8ea3a3642845b3dead59d642a43ed01a4bedd675a1447bd720e9a74f7a339d20

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2024, 22:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

netsong/ape.html
Size

5KB
MD5

dce55e5d4f10bf61167e8a6fb6c0892a
SHA1

ea4db49b5d6c23d02719dd0b0cae6af497693392
SHA256

f1bb231ba5c757e9121d24c114235ae39c8db72bf80aead862d8944f7f5974ca
SHA512

29035be44fc83fc8186d65c85d33d33dfd92848370efa3edea218e28b7cc9b3fe8051d6b7a11bcf0a5baee30e22c2e02ba094a4f5c3caaa6ea4d71f135fd84cc
SSDEEP

96:SIk8vOmQyl3FnZnBpiPG0yB3Cpyf3CU1TM4kDabdsKRUaQdeKRqLLa:SIrvOvI3FZnBMyFOyPH1MhDaTRU/RRqa

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2304	msedge.exe
2304	msedge.exe
2084	msedge.exe
2084	msedge.exe
3468	identity_helper.exe
3468	identity_helper.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe
3592	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2860	2084	msedge.exe	84
PID 2084 wrote to memory of 2860	2084	msedge.exe	84
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 3168	2084	msedge.exe	86
PID 2084 wrote to memory of 2304	2084	msedge.exe	87
PID 2084 wrote to memory of 2304	2084	msedge.exe	87
PID 2084 wrote to memory of 1464	2084	msedge.exe	88
PID 2084 wrote to memory of 1464	2084	msedge.exe	88
PID 2084 wrote to memory of 1464	2084	msedge.exe	88
PID 2084 wrote to memory of 1464	2084	msedge.exe	88
PID 2084 wrote to memory of 1464	2084	msedge.exe	88
PID 2084 wrote to memory of 1464	2084	msedge.exe	88
PID 2084 wrote to memory of 1464	2084	msedge.exe	88
PID 2084 wrote to memory of 1464	2084	msedge.exe	88
PID 2084 wrote to memory of 1464	2084	msedge.exe	88
PID 2084 wrote to memory of 1464	2084	msedge.exe	88
PID 2084 wrote to memory of 1464	2084	msedge.exe	88
PID 2084 wrote to memory of 1464	2084	msedge.exe	88
PID 2084 wrote to memory of 1464	2084	msedge.exe	88
PID 2084 wrote to memory of 1464	2084	msedge.exe	88
PID 2084 wrote to memory of 1464	2084	msedge.exe	88
PID 2084 wrote to memory of 1464	2084	msedge.exe	88
PID 2084 wrote to memory of 1464	2084	msedge.exe	88
PID 2084 wrote to memory of 1464	2084	msedge.exe	88
PID 2084 wrote to memory of 1464	2084	msedge.exe	88
PID 2084 wrote to memory of 1464	2084	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\netsong\ape.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7dda46f8,0x7ffc7dda4708,0x7ffc7dda4718
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,2456314430121141,14536220891613047244,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,2456314430121141,14536220891613047244,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,2456314430121141,14536220891613047244,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2456314430121141,14536220891613047244,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2456314430121141,14536220891613047244,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,2456314430121141,14536220891613047244,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,2456314430121141,14536220891613047244,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2456314430121141,14536220891613047244,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2456314430121141,14536220891613047244,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2456314430121141,14536220891613047244,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,2456314430121141,14536220891613047244,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,2456314430121141,14536220891613047244,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
12fd1226c6d098cd7e9a669f0df5ac04

SHA1
4f020690b37a172403fe3819da3a27e802dbca48

SHA256
efcc75fb924ae11693ace10ef956364a03ac810a911b801924029f998ba1ab59

SHA512
9b0bee32b403d4822cdbdbb518a3e62a00abfd9932af3775ed32f9f732e9564f2b13afbc4dea4cc5b607478e6df1a50ec96da8b671b435cd8b97f653b645985c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4201a427f2235d69e4f383a00142b7b9

SHA1
ed97319bae9a8e2575531dd8fd8760ab65d2bcb8

SHA256
e607fa691531ce3583852da83d15d4f646263548850858bed8b96e0a39a0bc2b

SHA512
7f363a8d666dd616d9be9035ad23bd4f0f506dd693b89ab72683e8dba90f9b9ea30166937fe3bc53d11ec5ec02e86ba4585a1f6da676ba59eae944fba1894708

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c169bc85bd005fe49bdaf88093714921

SHA1
438f22cb6b06070466c109d92c6d0daa9e412cc6

SHA256
dedd8e6efc67aee4817adcc60b113af16b5981c38e5ad5d3b83d33a602602132

SHA512
de70c61c441e653029a8b0f09dd7551679beda2656eaf49e88f52a331f2b56703356a4255b61f19a3fa8f24c63bb2a6fe645b732116c9d5b1b410bd04263ce25

Download Submit