26be89ffec641168a4b5a1733323ea3f18a7ed99ac730acefa0e1c987f377f23

Analysis

max time kernel
145s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
03-10-2024 10:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MantiWPF/workspace/Sirius/Assets/startup.html
Size

2KB
MD5

76abec15c05d3648314753229c3711ec
SHA1

ff5aeea2f61ba8333120d918ab0789488dd6d3f9
SHA256

fc035c892d7d627438d28387d22ac26f3e3ebb4933a935f3ebec506bee9a3c18
SHA512

85a5a8bd02fc294f6bb4a0118be3c90f5d0d74e461e199ef3afb1aca9462015c2fb0c073f330514a298848c59d2fd7a83c8eac49c664790481ddfb4b30e266bd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exe

pid	process
2424	msedge.exe
2424	msedge.exe
1256	msedge.exe
1256	msedge.exe
3640	identity_helper.exe
3640	identity_helper.exe
4088	msedge.exe
4088	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1256 msedge.exe
1256 msedge.exe
1256 msedge.exe
1256 msedge.exe
1256 msedge.exe
1256 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1256 wrote to memory of 4892	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4892	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4836	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 2424	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 2424	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 1784	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 1784	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 1784	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 1784	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 1784	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 1784	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 1784	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 1784	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 1784	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 1784	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 1784	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 1784	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 1784	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 1784	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 1784	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 1784	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 1784	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 1784	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 1784	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 1784	1256	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\MantiWPF\workspace\Sirius\Assets\startup.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff81f253cb8,0x7ff81f253cc8,0x7ff81f253cd8
2⤵
PID:4892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,5944122014827850683,2251587148443330675,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
2⤵
PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,5944122014827850683,2251587148443330675,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,5944122014827850683,2251587148443330675,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
2⤵
PID:1784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5944122014827850683,2251587148443330675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
2⤵
PID:4176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5944122014827850683,2251587148443330675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
2⤵
PID:2880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5944122014827850683,2251587148443330675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
2⤵
PID:3788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5944122014827850683,2251587148443330675,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
2⤵
PID:3268

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,5944122014827850683,2251587148443330675,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5944122014827850683,2251587148443330675,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
2⤵
PID:1028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,5944122014827850683,2251587148443330675,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
2⤵
PID:3700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,5944122014827850683,2251587148443330675,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5968 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,5944122014827850683,2251587148443330675,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1700 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
3e2612636cf368bc811fdc8db09e037d

SHA1
d69e34379f97e35083f4c4ea1249e6f1a5f51d56

SHA256
2eecaacf3f2582e202689a16b0ac1715c628d32f54261671cf67ba6abbf6c9f9

SHA512
b3cc3bf967d014f522e6811448c4792eed730e72547f83eb4974e832e958deb7e7f4c3ce8e0ed6f9c110525d0b12f7fe7ab80a914c2fe492e1f2d321ef47f96d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
e8115549491cca16e7bfdfec9db7f89a

SHA1
d1eb5c8263cbe146cd88953bb9886c3aeb262742

SHA256
dfa9a8b54936607a5250bec0ed3e2a24f96f4929ca550115a91d0d5d68e4d08e

SHA512
851207c15de3531bd230baf02a8a96550b81649ccbdd44ad74875d97a700271ef96e8be6e1c95b2a0119561aee24729cb55c29eb0b3455473688ef9132ed7f54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
63052f336fe3003b2fc00efb2754cfd3

SHA1
6f93bfd5512c3b9f4685507d0d1144d3f0011e86

SHA256
6e21d157f77256aab0894fc7727149a716d142a85333c4fbb1e3b0a9e09fffeb

SHA512
c451abc6e2818564c549f34506ff2d9f0b22e11887779d6a9704d012fbe32726003c11acd960ca49e8e6e095be05d83b2f07e5e906a5bcec1c340a86d2106133

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
43354105c6f5a12eb16e3a2459d0f9d3

SHA1
10d457d4680a0d92f260f2535fe0809c8b341d96

SHA256
8551c574318253232e0bd458813f45c2165739628622490f7bf5f781aadba38b

SHA512
2de3a6ced9fea5fe8f13381683d2d5755dd349e3edff33ace3ab98e1ff8a878e3d1bb86b5c47dc06d647871d4a4e666c06087b83fefb17c01dfeeaccf1e3f667

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
770e1568002883850a1e33ad9bcb98c0

SHA1
a57ba7567d8e93e9237a2948fa62a340d235bef8

SHA256
3240a97732f059cdc0329124a30e92ec29a29f3627cd144122264019ce420985

SHA512
de2cdd48973f8c62f230d692988ab7dcff4b854f54e96d1950e7f2c38bb0c9081558fc775daa55b8034d5757e97af40c821a6c9c785c76ce305b7c14181271f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
df10392cbd35824bf5d4c6db2db6d8bc

SHA1
3ffd099af7d9d3757c8cd0a5387d77894a4d5ed7

SHA256
22aefb2a6dfb8b3ddc5b4898e3b271a5f6256c077392865a8de0c18720a7d1e5

SHA512
f93d1181153b6a486905dd0782cfaa8ce725314a4468d4160c06a82e5249620eb8faea71249a85d575564797f5345355638cd60f6c10a3483c6a3981d7b32017

Download Submit
\??\pipe\LOCAL\crashpad_1256_BLXMSWEIIENNHLIK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit