4599f5d504c127f7e2ee391f06725461b9b761492c72ac2eb98f2429f04ef5c1

Analysis

max time kernel
89s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-10-2024 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lua/http/dialogs/error_window.html
Size

501B
MD5

ad9769b13838d62653857ff47718c6c0
SHA1

a4683573d5b43aca9e256d4a45dc5ac46db927ed
SHA256

75d1a1ab807cd97801bc37ed547b26c7b357497e82d01221ac064497c9480304
SHA512

58a7d9ce56936da79a8f46f0f5c1e465d63ee1b8f68701627ffa00e1c43267899a64a3dfe601bf660bfee66b5ea365a27ba8d68f7d598ab6e3a917b52d6e9fc0

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1604	msedge.exe
1604	msedge.exe
2780	msedge.exe
2780	msedge.exe
4544	identity_helper.exe
4544	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 3608	2780	msedge.exe	85
PID 2780 wrote to memory of 3608	2780	msedge.exe	85
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 3048	2780	msedge.exe	86
PID 2780 wrote to memory of 1604	2780	msedge.exe	87
PID 2780 wrote to memory of 1604	2780	msedge.exe	87
PID 2780 wrote to memory of 3836	2780	msedge.exe	88
PID 2780 wrote to memory of 3836	2780	msedge.exe	88
PID 2780 wrote to memory of 3836	2780	msedge.exe	88
PID 2780 wrote to memory of 3836	2780	msedge.exe	88
PID 2780 wrote to memory of 3836	2780	msedge.exe	88
PID 2780 wrote to memory of 3836	2780	msedge.exe	88
PID 2780 wrote to memory of 3836	2780	msedge.exe	88
PID 2780 wrote to memory of 3836	2780	msedge.exe	88
PID 2780 wrote to memory of 3836	2780	msedge.exe	88
PID 2780 wrote to memory of 3836	2780	msedge.exe	88
PID 2780 wrote to memory of 3836	2780	msedge.exe	88
PID 2780 wrote to memory of 3836	2780	msedge.exe	88
PID 2780 wrote to memory of 3836	2780	msedge.exe	88
PID 2780 wrote to memory of 3836	2780	msedge.exe	88
PID 2780 wrote to memory of 3836	2780	msedge.exe	88
PID 2780 wrote to memory of 3836	2780	msedge.exe	88
PID 2780 wrote to memory of 3836	2780	msedge.exe	88
PID 2780 wrote to memory of 3836	2780	msedge.exe	88
PID 2780 wrote to memory of 3836	2780	msedge.exe	88
PID 2780 wrote to memory of 3836	2780	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\lua\http\dialogs\error_window.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd9c3646f8,0x7ffd9c364708,0x7ffd9c364718
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,9771071017370786143,5803108835500671686,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,9771071017370786143,5803108835500671686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,9771071017370786143,5803108835500671686,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9771071017370786143,5803108835500671686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9771071017370786143,5803108835500671686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9771071017370786143,5803108835500671686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9771071017370786143,5803108835500671686,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,9771071017370786143,5803108835500671686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,9771071017370786143,5803108835500671686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9771071017370786143,5803108835500671686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,9771071017370786143,5803108835500671686,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:3260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d6dcd7a68e67f4d036d7e6b388db35b2

SHA1
725a0c32eccb82c5fafc53d7ebcb471a44d3f66d

SHA256
f0cf76854c4b46f206cd88e2e692d4d71311dab88f35d536634cdd8743a64df0

SHA512
e0921819227c1ffb80a1ebad10b465f49aa6234454af590a0a7565820f3b86dee77f112984ed41d2bc632f49614350d4874443639d96c6d53c4b741c375204fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f31c42692d04562ac99ccd54bacf43aa

SHA1
1ce7e0e66c7187d30841a8d6703949a8f3a8df1d

SHA256
7315d2550bfbde523c9fca9b3e5431646af6ca32ca1300ade24a43814f981e9b

SHA512
f63697ebbed8e721798302d83904ed024607a23cc672bc52121d34b07076cc1a0f48b771598cc7869f526206da724ec3b2077697322174252f1a2d23d93e9fdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bb4c3ee2d2f4ee48454d4e40d3638f6f

SHA1
3ef5a3ddbe279bf3f5410d6082a609dc99d8936c

SHA256
3e3b202d75ae60be70cb18bd6e79ff678bc692e03df3c95a1d4367cbafdb47cb

SHA512
c70e21d86f89fcf8a62cfbaab919215a0a3a003bdfc2905f4d43b9e9d7952388eca907b00477ecca2168e8081058c3513e0e44b81e31ba66fddc5275c8ca460f

Download Submit