5cb43536a90c4a993cf7e2d156c3fca001923bc2a6e48a4b37d8c93cbfe00807

Resubmissions

13/11/2024, 18:59

241113-xm5naawrfs3

13/11/2024, 18:55

241113-xlarhsxfpp6

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/11/2024, 18:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Zenith (Big update)/Monaco/ace.html
Size 1021B
Sample241113-xlarhsxfpp
SHA256 6b3c653bf0d6b50de87879b33ea62e1862fc515a4f19b5d5d92037d7fa20296b
MD5 b99c014adf4d126aa96fc9730f40e836
SHA1 7f68173c159929b85473fc8e2929dccbc15c6a7d
SHA512 3417259b1fc00d5feb74828dae67a70cbd3bacdd3812c7d8ceb74fad31257a641d19c784197dbaa904b577c1b136adcc97cafa306beaaa0a6b63c842f3ebdd34
MD5 SHA1 SHA512

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4748	msedge.exe
4748	msedge.exe
2396	msedge.exe
2396	msedge.exe
1852	identity_helper.exe
1852	identity_helper.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 980	2396	msedge.exe	84
PID 2396 wrote to memory of 980	2396	msedge.exe	84
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 1220	2396	msedge.exe	85
PID 2396 wrote to memory of 4748	2396	msedge.exe	86
PID 2396 wrote to memory of 4748	2396	msedge.exe	86
PID 2396 wrote to memory of 4700	2396	msedge.exe	87
PID 2396 wrote to memory of 4700	2396	msedge.exe	87
PID 2396 wrote to memory of 4700	2396	msedge.exe	87
PID 2396 wrote to memory of 4700	2396	msedge.exe	87
PID 2396 wrote to memory of 4700	2396	msedge.exe	87
PID 2396 wrote to memory of 4700	2396	msedge.exe	87
PID 2396 wrote to memory of 4700	2396	msedge.exe	87
PID 2396 wrote to memory of 4700	2396	msedge.exe	87
PID 2396 wrote to memory of 4700	2396	msedge.exe	87
PID 2396 wrote to memory of 4700	2396	msedge.exe	87
PID 2396 wrote to memory of 4700	2396	msedge.exe	87
PID 2396 wrote to memory of 4700	2396	msedge.exe	87
PID 2396 wrote to memory of 4700	2396	msedge.exe	87
PID 2396 wrote to memory of 4700	2396	msedge.exe	87
PID 2396 wrote to memory of 4700	2396	msedge.exe	87
PID 2396 wrote to memory of 4700	2396	msedge.exe	87
PID 2396 wrote to memory of 4700	2396	msedge.exe	87
PID 2396 wrote to memory of 4700	2396	msedge.exe	87
PID 2396 wrote to memory of 4700	2396	msedge.exe	87
PID 2396 wrote to memory of 4700	2396	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\Zenith (Big update)\Monaco\ace.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd679e46f8,0x7ffd679e4708,0x7ffd679e4718
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,6457699801418917583,15569533535459163559,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,6457699801418917583,15569533535459163559,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,6457699801418917583,15569533535459163559,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,6457699801418917583,15569533535459163559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,6457699801418917583,15569533535459163559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,6457699801418917583,15569533535459163559,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,6457699801418917583,15569533535459163559,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,6457699801418917583,15569533535459163559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,6457699801418917583,15569533535459163559,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,6457699801418917583,15569533535459163559,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,6457699801418917583,15569533535459163559,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,6457699801418917583,15569533535459163559,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405
MD5 bffcefacce25cd03f3d5c9446ddb903d
SHA1 8923f84aa86db316d2f5c122fe3874bbe26f3bab
SHA512 761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6
MD5 d22073dea53e79d9b824f27ac5e9813e
SHA1 6d8a7281241248431a1571e6ddc55798b01fa961
SHA512 97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 9db80bbba4958431f9dec210c9a33e0e3431e97f1d36110ff1bb92f5e26630b7
MD5 336961e495054ec3e438edc921184dcb
SHA1 2715dc2e6c1990bd7eece1f9ca995dbbe2059eac
SHA512 ae1f8003067aac3df26fc514c16fcfe570e2a6fcaa0b93a407ab5b2c8396cf2742053a324c5d83127968d153665303fd202cfdf4739ad6b2326773393883af22
SSDEEP 96:nNkAI1oUbwpvWMoiVmdeHXj+ATVlUWQyV+VDCziEwb:nNk5OUbGWMXzTVlro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 2f1f5dda73af23bfad4be1541e7a2d9e48680239744a4586f0e60549f3b4e0ad
MD5 ee34e1637704b37d7d0941afde8a4169
SHA1 617a4781e8ad787e473f754d352c627b8ef71570
SHA512 220710a57773939debfa5106e0912d4226b93bff33b9483fc91414e3613a30ddbfa48cd269ad8f0264f589ed710214b0114f57cfa9dd71dff9114e22acc1c55b
SSDEEP 96:nNkyI1oUbwpvWMoiVmdeHXj+ATVlUWQyV+VD7AiEwb:nNkzOUbGWMXzTVlrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 f209c2a63d5094f1d7ba228a0cee224cb8f003a4edb86418e50b95a227e3d7f4
MD5 9919f4120a4c86d529ce1d226da0dac3
SHA1 ba3cd403647e0b61f806687291747986f4969f05
SHA512 bbc8e5ee9fa07cab1e3063248445eae5f102899e3be2e0849082c068ae24bab9d32fce41d7a23af174a337946691b7b320059f81f4b9f7dbf48b44e32cc2b081
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupC5e2RUw/4nvRZGHqRUx3Gg:A9iIxuERzA83h09RZxYWRwv/5SFGmx8a
MD5 SHA1 SHA512 SSDEEP

Submit Download