3f3a2c1a16748eeccefc4d68666836acedd60b1ca0e2314576377ecd91d7ad84

Analysis

max time kernel
145s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

doc/de/mkvmerge.html
Size

201KB
MD5

23dddf80cc2d6569678fd249fe6fd46e
SHA1

001dc6254340f499e85d6b30be251916c46a1612
SHA256

d6f9429bb7986ac1f77940e609cbe3109afe9c53b5ebfdaac48bfed75e7a8b43
SHA512

16b6636749b5cab500897d1447d1b6ab3563a43f63a4beff22b23199303631b210c4b90d09e4e355d5bcc2249155d119f0c50135b80799503679822638394ef1
SSDEEP

1536:qsaS9ckYSuzDW1+zTCVczvNpgvUTy3QQQb3DK314Ri0q44z14p759znlUM7fN5hO:79LuzDWI3CVQv8UTHK314RoIlUM55x5U

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2044	msedge.exe
2044	msedge.exe
876	msedge.exe
876	msedge.exe
3840	identity_helper.exe
3840	identity_helper.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 2816	876	msedge.exe	84
PID 876 wrote to memory of 2816	876	msedge.exe	84
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 4996	876	msedge.exe	85
PID 876 wrote to memory of 2044	876	msedge.exe	86
PID 876 wrote to memory of 2044	876	msedge.exe	86
PID 876 wrote to memory of 1444	876	msedge.exe	87
PID 876 wrote to memory of 1444	876	msedge.exe	87
PID 876 wrote to memory of 1444	876	msedge.exe	87
PID 876 wrote to memory of 1444	876	msedge.exe	87
PID 876 wrote to memory of 1444	876	msedge.exe	87
PID 876 wrote to memory of 1444	876	msedge.exe	87
PID 876 wrote to memory of 1444	876	msedge.exe	87
PID 876 wrote to memory of 1444	876	msedge.exe	87
PID 876 wrote to memory of 1444	876	msedge.exe	87
PID 876 wrote to memory of 1444	876	msedge.exe	87
PID 876 wrote to memory of 1444	876	msedge.exe	87
PID 876 wrote to memory of 1444	876	msedge.exe	87
PID 876 wrote to memory of 1444	876	msedge.exe	87
PID 876 wrote to memory of 1444	876	msedge.exe	87
PID 876 wrote to memory of 1444	876	msedge.exe	87
PID 876 wrote to memory of 1444	876	msedge.exe	87
PID 876 wrote to memory of 1444	876	msedge.exe	87
PID 876 wrote to memory of 1444	876	msedge.exe	87
PID 876 wrote to memory of 1444	876	msedge.exe	87
PID 876 wrote to memory of 1444	876	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\doc\de\mkvmerge.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9dc1146f8,0x7ff9dc114708,0x7ff9dc114718
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,15600967452634096645,8852154392138514645,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,15600967452634096645,8852154392138514645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,15600967452634096645,8852154392138514645,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15600967452634096645,8852154392138514645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15600967452634096645,8852154392138514645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,15600967452634096645,8852154392138514645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,15600967452634096645,8852154392138514645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15600967452634096645,8852154392138514645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15600967452634096645,8852154392138514645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15600967452634096645,8852154392138514645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15600967452634096645,8852154392138514645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,15600967452634096645,8852154392138514645,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a10cd9e69929e49a6a055bb2593ea005

SHA1
de1a3762f67c8cb42f00c99f3a856af222d28eca

SHA256
9669f578017be9804c33eb30efb11208a98cc08485198be0022971520dd00b3c

SHA512
8dae26360d476e8025161be2235bd4e1ccdde6a66f9ba6d5ec13b83b6a82760024a910dfddd872377118198570135cc4887b7267ff2f516bdbb33a72e3fa8dd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7ff06769ec25aa6e88e2dc0360d6de30

SHA1
70e0e28c63cba00dd32440cdbb463c5028207103

SHA256
f1738472082186b86a3784bee113a83b3538d478c0a439a9ccb6862507510253

SHA512
726eadaaa5006414673a40d55cf8abd6eccaacbfa9a1aec601c6b398567989fc723807103a793be1ef54ced574dae9ce629b1cff5bb1715765c5fa92a2e79271

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9947d244ba34a5903a2b466a5cacb80a

SHA1
9663fb2f83f79474951fb739171c7cba64678214

SHA256
04f95cfcc2888412aa06f9f10c35234f8ea2f28b8f49477a74ce8ecf0383b29c

SHA512
d7548cbc3cade1c03fc68aaf1efca4dc7a81a0e26529e70d7b1d05d05b1c81255e3b541b1d48ce3dfad4a4dbe8fa63f1cd39cad4f5b36ec7b8b086fc60fc8a1d

Download Submit