hxxp://www[.]sysinternals[.]com

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-de
resource tags

arch:x64arch:x86image:win10v2004-20241007-delocale:de-deos:windows10-2004-x64systemwindows
submitted
10/10/2024, 06:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://www.sysinternals.com

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
624	msedge.exe
624	msedge.exe
4180	msedge.exe
4180	msedge.exe
4728	identity_helper.exe
4728	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 264	4180	msedge.exe	84
PID 4180 wrote to memory of 264	4180	msedge.exe	84
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 4788	4180	msedge.exe	85
PID 4180 wrote to memory of 624	4180	msedge.exe	86
PID 4180 wrote to memory of 624	4180	msedge.exe	86
PID 4180 wrote to memory of 2840	4180	msedge.exe	87
PID 4180 wrote to memory of 2840	4180	msedge.exe	87
PID 4180 wrote to memory of 2840	4180	msedge.exe	87
PID 4180 wrote to memory of 2840	4180	msedge.exe	87
PID 4180 wrote to memory of 2840	4180	msedge.exe	87
PID 4180 wrote to memory of 2840	4180	msedge.exe	87
PID 4180 wrote to memory of 2840	4180	msedge.exe	87
PID 4180 wrote to memory of 2840	4180	msedge.exe	87
PID 4180 wrote to memory of 2840	4180	msedge.exe	87
PID 4180 wrote to memory of 2840	4180	msedge.exe	87
PID 4180 wrote to memory of 2840	4180	msedge.exe	87
PID 4180 wrote to memory of 2840	4180	msedge.exe	87
PID 4180 wrote to memory of 2840	4180	msedge.exe	87
PID 4180 wrote to memory of 2840	4180	msedge.exe	87
PID 4180 wrote to memory of 2840	4180	msedge.exe	87
PID 4180 wrote to memory of 2840	4180	msedge.exe	87
PID 4180 wrote to memory of 2840	4180	msedge.exe	87
PID 4180 wrote to memory of 2840	4180	msedge.exe	87
PID 4180 wrote to memory of 2840	4180	msedge.exe	87
PID 4180 wrote to memory of 2840	4180	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.sysinternals.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ff9e00246f8,0x7ff9e0024708,0x7ff9e0024718
  2⤵
  PID:264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,7013620441522094596,16942061826911929714,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,7013620441522094596,16942061826911929714,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,7013620441522094596,16942061826911929714,131072 --lang=de --service-sandbox-type=utility --mojo-platform-channel-handle=2972 /prefetch:8
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7013620441522094596,16942061826911929714,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7013620441522094596,16942061826911929714,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7013620441522094596,16942061826911929714,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2016 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,7013620441522094596,16942061826911929714,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,7013620441522094596,16942061826911929714,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7013620441522094596,16942061826911929714,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7013620441522094596,16942061826911929714,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7013620441522094596,16942061826911929714,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7013620441522094596,16942061826911929714,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:2664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
3b5bd7de43fd590678920fc5826bbfda

SHA1
1e9ccfa3da5de466097f7d7f9f966e0efb74efa6

SHA256
7cd3e8a586f71f8132e46dd6af45f1fb464302b0575de13af257942952e09ffb

SHA512
86fccddd731918da03dbae4a1d4caebdbba14c5d86a2d9d1ddee7f7d2003e8708b0f18b8a2f2dcd98e866db1d888d15a38b3fa45de5ae154517ba6151a445b6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
605B

MD5
cde3a6d7bd9d6b0a02a1fb219f75acb0

SHA1
6f5cfbffaa6ca50ac74b3018144fa3bdb53acaff

SHA256
7ed5dbd5df8d63bd3b87aeb11ef122f703fd1a9f4307270c7a351f5e2e2875b2

SHA512
153bc679ea9deeefbdf96eca0ab2594902afa153f8e84fed0baf4d10773bcffdcb3c92d512b5c475dc381ea82eb18243e275635764b3fbdfaa76a3a278eda5ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
767b00f1659ddd18b75339af7be33cf5

SHA1
ea905fed16565f5d2463fdcdd4916d1c8ab8e294

SHA256
e2c40e50bb9db4a83d6d234360ada792a2da587954a61663bd0d6861e5612dc2

SHA512
9214f39c31f86320a7400afbb7929375f491ee2c65706fb699ae6f1ca3e38f1a31576340eef63ff2f058e9fabc010da6e9a2d54e4a1461d8a6fb178359a578f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
edbaa6aeec28013892806e36a023fbfb

SHA1
a62eb54cbcd0e0d337addfc32973e1cc89cec07d

SHA256
fe58ef68d20fac18a3d65f7a085bfaf1b6eeb84361deeddc14d918044bc83d28

SHA512
0c52e3e3d5c04c2f6d4965a7a9bf0c85798f2fbba3e37b995986ed8db0d2ab5c6a8450d8f0d39e5a886ef6faa53d17546aa1a1e89fde0572f9111bfb36bc0611

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
538e733b24584ed89759c6406cb1562f

SHA1
d741025d0af8718294b31b64a5e3360547568815

SHA256
736c9f0b33ceadce55a68802819ffbbc9e48e2a9353a9e8072e0f4dc444c9dc4

SHA512
ca87f1ede933ab9163d1ec0dedebec6bb1153e535a0aa301c465a4b21bfa8d198f76a8b2c3e40817bc1d9f1360fac1dd86f3c0cbdaaf4cae837d5dbd0f4f63d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
5188c476f55c7c6d2bb18c6c6b3c7f08

SHA1
d85d65087849c089c23597c31075c632738094e5

SHA256
48b364aa11895c75bafc7b86779c9501158937fdb84c1bd970ec2bbc6c674c5c

SHA512
c85b458d34701f93d80dfd3f4e213d0b97a5480fabe621cf9e72123f40b6d4f64bd03983e26c375200c23161f787164b6b02d022cde37e6c673647dcab5e9cde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5816de.TMP

Filesize
538B

MD5
6877a4f4af4cd318fbd62141294b91e4

SHA1
76170d3d0f90c27ba9d9f4a408e4a4a756c42563

SHA256
405b7e9d83d2187c8709292f3a2d55c5715eb67a8a8098f497d48e94f6f68256

SHA512
3e2bebf299adb2d14f0dbb39792622d36da47e24ae06c767998944cd4e46c16fcb8fec32dc7d07b00328c5ca2a9348437ca89a8b4e495b43057baa18797510a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7870ecf1387f2ee4c53af0e682724f9e

SHA1
f56ca0731f56ad246e660e0105589f517429cfaa

SHA256
f40e23d15919d352c11ee9e1011fafd1530658b82fe962f21d3b3489c0be31b7

SHA512
322669d2c031e88e536a417bed391f75f2a2b649dc2573eeeb6296b54b2887949a2ba21bc7633bdd78c86483ec29b5daab85accaded5c6731c4d0e26859f2014

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6e9e9af2d1490fdfd8da678324812304

SHA1
58492afd371fcdad3eb7afd55a7a27bbc3ba8092

SHA256
8ee1133c339ebbb052fa706d6c316b270fe98567c6fb2cd09c58a67a9b999a84

SHA512
9491481140b715942fdc476eacf96eb69d2801397a3320d250d3f7ba23deea643f7dae13b785f26368252178e76b333e81553cd9fc2b68cacd0e2e21b8191b31

Download Submit