hxxps://www[.]amd[.]com/en/corporate[.]html

Analysis

max time kernel
324s
max time network
330s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 16:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.amd.com/en/corporate.html

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1580	msedge.exe
1580	msedge.exe
4748	msedge.exe
4748	msedge.exe
536	identity_helper.exe
536	identity_helper.exe
5864	msedge.exe
5864	msedge.exe
5864	msedge.exe
5864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe
4748	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 1188	4748	msedge.exe	83
PID 4748 wrote to memory of 1188	4748	msedge.exe	83
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 3696	4748	msedge.exe	84
PID 4748 wrote to memory of 1580	4748	msedge.exe	85
PID 4748 wrote to memory of 1580	4748	msedge.exe	85
PID 4748 wrote to memory of 1124	4748	msedge.exe	86
PID 4748 wrote to memory of 1124	4748	msedge.exe	86
PID 4748 wrote to memory of 1124	4748	msedge.exe	86
PID 4748 wrote to memory of 1124	4748	msedge.exe	86
PID 4748 wrote to memory of 1124	4748	msedge.exe	86
PID 4748 wrote to memory of 1124	4748	msedge.exe	86
PID 4748 wrote to memory of 1124	4748	msedge.exe	86
PID 4748 wrote to memory of 1124	4748	msedge.exe	86
PID 4748 wrote to memory of 1124	4748	msedge.exe	86
PID 4748 wrote to memory of 1124	4748	msedge.exe	86
PID 4748 wrote to memory of 1124	4748	msedge.exe	86
PID 4748 wrote to memory of 1124	4748	msedge.exe	86
PID 4748 wrote to memory of 1124	4748	msedge.exe	86
PID 4748 wrote to memory of 1124	4748	msedge.exe	86
PID 4748 wrote to memory of 1124	4748	msedge.exe	86
PID 4748 wrote to memory of 1124	4748	msedge.exe	86
PID 4748 wrote to memory of 1124	4748	msedge.exe	86
PID 4748 wrote to memory of 1124	4748	msedge.exe	86
PID 4748 wrote to memory of 1124	4748	msedge.exe	86
PID 4748 wrote to memory of 1124	4748	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.amd.com/en/corporate.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80d7746f8,0x7ff80d774708,0x7ff80d774718
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,13555522260109655376,12575477657699102118,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,13555522260109655376,12575477657699102118,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,13555522260109655376,12575477657699102118,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13555522260109655376,12575477657699102118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13555522260109655376,12575477657699102118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13555522260109655376,12575477657699102118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,13555522260109655376,12575477657699102118,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,13555522260109655376,12575477657699102118,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13555522260109655376,12575477657699102118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13555522260109655376,12575477657699102118,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13555522260109655376,12575477657699102118,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13555522260109655376,12575477657699102118,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,13555522260109655376,12575477657699102118,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4836 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
960B

MD5
0fe5ef3557bdfaf6c008d86e34e8c700

SHA1
f62de58af99a4b65344267a67ae9e40f471797f2

SHA256
edb9241431f94afa0aa1e4d4294c46704c2579a0c62504f188d75f8af4aaa5e4

SHA512
bf53fd818f4101590aa40c46f6b8087b3a741ea18462c7a3fed633c755697f22cb043ef3bed74587cbd586e9760f06b5803d96af556ebadbfbf7d75b56b07355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a613daf5999a5c11d95497e92c4da1a4

SHA1
9ed263619c67878ca32bed142da308e70fe5e39d

SHA256
4fb71af5f9ff3580b3f13ecc115625c878ce6aa9a90b5b9163f25a33bf08cf8c

SHA512
b7b84576856a19ca1a6be8bbc77bd3cb3caec9127e8baf64a26c20efb6c51fd4e7dcc087dcf7f5ab312eefcb0bc2317f55ed12f9886580f408482266e8877ba6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
827cbaf8f5f53073da381488e2d35251

SHA1
184f8350724deb54b5733c66e9f630bd37439dd4

SHA256
4cb998622c5be0bd989c99e46da38f7859de971bc5c230bbd35265c916e6d01d

SHA512
f4e09f58c2c23f7b4bb1445f9dbeee0a1caa463fbafeef60f1a5e0c03f24acbbad1d733def30c15780e8641ce9cab5903ec559dcfe8875863091dc2431a671a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a50459245772d0d0653701a4cacfb518

SHA1
6a6c2fa5012ca465716c95980d0dda3b7ce882f3

SHA256
26e1df0b79bc9a4f43460de8d8584fc2560484064da1ccd85d42519168bf1740

SHA512
1bf0d95a2c23c33077fe8ed8e5e08758e69481d8a5c5b0accb3b6a1086c7f4a027ecb0f244dfade1fd21eed18244bab9dec07dcca0465d35be3160fd9c0439bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3ca47c0b5bbabf0170104199a86fb605

SHA1
969fd007284c67d201d18e4a60f9aaf565be17a1

SHA256
8b732a5ce35429ac9881ff01ed672ed9a69a95af53e68a3ce4aabf319b991df6

SHA512
74b827ba082929b4c5087645854d477403c3f30e882c7b06d0614788c50f14c2385458b4caaeb9ed73358b5a7cc9e0cda23e411b73c5a2e70f0aa571d8d57d8c

Download Submit