c4bafdcf1f2f9593812c96e27591a3c988eabd1ec9d45337c394de86aafdaf71

Analysis

max time kernel
145s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Help/en/camcontrol.html
Size

714B
MD5

3a8a6e7c27497b9229eac75ff0fa7c9f
SHA1

c4107e99e559dd77cef78868f9745592c52f747f
SHA256

7393265a71121cc6895da25cee14fb9e13c360ac7ab57c8620c257a5f36e5a42
SHA512

5ff4bf19029f64117373e850e3aa23da01ea3484bfe67d1b9a36d3abbe2a0e6b227d8b74e352af3bfcf606e378b2460da4977a85f05a36aa4c120db551ced861

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4868	msedge.exe
4868	msedge.exe
3980	msedge.exe
3980	msedge.exe
4444	identity_helper.exe
4444	identity_helper.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 4904	3980	msedge.exe	82
PID 3980 wrote to memory of 4904	3980	msedge.exe	82
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4916	3980	msedge.exe	83
PID 3980 wrote to memory of 4868	3980	msedge.exe	84
PID 3980 wrote to memory of 4868	3980	msedge.exe	84
PID 3980 wrote to memory of 1180	3980	msedge.exe	85
PID 3980 wrote to memory of 1180	3980	msedge.exe	85
PID 3980 wrote to memory of 1180	3980	msedge.exe	85
PID 3980 wrote to memory of 1180	3980	msedge.exe	85
PID 3980 wrote to memory of 1180	3980	msedge.exe	85
PID 3980 wrote to memory of 1180	3980	msedge.exe	85
PID 3980 wrote to memory of 1180	3980	msedge.exe	85
PID 3980 wrote to memory of 1180	3980	msedge.exe	85
PID 3980 wrote to memory of 1180	3980	msedge.exe	85
PID 3980 wrote to memory of 1180	3980	msedge.exe	85
PID 3980 wrote to memory of 1180	3980	msedge.exe	85
PID 3980 wrote to memory of 1180	3980	msedge.exe	85
PID 3980 wrote to memory of 1180	3980	msedge.exe	85
PID 3980 wrote to memory of 1180	3980	msedge.exe	85
PID 3980 wrote to memory of 1180	3980	msedge.exe	85
PID 3980 wrote to memory of 1180	3980	msedge.exe	85
PID 3980 wrote to memory of 1180	3980	msedge.exe	85
PID 3980 wrote to memory of 1180	3980	msedge.exe	85
PID 3980 wrote to memory of 1180	3980	msedge.exe	85
PID 3980 wrote to memory of 1180	3980	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Help\en\camcontrol.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82e9a46f8,0x7ff82e9a4708,0x7ff82e9a4718
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,2285188187261789331,10721927469969363912,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1984,2285188187261789331,10721927469969363912,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1984,2285188187261789331,10721927469969363912,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,2285188187261789331,10721927469969363912,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,2285188187261789331,10721927469969363912,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,2285188187261789331,10721927469969363912,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,2285188187261789331,10721927469969363912,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,2285188187261789331,10721927469969363912,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,2285188187261789331,10721927469969363912,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,2285188187261789331,10721927469969363912,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,2285188187261789331,10721927469969363912,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,2285188187261789331,10721927469969363912,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5116 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d24ee5d1fcfc4d8bf2a88fc971364312

SHA1
516e49a86047e4313f1643d0e6e080ab39f5cdb3

SHA256
c0dae8fa5891ab71b5f6158e06864cf6bb917a7537d511006f41f8106f1000b2

SHA512
9dd77d1c59e080a7d545e9e6fdd206a4943ee8fc43f3ad0c36b2ef1f4ca030c08eb04b93c30f7665725d6cf0ef7cba92af353b76f532c2975cb497988073e674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e39812611a32b7738d204eb712b3a5df

SHA1
324b780e8902263a2c59d8f1dbb24f3cad164485

SHA256
e0738b70a83da1a6dc05944609fdf8ceb52e4a8525906d3605e29f0801840f33

SHA512
6d58d367ee40cc8a5430fccb220e85ba70f59589e1ca06397e7001ef474b38904a03c148b26b9bbc163032df2157c7c477036647a974f03c4e95814f7eed7083

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
413cde7f905d3b9859e95b138f3814cb

SHA1
c4f0bc3a9047a86e729442b6795b3de13c1c4150

SHA256
bff34b404210a99b3a9b031b160281f69479a2503d91e3b4b41abc507b444d80

SHA512
bcaa0712bc22034f6cd66b578fa237011f761d18c294a0377f900b31208cd8077d2ebeb7b784bb8e0b0fddad7395bf4fb30c0888944536aebc371f91be9f1378

Download Submit