hxxp://pasty[.]b-cdn[.]net/tryout/check-ste-new-build-kb2[.]html

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2024 20:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://pasty.b-cdn.net/tryout/check-ste-new-build-kb2.html

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1240	msedge.exe
1240	msedge.exe
3132	msedge.exe
3132	msedge.exe
3332	identity_helper.exe
3332	identity_helper.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe
3132	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 2348	3132	msedge.exe	82
PID 3132 wrote to memory of 2348	3132	msedge.exe	82
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 412	3132	msedge.exe	83
PID 3132 wrote to memory of 1240	3132	msedge.exe	84
PID 3132 wrote to memory of 1240	3132	msedge.exe	84
PID 3132 wrote to memory of 1852	3132	msedge.exe	85
PID 3132 wrote to memory of 1852	3132	msedge.exe	85
PID 3132 wrote to memory of 1852	3132	msedge.exe	85
PID 3132 wrote to memory of 1852	3132	msedge.exe	85
PID 3132 wrote to memory of 1852	3132	msedge.exe	85
PID 3132 wrote to memory of 1852	3132	msedge.exe	85
PID 3132 wrote to memory of 1852	3132	msedge.exe	85
PID 3132 wrote to memory of 1852	3132	msedge.exe	85
PID 3132 wrote to memory of 1852	3132	msedge.exe	85
PID 3132 wrote to memory of 1852	3132	msedge.exe	85
PID 3132 wrote to memory of 1852	3132	msedge.exe	85
PID 3132 wrote to memory of 1852	3132	msedge.exe	85
PID 3132 wrote to memory of 1852	3132	msedge.exe	85
PID 3132 wrote to memory of 1852	3132	msedge.exe	85
PID 3132 wrote to memory of 1852	3132	msedge.exe	85
PID 3132 wrote to memory of 1852	3132	msedge.exe	85
PID 3132 wrote to memory of 1852	3132	msedge.exe	85
PID 3132 wrote to memory of 1852	3132	msedge.exe	85
PID 3132 wrote to memory of 1852	3132	msedge.exe	85
PID 3132 wrote to memory of 1852	3132	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pasty.b-cdn.net/tryout/check-ste-new-build-kb2.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff6c0f46f8,0x7fff6c0f4708,0x7fff6c0f4718
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,3678260684266228994,4895557370094805545,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,3678260684266228994,4895557370094805545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,3678260684266228994,4895557370094805545,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3678260684266228994,4895557370094805545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3678260684266228994,4895557370094805545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,3678260684266228994,4895557370094805545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,3678260684266228994,4895557370094805545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3678260684266228994,4895557370094805545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3678260684266228994,4895557370094805545,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3678260684266228994,4895557370094805545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3678260684266228994,4895557370094805545,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,3678260684266228994,4895557370094805545,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1868 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
382B

MD5
56bbac7e68af0f863a9cf6a69f7dfe9a

SHA1
d9ae2fc7065b9bc7cf290dd865244958a7d23aab

SHA256
375ad88a0628794feb59950a847d5eafe67a49e1749b90da70a5eae1c7b8508e

SHA512
c9ffdee16e409331c7231b6259994b681f5bf630034396d3f23fc2abac634cc25c802b5e8c733c9c852b759ab73e2780d64954ef97cf7489fefd17ae8172e0da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
697cab28fd9161c8efed38c7f25460c6

SHA1
d5184cfe627937721f389f8a4bd702414033d7a2

SHA256
58cecceec49fd43092e98e1420eeebce23c23bd1d729118293b6ce90175045a6

SHA512
b1c5f1267b6770e0632b7df9ac675c067b7d473cbdd7552c3677ec95e560f032b57e6e9876779ff46cbe5054d447e49c3122f7348652380128e9b7fa56f2b8a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
34a00ae3b02ce53b02ae3c7718ea8c52

SHA1
084c35ea3071becbfecbff4848d90a3d4d947e58

SHA256
77d0b9c19abf582e360fc96bec1b3133eb11a6f349845f23d9a110de714609a7

SHA512
657932c50b8bb15bba7494012afc97f2962e22cc2d1b27be5b6c29944b8dba248cf2b812b2d98b21ad39baac90b07465d0cf19ae22ca8096fe5811467936ad2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9f4255eba0716d555c85581e020930f4

SHA1
24eb4d1cce1a720add2af9e6b71532d4b97bb947

SHA256
2dff466a9827f8d14af7c563f3f3c98eb183acbccf634b66d38a58b4232028ce

SHA512
6924b2e95e7acaef4a87f3b2656b3467a7f5a9ecf3296dccffe973f021a76406e12678f9c4e416bbb862db0d42a71ecc91908b51c29cfe3414c10d2e4e62048f

Download Submit