18e39d11238d9ded6a88b808a02ced9247c30071b7acc4217640575901b16cdb

Analysis

max time kernel
1784s
max time network
1686s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2024 20:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

www.dev-c.com.url
Size

42B
MD5

6d1062a38a2c835b32bb73df4af90fc0
SHA1

6283703aed023c2a67ca5caa524f352885d0f3f9
SHA256

8250e69c27be10f67c387b69208c4df4aa7823c487a58abffb18a47c02e5ac58
SHA512

ae3f4280cc87311f367a9ecfb355024d242de0ed1f4dd0733580d9b3e8d802888b2fa2e7ad867ba9ab398eaeab4bdb8e3bfcb245130470d5f80981c5e796460a

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4028	msedge.exe
4028	msedge.exe
2300	msedge.exe
2300	msedge.exe
644	identity_helper.exe
644	identity_helper.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 2300	3800	rundll32.exe	81
PID 3800 wrote to memory of 2300	3800	rundll32.exe	81
PID 2300 wrote to memory of 664	2300	msedge.exe	83
PID 2300 wrote to memory of 664	2300	msedge.exe	83
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 1740	2300	msedge.exe	84
PID 2300 wrote to memory of 4028	2300	msedge.exe	85
PID 2300 wrote to memory of 4028	2300	msedge.exe	85
PID 2300 wrote to memory of 1924	2300	msedge.exe	86
PID 2300 wrote to memory of 1924	2300	msedge.exe	86
PID 2300 wrote to memory of 1924	2300	msedge.exe	86
PID 2300 wrote to memory of 1924	2300	msedge.exe	86
PID 2300 wrote to memory of 1924	2300	msedge.exe	86
PID 2300 wrote to memory of 1924	2300	msedge.exe	86
PID 2300 wrote to memory of 1924	2300	msedge.exe	86
PID 2300 wrote to memory of 1924	2300	msedge.exe	86
PID 2300 wrote to memory of 1924	2300	msedge.exe	86
PID 2300 wrote to memory of 1924	2300	msedge.exe	86
PID 2300 wrote to memory of 1924	2300	msedge.exe	86
PID 2300 wrote to memory of 1924	2300	msedge.exe	86
PID 2300 wrote to memory of 1924	2300	msedge.exe	86
PID 2300 wrote to memory of 1924	2300	msedge.exe	86
PID 2300 wrote to memory of 1924	2300	msedge.exe	86
PID 2300 wrote to memory of 1924	2300	msedge.exe	86
PID 2300 wrote to memory of 1924	2300	msedge.exe	86
PID 2300 wrote to memory of 1924	2300	msedge.exe	86

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\www.dev-c.com.url
1⤵
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://dev-c.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc868746f8,0x7ffc86874708,0x7ffc86874718
    3⤵
    PID:664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,474583242844665625,1100415747590361243,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
    3⤵
    PID:1740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,474583242844665625,1100415747590361243,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,474583242844665625,1100415747590361243,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
    3⤵
    PID:1924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,474583242844665625,1100415747590361243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
    3⤵
    PID:4512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,474583242844665625,1100415747590361243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
    3⤵
    PID:1700
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,474583242844665625,1100415747590361243,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
    3⤵
    PID:232
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,474583242844665625,1100415747590361243,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,474583242844665625,1100415747590361243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
    3⤵
    PID:4172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,474583242844665625,1100415747590361243,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
    3⤵
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,474583242844665625,1100415747590361243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
    3⤵
    PID:2212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,474583242844665625,1100415747590361243,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
    3⤵
    PID:1200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,474583242844665625,1100415747590361243,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4892 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
982b07a621d38ed40dfdf7d5fe7c5bfd

SHA1
43043d9e4cdba7c280d56218c8f032503e4be4e4

SHA256
5cc56d41e1ed1079d08178387d34b022fe7334502801f55b73ae9d7696ae13a2

SHA512
9ef7a38833b46063b392d5999bfdaf9ac05ddbe152bd68664bcacc544574485cb1ecf0e9bc500d77757324fca153bcd8c260fa08479dc6870ce3e7cd9555aaab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0df876ebe395b8607d2547fcbf6b2e9c

SHA1
d9c226e82c08e3d02b48c7bc4cf147dcf6fb362a

SHA256
66ba0d93cbac4cf296e3d16c9ac6da9c45e16180ef588c591f6de3e895f58958

SHA512
aedfa222e82aa7063930fba2b007b4b4476a1dd8bec37e581337e4f8f99d74717b27536dff65e54e70cb90011b5458551bbe56aee094fbb2f13b1e861f460080

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fc9d523da53f9288af6972b5cb01fff2

SHA1
62173ac271b445d6b6779e478a58828dac45fec1

SHA256
ca8694917288a52abd28c5f61edd6ccd18ae9ba1e9ef91f02a0f9ee97a834f6f

SHA512
a6b813dea3fce32477236653f673be35be45eed81b80469272eb42c14e6fb427d357a87a86c700e5393196bd78cd7cff2181dd149924e0bf0def9e7b1dda0241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
300125e3c27bb8a864aa1ab5d7a24e44

SHA1
5434a75ef35ce4d90cc1b7bb8a300a5de9f3f03c

SHA256
8a9ce1d6da1ba230b4aa0c3d4af1685900e05beb6031fbcdf4263d4eb6187e7c

SHA512
2eb8f5299bf71e7b332380dede69b7484e393acef3882643111bc041dd36dd3932b08b45f6f60435385a9a6c049f2e4780ac21bcecb08834599c4eeda3d0438c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ecb878c98379b1b35e8f896dd25e521b

SHA1
027ddafff4a525bcbef904fd00595900bc91ee2c

SHA256
0f33a21a15ba55add38a46f49d1514647b9dd04398c943a2bb1561c3861128bb

SHA512
20689ba7981d0ba5b7caaab7da58f3d2b89731a0b1d17728a0a96ed27ab1f838a7a7bffb164be3f3ee5aa4743d7125213da59a13ed5aa980076856dfbf521c3f

Download Submit