956779cad788e024ef3a53c965fb8ed8960b7fa9202b2a1339ca158297b8f255

Analysis

max time kernel
145s
max time network
142s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
19-09-2024 05:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/app/cmp.html
Size

5KB
MD5

d7b8b31b190e552677589cfd4cbb5d8e
SHA1

09ffb3c63991d5c932c819393de489268bd3ab88
SHA256

6c21e8c07ce28327dca05f873d73fe85d5473f9b22a751a4d3d28931f5d0c74f
SHA512

32794507a4b9a12e52ceb583222cb93300e38c634a72ea3f51a0189127aba60cf476fb7918942355a4f826185d7071e876cb40348ba34cf5d1ca7e9546ccb310
SSDEEP

48:t9rc0/GLAoShbEHaLKNGiNQtvmolOGR36tgtr/GTvJP8AscaV4LiMt7ByBZXGz+p:4VLjHa2NGiivmmpWsBVutFwAk5vSG

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
1668	msedge.exe
1668	msedge.exe
600	identity_helper.exe
600	identity_helper.exe
3456	msedge.exe
3456	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1232	1668	msedge.exe	80
PID 1668 wrote to memory of 1232	1668	msedge.exe	80
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 1368	1668	msedge.exe	82
PID 1668 wrote to memory of 8	1668	msedge.exe	83
PID 1668 wrote to memory of 8	1668	msedge.exe	83
PID 1668 wrote to memory of 1660	1668	msedge.exe	84
PID 1668 wrote to memory of 1660	1668	msedge.exe	84
PID 1668 wrote to memory of 1660	1668	msedge.exe	84
PID 1668 wrote to memory of 1660	1668	msedge.exe	84
PID 1668 wrote to memory of 1660	1668	msedge.exe	84
PID 1668 wrote to memory of 1660	1668	msedge.exe	84
PID 1668 wrote to memory of 1660	1668	msedge.exe	84
PID 1668 wrote to memory of 1660	1668	msedge.exe	84
PID 1668 wrote to memory of 1660	1668	msedge.exe	84
PID 1668 wrote to memory of 1660	1668	msedge.exe	84
PID 1668 wrote to memory of 1660	1668	msedge.exe	84
PID 1668 wrote to memory of 1660	1668	msedge.exe	84
PID 1668 wrote to memory of 1660	1668	msedge.exe	84
PID 1668 wrote to memory of 1660	1668	msedge.exe	84
PID 1668 wrote to memory of 1660	1668	msedge.exe	84
PID 1668 wrote to memory of 1660	1668	msedge.exe	84
PID 1668 wrote to memory of 1660	1668	msedge.exe	84
PID 1668 wrote to memory of 1660	1668	msedge.exe	84
PID 1668 wrote to memory of 1660	1668	msedge.exe	84
PID 1668 wrote to memory of 1660	1668	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app\cmp.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9197e3cb8,0x7ff9197e3cc8,0x7ff9197e3cd8
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,4716567641155649433,10730976969340846879,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,4716567641155649433,10730976969340846879,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,4716567641155649433,10730976969340846879,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4716567641155649433,10730976969340846879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4716567641155649433,10730976969340846879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4716567641155649433,10730976969340846879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4716567641155649433,10730976969340846879,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,4716567641155649433,10730976969340846879,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4716567641155649433,10730976969340846879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1888 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,4716567641155649433,10730976969340846879,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,4716567641155649433,10730976969340846879,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,4716567641155649433,10730976969340846879,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5572 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8276eab0f8f0c0bb325b5b8c329f64f

SHA1
8ce681e4056936ca8ccd6f487e7cd7cccbae538b

SHA256
847f60e288d327496b72dbe1e7aa1470a99bf27c0a07548b6a386a6188cd72da

SHA512
42f91bf90e92220d0731fa4279cc5773d5e9057a9587f311bee0b3f7f266ddceca367bd0ee7f1438c3606598553a2372316258c05e506315e4e11760c8f13918

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
058032c530b52781582253cb245aa731

SHA1
7ca26280e1bfefe40e53e64345a0d795b5303fab

SHA256
1c3a7192c514ef0d2a8cf9115cfb44137ca98ec6daa4f68595e2be695c7ed67e

SHA512
77fa3cdcd53255e7213bb99980049e11d6a2160f8130c84bd16b35ba9e821a4e51716371526ec799a5b4927234af99e0958283d78c0799777ab4dfda031f874f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
309B

MD5
377bb9dd67d3364ead24943609cc412e

SHA1
63e86b7c0a80bdcd2577e94a5215f59e07d52eca

SHA256
a3de648710d6c35b7d168c886dac06e3721b1fe671d08b73893c20d2db9b2f6d

SHA512
23380505db4cb81cde79b6304a6f2950f1e8022e66271c4b5adbb42c0f2541ae99c28222821be6526011c4cd1e867dfbecd55b5680f0c7c70532650b306e67f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8df5a7b97e61f45ed6ed51f64054ec48

SHA1
fe17af5cd225703ae542eace16ed043a16500a18

SHA256
eabb8f1c50609bd13131507eac6c90512222584023a749f4c911752485375912

SHA512
8a228fb8df367359234b681cc83b29f84359c0e49a12f13ee139703de5982bc56db99e10c640f9c309be7e8cbaa9c5be57f55952e6ef9d96f23288f1f614e3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6d03693a0931ab05e2f73c72222f59a5

SHA1
a5f9ca2acd78ba1ed414ae13a696c857b71fa750

SHA256
4787f87470ec478ab5a233e33f156dd912df7a6e36a4799f2939143cdd14fc57

SHA512
bf90e50eae965c687ac25291c1c780e855082bab91f8000399f40632964c6b52efcb6950334baa9c3dc34761d3c459aedac93423ec94d094109de7cdf4802477

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4b786e845fbd76e40b0cf5a9b7d62d76

SHA1
ca0b7ba3029edcf173eaceb89691cafeb600b89c

SHA256
03ddbbf330af4ddbae46ea81b930219eb693cb7aee274554962d608e06bd85eb

SHA512
16dbddacaad09c3542b186f0d45717520a9faf47d64bfd5a4178a4cac994647dc06257ab80ce07bd8432fb4689933096e51d1eb424cae738ea785e110dc73625

Download Submit