f329ef2e93cac6dea7c9ba1a80c268ae50f851b2ee8ccb1d135a240e82232309

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 14:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

便宜房产网 v1.0/admin/PIC.html
Size

1KB
MD5

38ac41110a58df16aab26a9500de7607
SHA1

0e9450a72de5e79f838d76ce67b80cf9016e8bcf
SHA256

e26f7985fe605205f7389665de2f58b87ba6132f2fdc404d4289013c9b89361a
SHA512

4547bf3f631df997adbc0d4f50bc0e71a7a70fdb3c878dd4b4bf7e7713b65a6900b79df31af2a518fa76154256ea8b0f6b7e009793fadf920b0da48d174ceb2c

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4172	msedge.exe
4172	msedge.exe
1668	msedge.exe
1668	msedge.exe
1412	identity_helper.exe
1412	identity_helper.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe
4512	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe
1668	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 3972	1668	msedge.exe	81
PID 1668 wrote to memory of 3972	1668	msedge.exe	81
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4004	1668	msedge.exe	82
PID 1668 wrote to memory of 4172	1668	msedge.exe	83
PID 1668 wrote to memory of 4172	1668	msedge.exe	83
PID 1668 wrote to memory of 2296	1668	msedge.exe	84
PID 1668 wrote to memory of 2296	1668	msedge.exe	84
PID 1668 wrote to memory of 2296	1668	msedge.exe	84
PID 1668 wrote to memory of 2296	1668	msedge.exe	84
PID 1668 wrote to memory of 2296	1668	msedge.exe	84
PID 1668 wrote to memory of 2296	1668	msedge.exe	84
PID 1668 wrote to memory of 2296	1668	msedge.exe	84
PID 1668 wrote to memory of 2296	1668	msedge.exe	84
PID 1668 wrote to memory of 2296	1668	msedge.exe	84
PID 1668 wrote to memory of 2296	1668	msedge.exe	84
PID 1668 wrote to memory of 2296	1668	msedge.exe	84
PID 1668 wrote to memory of 2296	1668	msedge.exe	84
PID 1668 wrote to memory of 2296	1668	msedge.exe	84
PID 1668 wrote to memory of 2296	1668	msedge.exe	84
PID 1668 wrote to memory of 2296	1668	msedge.exe	84
PID 1668 wrote to memory of 2296	1668	msedge.exe	84
PID 1668 wrote to memory of 2296	1668	msedge.exe	84
PID 1668 wrote to memory of 2296	1668	msedge.exe	84
PID 1668 wrote to memory of 2296	1668	msedge.exe	84
PID 1668 wrote to memory of 2296	1668	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\便宜房产网 v1.0\admin\PIC.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc1a4646f8,0x7ffc1a464708,0x7ffc1a464718
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,14816999783929156063,15159140438466447157,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,14816999783929156063,15159140438466447157,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,14816999783929156063,15159140438466447157,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14816999783929156063,15159140438466447157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3132 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14816999783929156063,15159140438466447157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,14816999783929156063,15159140438466447157,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,14816999783929156063,15159140438466447157,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14816999783929156063,15159140438466447157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14816999783929156063,15159140438466447157,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14816999783929156063,15159140438466447157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14816999783929156063,15159140438466447157,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,14816999783929156063,15159140438466447157,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1052 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4ae82b06f337b91d851a0be254560dcb

SHA1
3468644c4348c7159c877ef7b93cd4281fb5dd9a

SHA256
9aeab9e7a2f661b7759a901efacbe780d1f55816074468515ba94b06f082036f

SHA512
8a74ed3848a94b195656419186498c91e2d4760fcedd9b621e6bef35f15f7e17be05c741988ce47b623b2a96aa7c43eecd6c60cb634b416c13ef518f0d983ea0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4630d1f195e847b7cdb6fc221bab29dd

SHA1
ac1a1313a6e5208218e07244c54d85565a520cac

SHA256
2cfa8473be1773e760d2f8e1b1609515e70909ab9d17a316df16032eef08fcb6

SHA512
63491293fcc7cf62cd26846bafe427d951527cdc8234cde965431896980590e353d00ea49e5477b9749e38628771f9f7221d29ebceb8a36f489d6c6cadb0f832

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
96bc5af6499922dbfc6f631d954667bf

SHA1
26bc41574e6ae65866bb59832b10342c4c67c985

SHA256
fbb3c348a369edff959c9d68139b5f2f1be8fc39d48aad21f348d64bd2d7c7a0

SHA512
7b1f3d303b31a06b4c84f2cb43d1fdde025848c24ea90f1ec8ff855e8f4ddc72726bacc07a59839b9871a7b0edc5b5c2b45e0bfb12cc92ff054765cdb9ecbc17

Download Submit