56bacfb737076b0b10f9896ac124c2e8f83cb855f7b31ef5a95338b7529b3126

Analysis

max time kernel
145s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
30/09/2024, 02:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

6.3MB
MD5

997768ae7eb8c036425bed10f766e823
SHA1

2ec99026b977f6603a8a7890bc05594a9a4f13a1
SHA256

ab30ee348b3257ec2f19fb5733e64278438be792f1280ce0f28eae0c9cb8943c
SHA512

f408b817b68861cbad62425e0bb8726f876d36a2212186a8f948d5c825c95ed819dcc41284d8ad8ac11e7ab7ff6141588fededd01c287780f84269846515f639
SSDEEP

24576:nP9t5W7WSLzrj41T4mfA6c606q6C6eBcHKcaRpG:gFO

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3472	msedge.exe
3472	msedge.exe
388	msedge.exe
388	msedge.exe
1148	msedge.exe
1148	msedge.exe
240	identity_helper.exe
240	identity_helper.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 1876	388	msedge.exe	78
PID 388 wrote to memory of 1876	388	msedge.exe	78
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 2380	388	msedge.exe	79
PID 388 wrote to memory of 3472	388	msedge.exe	80
PID 388 wrote to memory of 3472	388	msedge.exe	80
PID 388 wrote to memory of 2172	388	msedge.exe	81
PID 388 wrote to memory of 2172	388	msedge.exe	81
PID 388 wrote to memory of 2172	388	msedge.exe	81
PID 388 wrote to memory of 2172	388	msedge.exe	81
PID 388 wrote to memory of 2172	388	msedge.exe	81
PID 388 wrote to memory of 2172	388	msedge.exe	81
PID 388 wrote to memory of 2172	388	msedge.exe	81
PID 388 wrote to memory of 2172	388	msedge.exe	81
PID 388 wrote to memory of 2172	388	msedge.exe	81
PID 388 wrote to memory of 2172	388	msedge.exe	81
PID 388 wrote to memory of 2172	388	msedge.exe	81
PID 388 wrote to memory of 2172	388	msedge.exe	81
PID 388 wrote to memory of 2172	388	msedge.exe	81
PID 388 wrote to memory of 2172	388	msedge.exe	81
PID 388 wrote to memory of 2172	388	msedge.exe	81
PID 388 wrote to memory of 2172	388	msedge.exe	81
PID 388 wrote to memory of 2172	388	msedge.exe	81
PID 388 wrote to memory of 2172	388	msedge.exe	81
PID 388 wrote to memory of 2172	388	msedge.exe	81
PID 388 wrote to memory of 2172	388	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ffed68b3cb8,0x7ffed68b3cc8,0x7ffed68b3cd8
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,6715712777918304008,3521870033869829897,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,6715712777918304008,3521870033869829897,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,6715712777918304008,3521870033869829897,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6715712777918304008,3521870033869829897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6715712777918304008,3521870033869829897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6715712777918304008,3521870033869829897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6715712777918304008,3521870033869829897,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6715712777918304008,3521870033869829897,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6715712777918304008,3521870033869829897,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,6715712777918304008,3521870033869829897,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,6715712777918304008,3521870033869829897,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,6715712777918304008,3521870033869829897,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d30a5618854b9da7bcfc03aeb0a594c4

SHA1
7f37105d7e5b1ecb270726915956c2271116eab7

SHA256
3494c446aa3cb038f1d920b26910b7fe1f4286db78cb3f203ad02cb93889c1a8

SHA512
efd488fcd1729017a596ddd2950bff07d5a11140cba56ff8e0c62ef62827b35c22857bc4f5f5ea11ccc2e1394c0b3ee8651df62a25e66710f320e7a2cf4d1a77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
03a56f81ee69dd9727832df26709a1c9

SHA1
ab6754cc9ebd922ef3c37b7e84ff20e250cfde3b

SHA256
65d97e83b315d9140f3922b278d08352809f955e2a714fedfaea6283a5300e53

SHA512
e9915f11e74c1bcf7f80d1bcdc8175df820af30f223a17c0fe11b6808e5a400550dcbe59b64346b7741c7c77735abefaf2c988753e11d086000522a05a0f7781

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4f158dea5e74ffc6a5567c3a12e90bf5

SHA1
a04927a37341b1330c65cc1c2c696b4fb0e1e9b8

SHA256
26f32e1ac3a483f5ef0fced84709ea60d450fbce8b4c3b7ac0e451c5589307f1

SHA512
88e9b198f7c0f8defdd05f6734f2816b7776a621ae305f86cbfde1d8e82f41636ac103ac8bac2f6bb5b8aca57a565c9f32454cd09b74ea7660a4b685acdbc16d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b916f774c6e7cee3fc6f07f49f4e2ac5

SHA1
8e8457e6c3f2d6d274b949b48cd326d6a027aafe

SHA256
9206af87f60455a3f2c00bfa9cb910288ed30c4418a563f082742fb10ec5f46e

SHA512
2a1aef3423e717f4fdfeaa79f13a5ac27eec9a889def74227a73eacbce7b39b350a2ccb812e6ee3dd54a909c3c362d351aedafc9ac152980f19a2cec6a2f5257

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b1daffd1f8a7d6234282368e328dcf08

SHA1
220c1c4200d95e4e57a8d553cfabe433fdeee165

SHA256
b2efcdc5eda17328668627f993af6871f60bdd209d851c4bd2ffa525abba8cec

SHA512
c5faf7ffe914909e3343da451327070acdbed97d29f2e0836ccd72f8db599171579d32feb0dfb8d9041053100c3d12a37a076f168148114f6c48b5d53999ee3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0dae02913575c2131971151f7e262f87

SHA1
2868bfe8ec532c32ca18d060511239bf5dc02a8b

SHA256
72ee56e23a297dcea899af184ff6226f0b9e81ddda22e9c0ddfe3344c4e12cbb

SHA512
8a457cd8faa468020d59c25c66d96297a021cd615387e61fc583fdf713efe5ad3b1758a54bb035a68c31edd8ed36e12c8fb7d65e07cbb6cabd204e6ed108e1a4

Download Submit