0a528772c4fa872f722632c64906d5e79f7caebe4f8ad59ec757379262394d30

Analysis

max time kernel
112s
max time network
126s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
19-09-2024 05:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

9.8MB
MD5

0ff177fbf2a3873dd573077840e0b8f5
SHA1

03d06bc7cd894399a5fc6600a0210f6e3226f92a
SHA256

c4771c9158e31855293ee565db76c9b2c52f84c8a37eda4700cfb149a17fd7eb
SHA512

3264becd3103c905ab7f9cc034320885f18cbecaa45f582a4a9567ca4bcd620d64dc59fb03532964e775c35f07928a4497f5529cf1b9dc18379e4e9cff02ff8a
SSDEEP

24576:K+QQM6Ms6x5d1n+wRhXe1BmfL6k6T6W6b6f6V6GeGj/3BIpx:LUzeGdY

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1564	msedge.exe
1564	msedge.exe
5076	msedge.exe
5076	msedge.exe
5248	identity_helper.exe
5248	identity_helper.exe
5600	msedge.exe
5600	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 5644	5076	msedge.exe	79
PID 5076 wrote to memory of 5644	5076	msedge.exe	79
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 3464	5076	msedge.exe	80
PID 5076 wrote to memory of 1564	5076	msedge.exe	81
PID 5076 wrote to memory of 1564	5076	msedge.exe	81
PID 5076 wrote to memory of 5720	5076	msedge.exe	82
PID 5076 wrote to memory of 5720	5076	msedge.exe	82
PID 5076 wrote to memory of 5720	5076	msedge.exe	82
PID 5076 wrote to memory of 5720	5076	msedge.exe	82
PID 5076 wrote to memory of 5720	5076	msedge.exe	82
PID 5076 wrote to memory of 5720	5076	msedge.exe	82
PID 5076 wrote to memory of 5720	5076	msedge.exe	82
PID 5076 wrote to memory of 5720	5076	msedge.exe	82
PID 5076 wrote to memory of 5720	5076	msedge.exe	82
PID 5076 wrote to memory of 5720	5076	msedge.exe	82
PID 5076 wrote to memory of 5720	5076	msedge.exe	82
PID 5076 wrote to memory of 5720	5076	msedge.exe	82
PID 5076 wrote to memory of 5720	5076	msedge.exe	82
PID 5076 wrote to memory of 5720	5076	msedge.exe	82
PID 5076 wrote to memory of 5720	5076	msedge.exe	82
PID 5076 wrote to memory of 5720	5076	msedge.exe	82
PID 5076 wrote to memory of 5720	5076	msedge.exe	82
PID 5076 wrote to memory of 5720	5076	msedge.exe	82
PID 5076 wrote to memory of 5720	5076	msedge.exe	82
PID 5076 wrote to memory of 5720	5076	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff381f3cb8,0x7fff381f3cc8,0x7fff381f3cd8
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,7269786146006441675,15818577551543604538,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1932,7269786146006441675,15818577551543604538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1932,7269786146006441675,15818577551543604538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,7269786146006441675,15818577551543604538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,7269786146006441675,15818577551543604538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1932,7269786146006441675,15818577551543604538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,7269786146006441675,15818577551543604538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,7269786146006441675,15818577551543604538,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,7269786146006441675,15818577551543604538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,7269786146006441675,15818577551543604538,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1932,7269786146006441675,15818577551543604538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9828ffacf3deee7f4c1300366ec22fab

SHA1
9aff54b57502b0fc2be1b0b4b3380256fb785602

SHA256
a3d21f0fb6563a5c9d0f7a6e9c125ec3faaa86ff43f37cb85a8778abc87950f7

SHA512
2e73ea4d2fcd7c8d52487816110f5f4a808ed636ae87dd119702d1cd1ae315cbb25c8094a9dddf18f07472b4deaed3e7e26c9b499334b26bdb70d4fa7f84168d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6fdbe80e9fe20761b59e8f32398f4b14

SHA1
049b1f0c6fc4e93a4ba6b3c992f1d6cecf3ada1f

SHA256
b7f0d9ece2307bdc4f05a2d814c947451b007067ff8af977f77f06c3d5706942

SHA512
cf25c7fd0d6eccc46e7b58949c16d17ebeefb7edd6c76aa62f7ab5da52d1c6fc88bde620be40396d336789bd0d62b2162209a947d7ab69389e8c03682e880234

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
16bc4af7a66e659aa4e68e559f9b8bfe

SHA1
21b0cc4f60380a6df0d379652f6fc7cc06634af9

SHA256
4c09c1ce7b397a5b721ef11f79b3a4a4c0b1ce2c6a965f2bf00dcbb007dacf10

SHA512
697fd7ccf54b602cec0aa3baec200edbef78c274271171acf55f6e7e16c5d018ade62b4a826300df4b5cf35919896d136bce5ea51d5afd9031468839437ee7f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ca04a863a23450a25a122875cb774fa3

SHA1
35cf452224ba20ce0e6a7842a481539c3b349df2

SHA256
aa61bec88e051df362d328878ffb9dec27b78bf24590d10b2e607186b9472725

SHA512
88103adc96aa2448294d89e2ddcd79d4f38d441c860d7390ca6567cd24f73c5b45d37a12bb1cef3bfca2924902fda0f9f3c96f4cbc3dee2386832806360cda30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
29c3e0d15aa6c090301b583fcdf2e498

SHA1
856f73f6cf54e5302a90173bb966c2433947b20a

SHA256
15d72195cc3a340a5ef285811fa356b20024bafe4e133ebe4f7ed97beb7e15bc

SHA512
4832767ca84d2d9ebba424eace418f0c08c5d7346b89e3ef07260af0f9f2f717100d8f1c98b18ff11ff0a896b9779b1ff35263dafadb3e9afd411cc91d1f97a6

Download Submit