrote to memory of 3616	4944	msedge.exe	85
PID 4944 wrote to memory of 3616	4944	msedge.exe	85
PID 4944 wrote to memory of 3616	4944	msedge.exe	85
PID 4944 wrote to memory of 3616	4944	msedge.exe	85
PID 4944 wrote to memory of 3616	4944	msedge.exe	85
PID 4944 wrote to memory of 3616	4944	msedge.exe	85
PID 4944 wrote to memory of 3616	4944	msedge.exe	85
PID 4944 wrote to memory of 3616	4944	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\$APPDATA\seemao\config\map\www.3dbuy.com.cn.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc28c346f8,0x7ffc28c34708,0x7ffc28c34718
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,6529645153710398082,3357576153230987996,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,6529645153710398082,3357576153230987996,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,6529645153710398082,3357576153230987996,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,6529645153710398082,3357576153230987996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,6529645153710398082,3357576153230987996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,6529645153710398082,3357576153230987996,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,6529645153710398082,3357576153230987996,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,6529645153710398082,3357576153230987996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,6529645153710398082,3357576153230987996,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,6529645153710398082,3357576153230987996,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,6529645153710398082,3357576153230987996,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,6529645153710398082,3357576153230987996,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4334547b2df17fd3b179816fea8ec750

SHA1
c9ea0e45637f21967a2c9a8ecac253e5f54ca8eb

SHA256
0ab8a45f214785f7e7b852ba83f9668fc07d49bd8e0e31e776f64cbd727d882d

SHA512
52a08f72672d7b5ee8879b8efde76f9b089998f93d4dfd41fd1ce8432721428e10dfda6d3802b56550670919dfd09e19ffc8d9b82cbdcc864c8054b6118e01cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ba920e6cafa863771eeb86bc704286d2

SHA1
c4dff38fdbaee126a3e1fff143d86e9c425e1593

SHA256
e67bfb311bc68cd168e79b50b2842b0dff3814e543744f3bc667b08c3b69c1de

SHA512
1e0c17cccbc0391cbd9b1983da0007c2bf970f4c905c247ca21d8a7a4e257a62a5f61b454059d1a3f447c901b13ceae0dc8787f14ea240d2a88475c97ada21a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e8358414e292e7fac6903532d4a5fd6e

SHA1
d7b1a88245cc9a64d4932aaa3b21db2d58c4b260

SHA256
a78ef2cff8bb5cf3ea8b0124c25c32f223840e7f9f38c90e2dd0390b128a159d

SHA512
b341519996e87ce410a3bcb080e9a71b645c25f3ecff426831abb402a431d373b1397a4722c31bb440e083c4c5246911ae2caa933fd0e3d4ea777b71710baa6f

Download Submit