Analysis
-
max time kernel
1681s -
max time network
1686s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
14-11-2024 15:41
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3320 msedge.exe 3320 msedge.exe 3640 msedge.exe 3640 msedge.exe 2564 identity_helper.exe 2564 identity_helper.exe 1940 msedge.exe 1940 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3640 wrote to memory of 1072 3640 msedge.exe 79 PID 3640 wrote to memory of 1072 3640 msedge.exe 79 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 1104 3640 msedge.exe 80 PID 3640 wrote to memory of 3320 3640 msedge.exe 81 PID 3640 wrote to memory of 3320 3640 msedge.exe 81 PID 3640 wrote to memory of 876 3640 msedge.exe 82 PID 3640 wrote to memory of 876 3640 msedge.exe 82 PID 3640 wrote to memory of 876 3640 msedge.exe 82 PID 3640 wrote to memory of 876 3640 msedge.exe 82 PID 3640 wrote to memory of 876 3640 msedge.exe 82 PID 3640 wrote to memory of 876 3640 msedge.exe 82 PID 3640 wrote to memory of 876 3640 msedge.exe 82 PID 3640 wrote to memory of 876 3640 msedge.exe 82 PID 3640 wrote to memory of 876 3640 msedge.exe 82 PID 3640 wrote to memory of 876 3640 msedge.exe 82 PID 3640 wrote to memory of 876 3640 msedge.exe 82 PID 3640 wrote to memory of 876 3640 msedge.exe 82 PID 3640 wrote to memory of 876 3640 msedge.exe 82 PID 3640 wrote to memory of 876 3640 msedge.exe 82 PID 3640 wrote to memory of 876 3640 msedge.exe 82 PID 3640 wrote to memory of 876 3640 msedge.exe 82 PID 3640 wrote to memory of 876 3640 msedge.exe 82 PID 3640 wrote to memory of 876 3640 msedge.exe 82 PID 3640 wrote to memory of 876 3640 msedge.exe 82 PID 3640 wrote to memory of 876 3640 msedge.exe 82
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://store.steampowered.com/1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff45a23cb8,0x7fff45a23cc8,0x7fff45a23cd82⤵PID:1072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,10128291474599587824,5197379499437532433,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1752 /prefetch:22⤵PID:1104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,10128291474599587824,5197379499437532433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,10128291474599587824,5197379499437532433,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:82⤵PID:876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,10128291474599587824,5197379499437532433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,10128291474599587824,5197379499437532433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:1864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,10128291474599587824,5197379499437532433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:12⤵PID:2076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,10128291474599587824,5197379499437532433,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:12⤵PID:1852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,10128291474599587824,5197379499437532433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,10128291474599587824,5197379499437532433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4564 /prefetch:12⤵PID:4388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,10128291474599587824,5197379499437532433,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:12⤵PID:3788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,10128291474599587824,5197379499437532433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,10128291474599587824,5197379499437532433,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3008 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4832
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3068
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1992
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e1544690d41d950f9c1358068301cfb5
SHA1ae3ff81363fcbe33c419e49cabef61fb6837bffa
SHA25653d69c9cc3c8aaf2c8b58ea6a2aa47c49c9ec11167dd9414cd9f4192f9978724
SHA5121e4f1fe2877f4f947d33490e65898752488e48de34d61e197e4448127d6b1926888de80b62349d5a88b96140eed0a5b952ef4dd7ca318689f76e12630c9029da
-
Filesize
152B
MD59314124f4f0ad9f845a0d7906fd8dfd8
SHA10d4f67fb1a11453551514f230941bdd7ef95693c
SHA256cbd58fa358e4b1851c3da2d279023c29eba66fb4d438c6e87e7ce5169ffb910e
SHA51287b9060ca4942974bd8f95b8998df7b2702a3f4aba88c53b2e3423a532a75407070368f813a5bbc0251864b4eae47e015274a839999514386d23c8a526d05d85
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize456B
MD53c767dbfafcdf27602bdfac7f1d8d976
SHA140c9e916c7f87ba7c3769cf14893fc4bb4894445
SHA2563a7d4d975157c6b8b5901b5a5e4986bc7ce53ca2fccb0dc333e13d32bd9d171c
SHA5124601107b13e27834da6755741368c67727ae96cbd480c6233e053e87bc5607e13105dc4527396f61e32e04823cfaaad59d99cbfa4b96d02b3dbbe23826839eb4
-
Filesize
367B
MD53dce5fe5978fa9421facce55c4594af5
SHA1e72b242822f88e4824c4d1ab8dce9550627de47a
SHA25665d647ca68b46f75c6223b383c3984024291169de1c596849ee2d34dea19253f
SHA5122d099109deb49f4407cf39caa0783a62c8d1ef7e0939d1c2547e01da027e76b9f6e609ddc2c10b50e3f09f31f24450ee649bf6607934f4abad832bda5d0d8976
-
Filesize
5KB
MD533bd4efa254f232c3386cd233677d755
SHA1d3cf7edd378b90cae6e3c6c0fbf3c72d09b58d25
SHA2562fb87231f361b5da45b33c0b0ff3152dd7805feeabbe0303d1d301d4193069cf
SHA5125c64105e92281acb0b872cb8e21c761a170746565cbfc59628bd8c36f7fb127236f3d72f5a5be8490e8036792b8b65b8aea0c884113e0dcbc6d154ee11b8341b
-
Filesize
6KB
MD58d0c8007cfb2d2441ffd08c98b01ad2a
SHA1fe1e64515a05c76d9a82cd814aac3ab6adde355b
SHA2567261dbbb6adb01a8909f827690b34bb577cf6de9019d558c4facc35e70dddc7e
SHA512bad77b8ba58e2b73413b892505f9401444fe989e8d656d83c4f426c301029587189d56f8a04dd7dd7dfdef116f4a075e1c6f089bbc90e117240343fda8379419
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5e64ac44347a6866810bb8989b85d150e
SHA147f8a3582fd2010a8b7f4164134aec569e59e790
SHA256c3c89ee82eaae175c77fe2e381585fde266ed75a6a5ed37eae6cc45e2cef08ef
SHA512ff3756e1abfde9acff0503548825aa2bee733e8b00207b32bf4ac42998b3ed1ec96496a2317a244f887c64fa551c00236f7e667506d8d921c93ae4536a1636b5