4599f5d504c127f7e2ee391f06725461b9b761492c72ac2eb98f2429f04ef5c1

Analysis

max time kernel
90s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/10/2024, 20:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

lua/http/dialogs/create_stream.html
Size

14KB
MD5

c38a93ae302612a55ccf7f11bdb79c37
SHA1

f6064e146909323276c6c43410f314666e35b5a4
SHA256

fdfc3417223b88d2e8f0421ced4711760ab11a3c18a50dc05b805a0f4f1a5134
SHA512

9c38a52c10455ffa179f0bad0d09d50defddad25d850248a4a15ebf5aefbe0165e12ee7eace516ced181362062b7651c9f246c4a1c77a6da867bc8ad978d56be
SSDEEP

192:jvlSM2AtdS0E2jSC+J3kuC6qSSSKyf+yO3zy6CGuGek+3LbnAilKyc7aSCWM2kco:jvlIATE2jJAhuDqx3J0vHEF

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3540	msedge.exe
3540	msedge.exe
2856	msedge.exe
2856	msedge.exe
4692	identity_helper.exe
4692	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 3364	2856	msedge.exe	85
PID 2856 wrote to memory of 3364	2856	msedge.exe	85
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 2584	2856	msedge.exe	87
PID 2856 wrote to memory of 3540	2856	msedge.exe	88
PID 2856 wrote to memory of 3540	2856	msedge.exe	88
PID 2856 wrote to memory of 2472	2856	msedge.exe	90
PID 2856 wrote to memory of 2472	2856	msedge.exe	90
PID 2856 wrote to memory of 2472	2856	msedge.exe	90
PID 2856 wrote to memory of 2472	2856	msedge.exe	90
PID 2856 wrote to memory of 2472	2856	msedge.exe	90
PID 2856 wrote to memory of 2472	2856	msedge.exe	90
PID 2856 wrote to memory of 2472	2856	msedge.exe	90
PID 2856 wrote to memory of 2472	2856	msedge.exe	90
PID 2856 wrote to memory of 2472	2856	msedge.exe	90
PID 2856 wrote to memory of 2472	2856	msedge.exe	90
PID 2856 wrote to memory of 2472	2856	msedge.exe	90
PID 2856 wrote to memory of 2472	2856	msedge.exe	90
PID 2856 wrote to memory of 2472	2856	msedge.exe	90
PID 2856 wrote to memory of 2472	2856	msedge.exe	90
PID 2856 wrote to memory of 2472	2856	msedge.exe	90
PID 2856 wrote to memory of 2472	2856	msedge.exe	90
PID 2856 wrote to memory of 2472	2856	msedge.exe	90
PID 2856 wrote to memory of 2472	2856	msedge.exe	90
PID 2856 wrote to memory of 2472	2856	msedge.exe	90
PID 2856 wrote to memory of 2472	2856	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\lua\http\dialogs\create_stream.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb669a46f8,0x7ffb669a4708,0x7ffb669a4718
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,2067965455651491923,5371526967683739783,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,2067965455651491923,5371526967683739783,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,2067965455651491923,5371526967683739783,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2067965455651491923,5371526967683739783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2067965455651491923,5371526967683739783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,2067965455651491923,5371526967683739783,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,2067965455651491923,5371526967683739783,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2067965455651491923,5371526967683739783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2067965455651491923,5371526967683739783,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2067965455651491923,5371526967683739783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,2067965455651491923,5371526967683739783,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f5c270bd118e3b0d4361608e5709d72c

SHA1
ff02631524a5b54d019a194c94fe09208571af53

SHA256
1e686401e5b91b1f284090e9e3daaad228090994cf9e19f9dae6a4b0db7b5355

SHA512
bbfd5dbd46841723d86e7348c52caa79623579ad7740b5d2fb27e6b89b87ab7aeddf2dba6390c39e59bfcc802333b87f7367e7420929a8e8c337a4062616b69e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2d95f252a97610369009d5aae754ef6d

SHA1
a65651af63d7f8a68ae785eb2e216d54dfc92cc1

SHA256
691011e82ae7f2b9806f9541abf5ebaa5c084bb2545d3fc7d7375ab637d85936

SHA512
420e20d07c5ee089c1993c0714d58478f8e9634c3cea9ef077c8f659e85a354a05a65e5ab79aa2982def098b6036a58caf8f76b3f7f4bf673182926bf598ce48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ed9ec65ba1c5ca09f522b76a2c9ae4f1

SHA1
f20374673062a41d88163d629c668e6cda36c84e

SHA256
9f0c7cd1a9e467289bfd683dbc6fd1648c96876bc2d0ef2c4273426345d68077

SHA512
5d814705c1510a078e4811a79810eb3e221d8514d7c748432834f509956f28e3931a86622ec76e9fccdc9677cd017c29aaf0e23224362e94da8c89ca4de70ca9

Download Submit