Analysis
-
max time kernel
14s -
max time network
15s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 17:09
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2636 msedge.exe 2636 msedge.exe 1288 msedge.exe 1288 msedge.exe 1488 identity_helper.exe 1488 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe 1288 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1288 wrote to memory of 5008 1288 msedge.exe 83 PID 1288 wrote to memory of 5008 1288 msedge.exe 83 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 1716 1288 msedge.exe 84 PID 1288 wrote to memory of 2636 1288 msedge.exe 85 PID 1288 wrote to memory of 2636 1288 msedge.exe 85 PID 1288 wrote to memory of 1832 1288 msedge.exe 86 PID 1288 wrote to memory of 1832 1288 msedge.exe 86 PID 1288 wrote to memory of 1832 1288 msedge.exe 86 PID 1288 wrote to memory of 1832 1288 msedge.exe 86 PID 1288 wrote to memory of 1832 1288 msedge.exe 86 PID 1288 wrote to memory of 1832 1288 msedge.exe 86 PID 1288 wrote to memory of 1832 1288 msedge.exe 86 PID 1288 wrote to memory of 1832 1288 msedge.exe 86 PID 1288 wrote to memory of 1832 1288 msedge.exe 86 PID 1288 wrote to memory of 1832 1288 msedge.exe 86 PID 1288 wrote to memory of 1832 1288 msedge.exe 86 PID 1288 wrote to memory of 1832 1288 msedge.exe 86 PID 1288 wrote to memory of 1832 1288 msedge.exe 86 PID 1288 wrote to memory of 1832 1288 msedge.exe 86 PID 1288 wrote to memory of 1832 1288 msedge.exe 86 PID 1288 wrote to memory of 1832 1288 msedge.exe 86 PID 1288 wrote to memory of 1832 1288 msedge.exe 86 PID 1288 wrote to memory of 1832 1288 msedge.exe 86 PID 1288 wrote to memory of 1832 1288 msedge.exe 86 PID 1288 wrote to memory of 1832 1288 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://is.gd/DjGj071⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbbcbc46f8,0x7ffbbcbc4708,0x7ffbbcbc47182⤵PID:5008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7980408890713610112,8919494380057936820,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵PID:1716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,7980408890713610112,8919494380057936820,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,7980408890713610112,8919494380057936820,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:82⤵PID:1832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7980408890713610112,8919494380057936820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:4044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7980408890713610112,8919494380057936820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:5064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,7980408890713610112,8919494380057936820,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:82⤵PID:4820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,7980408890713610112,8919494380057936820,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7980408890713610112,8919494380057936820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:12⤵PID:3868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7980408890713610112,8919494380057936820,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:12⤵PID:1416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7980408890713610112,8919494380057936820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:12⤵PID:3548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7980408890713610112,8919494380057936820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:12⤵PID:1060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7980408890713610112,8919494380057936820,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:12⤵PID:3520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7980408890713610112,8919494380057936820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:12⤵PID:608
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3600
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5048
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Filesize328B
MD56e80dd68f06f1f0a68d88f8ccd2deb55
SHA1d9db6c92e9a0460344b81c91fedff8498cf10579
SHA256dca7bfe18bda71538f89c55c5daf3c4a8013a3be7590ba20881ed6e05a12cabf
SHA512fed565d50a577776eda81cd896300d106ae049daaf8878fd853f2836907ddc0b2e4ea7d1ef3223fd7b3a059ea20641de65fda302f8dff35a7743dcc87c09de92
-
Filesize
152B
MD50a9dc42e4013fc47438e96d24beb8eff
SHA1806ab26d7eae031a58484188a7eb1adab06457fc
SHA25658d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151
SHA512868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f
-
Filesize
152B
MD561cef8e38cd95bf003f5fdd1dc37dae1
SHA111f2f79ecb349344c143eea9a0fed41891a3467f
SHA256ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
SHA5126fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize408B
MD5ce78a6eeecefde4bf9528be3c1436b1f
SHA1e63ac4e87ba5b55a69774a3b93ddc915f9000289
SHA2564871244bd8159aa113f367e84de780d280bba94201a2d695a13ccb138626aded
SHA5129315bb43b105989760fc6fd01f4517275da20993581011edcfd2e609060ae85d478a35843da811c1acf8ecd9a8b96df658495ee4de648be89cba428879e6ed03
-
Filesize
574B
MD533bf5c94454ea65a30d5b1409429a343
SHA18a20ab5303b0304b0cd2b3bf246f749b2b8bdd90
SHA2562e96f76fc48e0487e8c56a04b5e24dfe19787b8e42e95174807cf69e9c82093e
SHA512393ecbdf3d91f20ca8a34dcdbba126c8faa8128938a55a500fd6f42c2c7ec68ef4168b55daa98f6b03873c2c260c69ecfe75f056d73c9530191fa36008d0395e
-
Filesize
6KB
MD532718cd3bdd4f01d8eac126933bade6f
SHA1500c1cda7a4e7cbad41766f1c474d42489df074a
SHA2562c4f6a0a3dfdeafc98427dd004874210cece49d64c108e14d15a6296a7b65796
SHA51288e044a4d02fd0f09c4ec315bef002bf8f259237c06f4eb506e117e40e602583c7ccc50863dad97606ca0f39695a94781e1202660f61644959dc28760df3bd17
-
Filesize
5KB
MD51d45e0c8ff69ba558f77783d7d804aed
SHA1bd02a0e3d4973eb6b4865b06a891adf9db5877a6
SHA2568e0bd6eff52f9ed15617abd6f7bbb8b26d52f0b4f5e20478a35a658e8bfb516f
SHA512764518cd8726a298cc199c5f616587f2d1ea6a4eb1af0801990348bfb9e3e52e7727dbdb37c7d71f1b0b4f9a2b87f092f9fccb12e8060122d513969a1e791f98
-
Filesize
6KB
MD54be1b224436b267d9dbb5d121cb3a392
SHA10f6dad740536a98ea68610b8408a98d6b04f698b
SHA25649bf229cb9b98caba074a20cb90ca5024d9b11ce848cfbe3d98b657d5e245ac8
SHA51268439b306f7209111da126c67475f1ae0ea1ddcb5c37e13b87fedcbd670389acb220ca7e64a56475bf25ffd1a5157f2bff8d60d99ec98b5408678362afd63b8b
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5f6ac62c9e410a92f72947bb6d85d60c7
SHA1c02cb4ec6098dd4a635c105cd96d457710f44133
SHA2560925aef3ecb69bf3bc4deab8ffeee617a1afb6fef19630064276096c149b64b0
SHA512a89eb61e7157f58dbcb3446d92281517975c55240f091cc1b18306ed30d3876d3cbf18a49172a2bf8292468df26c6a59fa1fda4557e8ac024f38342f7dafea58
-
Filesize
10KB
MD5aded21c07ffdfdbcb6317b75c31cd1bf
SHA153ff1b74fd8ccb65127d928d51227ce6a41c70c4
SHA2564eb2ab6c834576985a3e31d090fe71a817ece66d6b1aff5901ede917e8f80d6d
SHA51240206f727bd1649d31c1d4a1d9699fa4990ff8b4fb61d8d12f18d96c1793233279a533b2c06495e1966cddb52ff240367325ad6ccd6ee73051b436525c4f8431