5bc488e5bbc0112c8863ece0dd2e6edd171742d0aa6c562f4ae26195007007e2

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 18:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GooglePasswordDecryptor/Readme.html
Size

502B
MD5

fdb9d1d72b18241777626a9684200a17
SHA1

cb2c46befa50a9c5ee61662b5a5813ff16658689
SHA256

7dea6758ac440d2976253c48ec50237e630ba6ac063629cc82ca4e0dd8980dd2
SHA512

5eccfe46b48ae6472c9609a928fa3e59db3799f892f804c0051fca7153090b4c594bada51f15a9da2569e4d6533afea8a4fccf83eef9396e902955c3e429ad61

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5044	msedge.exe
5044	msedge.exe
4040	msedge.exe
4040	msedge.exe
4004	identity_helper.exe
4004	identity_helper.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 3292	4040	msedge.exe	82
PID 4040 wrote to memory of 3292	4040	msedge.exe	82
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 768	4040	msedge.exe	83
PID 4040 wrote to memory of 5044	4040	msedge.exe	84
PID 4040 wrote to memory of 5044	4040	msedge.exe	84
PID 4040 wrote to memory of 2552	4040	msedge.exe	85
PID 4040 wrote to memory of 2552	4040	msedge.exe	85
PID 4040 wrote to memory of 2552	4040	msedge.exe	85
PID 4040 wrote to memory of 2552	4040	msedge.exe	85
PID 4040 wrote to memory of 2552	4040	msedge.exe	85
PID 4040 wrote to memory of 2552	4040	msedge.exe	85
PID 4040 wrote to memory of 2552	4040	msedge.exe	85
PID 4040 wrote to memory of 2552	4040	msedge.exe	85
PID 4040 wrote to memory of 2552	4040	msedge.exe	85
PID 4040 wrote to memory of 2552	4040	msedge.exe	85
PID 4040 wrote to memory of 2552	4040	msedge.exe	85
PID 4040 wrote to memory of 2552	4040	msedge.exe	85
PID 4040 wrote to memory of 2552	4040	msedge.exe	85
PID 4040 wrote to memory of 2552	4040	msedge.exe	85
PID 4040 wrote to memory of 2552	4040	msedge.exe	85
PID 4040 wrote to memory of 2552	4040	msedge.exe	85
PID 4040 wrote to memory of 2552	4040	msedge.exe	85
PID 4040 wrote to memory of 2552	4040	msedge.exe	85
PID 4040 wrote to memory of 2552	4040	msedge.exe	85
PID 4040 wrote to memory of 2552	4040	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\GooglePasswordDecryptor\Readme.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b2b846f8,0x7ff9b2b84708,0x7ff9b2b84718
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,3661929400619488172,15757794838010810656,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,3661929400619488172,15757794838010810656,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,3661929400619488172,15757794838010810656,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,3661929400619488172,15757794838010810656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,3661929400619488172,15757794838010810656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,3661929400619488172,15757794838010810656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,3661929400619488172,15757794838010810656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,3661929400619488172,15757794838010810656,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4088 /prefetch:8
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,3661929400619488172,15757794838010810656,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,3661929400619488172,15757794838010810656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,3661929400619488172,15757794838010810656,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,3661929400619488172,15757794838010810656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,3661929400619488172,15757794838010810656,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,3661929400619488172,15757794838010810656,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4880 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5ebc9cb7-10f4-4b4f-ae19-8d2459215703.tmp

Filesize
10KB

MD5
d504988ec9ba9f75d0e19637717303d7

SHA1
6207126add9f079a461935dea79f2765e043e947

SHA256
5286dec56ca0cffe648fbc417b53de953cfb80e8b2891c45a13c5fa9790d0335

SHA512
fc083b26fc0727f2037aef45c290f5e96f69ce299b3ffc684ad4b16eac84daa068561305de199a232ecee8be2d241c79eb3c75df63b72284de0f0cf4cba9187e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6a8ac41c-254e-4ac3-acd5-56df5d1d02fc.tmp

Filesize
6KB

MD5
62e20ad1734a702d9c4a281849152d8d

SHA1
77e2fea60256e76799c4f2c4cce2a3b471395af2

SHA256
d6ca33c67864fdbf45c430169d7185a15a54ca2286c917406379836a45bacfe0

SHA512
0d57a23acd9f77bcdeaa21531e23be138148a1f3774530b59205752cf003cb8b76d27ac75731f046033a8b0f4f8399da28296f086ace138d07f9857e630ea6e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
5a85e981939715b2cf61c64c39f68b7e

SHA1
53989960ccf4b79e9247b4fb9adddbc6c0ef63ea

SHA256
7d5dfbe70a4683fbe24117caec893ef9b593bde2345d1fe5f5aa350e05995ca9

SHA512
2577aa2182bac061ec7598c669f571bf281f310f8bcec5d4d2378a06d96f36119c387b3553a07f69a75a2cb32a9ca678fab16b9bdfae87142f6958f3fd2fdf4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
187B

MD5
6b97024e4235109afa8413e0e39216d9

SHA1
c01034e68db6fb586d311f7d09ac8457f9d4773f

SHA256
6669a7ff870c1eb6de75eb60e4a3798f6d7ae20f4a07be4ae0bccb90c0c081ef

SHA512
2db0e3f2de041b3c9d5a75c8ea82b88fc9333922b40292f596e18fd9f32844e27cef82737fea3a4a8bb4917b626db75d4e66ce99a4a7451d8883bc35fabec8d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
61206285be40a5352f5a4cc3c4fa5d33

SHA1
7f297a463fa8cd90726231be9cf5bc3c73fa464d

SHA256
c07cead8a062a99b679bfb950191036dbfdb5dcf9257b1d868c5628a2e3e7096

SHA512
12976e7aba093f89d6e48c475c0180846fe8f92c3785b206c5b3052d5d078910b2f1ce9d86f0967b47245f3772f3a16102d82f7357d5e47e9e4433c10bfe2825

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit