956779cad788e024ef3a53c965fb8ed8960b7fa9202b2a1339ca158297b8f255

Analysis

max time kernel
147s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
19-09-2024 05:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/app/progress.html
Size

20KB
MD5

91462d1f452add0ccac7455e010e89df
SHA1

55435ad7c270cb137c19ad90503652bc63d3ef0c
SHA256

c3cd601ed7b1ce97e9a45518af8d9011353f9629b034e9d3939ee951c417bbf8
SHA512

0e2c8dfae33141ad9fb782d742b09f6cd12f8f4bca298c9599236d0708fc9fc6b753a672e68d2d25cf1f29f1792a00ead814ffe2d5bb136713812409866cb43a
SSDEEP

192:hadqnDNlPkZHmY74+/qmtRCtmK8W9I2gHHMlxh8B39LJ1Hab4OJgJnc5w/93gAJP:5O3aMOUnbC63UA5ia6w

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1224	msedge.exe
1224	msedge.exe
1128	msedge.exe
1128	msedge.exe
2900	msedge.exe
2900	msedge.exe
4784	identity_helper.exe
4784	identity_helper.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 3136	1128	msedge.exe	80
PID 1128 wrote to memory of 3136	1128	msedge.exe	80
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 5004	1128	msedge.exe	81
PID 1128 wrote to memory of 1224	1128	msedge.exe	82
PID 1128 wrote to memory of 1224	1128	msedge.exe	82
PID 1128 wrote to memory of 3932	1128	msedge.exe	83
PID 1128 wrote to memory of 3932	1128	msedge.exe	83
PID 1128 wrote to memory of 3932	1128	msedge.exe	83
PID 1128 wrote to memory of 3932	1128	msedge.exe	83
PID 1128 wrote to memory of 3932	1128	msedge.exe	83
PID 1128 wrote to memory of 3932	1128	msedge.exe	83
PID 1128 wrote to memory of 3932	1128	msedge.exe	83
PID 1128 wrote to memory of 3932	1128	msedge.exe	83
PID 1128 wrote to memory of 3932	1128	msedge.exe	83
PID 1128 wrote to memory of 3932	1128	msedge.exe	83
PID 1128 wrote to memory of 3932	1128	msedge.exe	83
PID 1128 wrote to memory of 3932	1128	msedge.exe	83
PID 1128 wrote to memory of 3932	1128	msedge.exe	83
PID 1128 wrote to memory of 3932	1128	msedge.exe	83
PID 1128 wrote to memory of 3932	1128	msedge.exe	83
PID 1128 wrote to memory of 3932	1128	msedge.exe	83
PID 1128 wrote to memory of 3932	1128	msedge.exe	83
PID 1128 wrote to memory of 3932	1128	msedge.exe	83
PID 1128 wrote to memory of 3932	1128	msedge.exe	83
PID 1128 wrote to memory of 3932	1128	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app\progress.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcb6b83cb8,0x7ffcb6b83cc8,0x7ffcb6b83cd8
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,5148869097700162672,12213082230079251420,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1868 /prefetch:2
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,5148869097700162672,12213082230079251420,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,5148869097700162672,12213082230079251420,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5148869097700162672,12213082230079251420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5148869097700162672,12213082230079251420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,5148869097700162672,12213082230079251420,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5148869097700162672,12213082230079251420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3784 /prefetch:1
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5148869097700162672,12213082230079251420,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1952 /prefetch:1
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5148869097700162672,12213082230079251420,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5148869097700162672,12213082230079251420,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,5148869097700162672,12213082230079251420,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,5148869097700162672,12213082230079251420,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5448 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e2612636cf368bc811fdc8db09e037d

SHA1
d69e34379f97e35083f4c4ea1249e6f1a5f51d56

SHA256
2eecaacf3f2582e202689a16b0ac1715c628d32f54261671cf67ba6abbf6c9f9

SHA512
b3cc3bf967d014f522e6811448c4792eed730e72547f83eb4974e832e958deb7e7f4c3ce8e0ed6f9c110525d0b12f7fe7ab80a914c2fe492e1f2d321ef47f96d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e8115549491cca16e7bfdfec9db7f89a

SHA1
d1eb5c8263cbe146cd88953bb9886c3aeb262742

SHA256
dfa9a8b54936607a5250bec0ed3e2a24f96f4929ca550115a91d0d5d68e4d08e

SHA512
851207c15de3531bd230baf02a8a96550b81649ccbdd44ad74875d97a700271ef96e8be6e1c95b2a0119561aee24729cb55c29eb0b3455473688ef9132ed7f54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4656782b97470a5ebbebfd279713cb35

SHA1
4124a0be7327f244d74c98b50b73af93a68b4a06

SHA256
bb8da168bc918f292bf837ab06594d44aff935899e79c1e4dcb3ce762d345391

SHA512
ed594b2e2d43da54e6ebb5d102e0e26ccd35f29c61f6144c8b69caf13f0ffba18899010498eb69ace021e708e1f6a581e9659a80fcdf60dfcb1d1c8b05657549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
792cbf4e94cf0ce883be62c9726fe6b6

SHA1
ed0d16638d45d8f1639bad8ca6a841bcb7c6c36e

SHA256
411e86e6669d825e5710a162652a4500d576b7407e0a334d3eb67c298b78712d

SHA512
8fe4bed20fdaf8a5b2d57503d85bbae5ac28ec32baef4d53fd2ccc74bb70bc2c74d70aa38aab8c5b73b387391ae3f5863b6a380aaf445e7700455d59d87acebe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a709ee3f170788d9427912fdeec58b78

SHA1
2ecf89a077ccb31e05fce09b3d1da587e3ab0f79

SHA256
9d27b75f4ba5b51cf7aa7d5728e1eab42152eac7f001b5056086bd4f64dafd32

SHA512
4f4cb76b572d94a1880faae0f8fa4467217ca50431fd5e3c4246d2a7ce2220f3f3de3ba75ce6b0a144296f4e9431a95e8200904c3ae1b9c18dd70207847a6e84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7ed4a9585b775ab6d3a40cdb91ad7666

SHA1
9c787cbadf75a1bf7216142e97583410bfe72afc

SHA256
c27d1e31916c1512ef6d7afb9cde474f4451bf486e5464a78f8b74e283aebca4

SHA512
9824db22c7709638d0022bf5b4886f0ada1469652c4c43f2c66d82c6832df546a8c9feb4b189e21d11a8d5b6d1ba3bbbc130744cb073c20e741f51d5ef8c3626

Download Submit