5cbc9b548f34c542cb9771fb1bde9c2833aa2e942fc003f2a7e12aba70e326e2

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 16:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

client/view/default/login.htm
Size

4KB
MD5

54f4404b1e80b142950126fbbd55c87b
SHA1

098472d4f73327d01adc23aeade69355202790d5
SHA256

4d73a48952ea34c23b862c800a03c59c8cff223fb2edf36aea282b3cdacdd6ae
SHA512

3dad29dfb0b4f44f2b40ad094cd5bfd78edb4c5f3928a78560dfea4ea6324b173c7e2dc8300a8e3a4d2f4b5f23b4fb6ffe25fd6b3bd03b6ec2a1eab5ee0bdaec
SSDEEP

96:wOjqUvFtZaATSTOw+ZIKgw6l/l1+4LMGUN96wNbi+Bq:wUqU9raRWgw6ZSNxVs

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1804	msedge.exe
1804	msedge.exe
3216	msedge.exe
3216	msedge.exe
3640	identity_helper.exe
3640	identity_helper.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe
1108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 3940	3216	msedge.exe	82
PID 3216 wrote to memory of 3940	3216	msedge.exe	82
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1432	3216	msedge.exe	83
PID 3216 wrote to memory of 1804	3216	msedge.exe	84
PID 3216 wrote to memory of 1804	3216	msedge.exe	84
PID 3216 wrote to memory of 4584	3216	msedge.exe	85
PID 3216 wrote to memory of 4584	3216	msedge.exe	85
PID 3216 wrote to memory of 4584	3216	msedge.exe	85
PID 3216 wrote to memory of 4584	3216	msedge.exe	85
PID 3216 wrote to memory of 4584	3216	msedge.exe	85
PID 3216 wrote to memory of 4584	3216	msedge.exe	85
PID 3216 wrote to memory of 4584	3216	msedge.exe	85
PID 3216 wrote to memory of 4584	3216	msedge.exe	85
PID 3216 wrote to memory of 4584	3216	msedge.exe	85
PID 3216 wrote to memory of 4584	3216	msedge.exe	85
PID 3216 wrote to memory of 4584	3216	msedge.exe	85
PID 3216 wrote to memory of 4584	3216	msedge.exe	85
PID 3216 wrote to memory of 4584	3216	msedge.exe	85
PID 3216 wrote to memory of 4584	3216	msedge.exe	85
PID 3216 wrote to memory of 4584	3216	msedge.exe	85
PID 3216 wrote to memory of 4584	3216	msedge.exe	85
PID 3216 wrote to memory of 4584	3216	msedge.exe	85
PID 3216 wrote to memory of 4584	3216	msedge.exe	85
PID 3216 wrote to memory of 4584	3216	msedge.exe	85
PID 3216 wrote to memory of 4584	3216	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\client\view\default\login.htm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffade9146f8,0x7ffade914708,0x7ffade914718
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,7277676356669202952,1923253505562706578,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2240,7277676356669202952,1923253505562706578,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2240,7277676356669202952,1923253505562706578,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,7277676356669202952,1923253505562706578,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,7277676356669202952,1923253505562706578,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,7277676356669202952,1923253505562706578,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,7277676356669202952,1923253505562706578,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,7277676356669202952,1923253505562706578,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,7277676356669202952,1923253505562706578,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,7277676356669202952,1923253505562706578,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,7277676356669202952,1923253505562706578,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,7277676356669202952,1923253505562706578,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5460 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
82234a1dda784315a51da6b85563b81c

SHA1
96dbce2dcb963a4f569c515a9b720143e9de0c1a

SHA256
66f54a76814799efe63b89afd3e8b0fa566073cb6574e9c51ebb44fcb5778a41

SHA512
8bd27d9eda75129e0f7036c3db0bbf979cb72a05a99ead3c361de392f67905a2ce0cfb70a041c0a37cf3c4f142c8d91f11bd2676c0e9227157deac7138ea50d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1af5e0e2775759bf24d2e6b946325f89

SHA1
e9eb1a35ec375d1cb2851f408c030d1f7e17de10

SHA256
f826a4e94d49819feb653ed92bd8a8586b9eb4adab7d3d64ccec28f65ed8f49e

SHA512
ffb69c4e98f413e5b760adb8bae20a70cf7d5cf141c477135a303ef0ed5eb82379350b7eccfba0e5bcbf3d7e8499789290c31c082da26115a8e21c8e72253f97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
18f743bea37f734204be0efab7b51cac

SHA1
4bab5dabb6ba22ebc886aeabe82bd260468e2dd0

SHA256
baf5895e84a8e2688906b6ca1f3f586c652babb19d6bd864388d4231e297f4f0

SHA512
57f2f0c49a0bfe3ea2685289ba2a483acc60d0b9c830e6ed5ad4c991695ff134d60c505306a6bc4ab239a005525a9590ae6e211aedfb44628f2e5112bc70e791

Download Submit