Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2024 20:46
Static task
static1
URLScan task
urlscan1
General
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3036 msedge.exe 3036 msedge.exe 3948 msedge.exe 3948 msedge.exe 4948 identity_helper.exe 4948 identity_helper.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe 4236 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3948 wrote to memory of 2448 3948 msedge.exe 82 PID 3948 wrote to memory of 2448 3948 msedge.exe 82 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3188 3948 msedge.exe 83 PID 3948 wrote to memory of 3036 3948 msedge.exe 84 PID 3948 wrote to memory of 3036 3948 msedge.exe 84 PID 3948 wrote to memory of 2588 3948 msedge.exe 85 PID 3948 wrote to memory of 2588 3948 msedge.exe 85 PID 3948 wrote to memory of 2588 3948 msedge.exe 85 PID 3948 wrote to memory of 2588 3948 msedge.exe 85 PID 3948 wrote to memory of 2588 3948 msedge.exe 85 PID 3948 wrote to memory of 2588 3948 msedge.exe 85 PID 3948 wrote to memory of 2588 3948 msedge.exe 85 PID 3948 wrote to memory of 2588 3948 msedge.exe 85 PID 3948 wrote to memory of 2588 3948 msedge.exe 85 PID 3948 wrote to memory of 2588 3948 msedge.exe 85 PID 3948 wrote to memory of 2588 3948 msedge.exe 85 PID 3948 wrote to memory of 2588 3948 msedge.exe 85 PID 3948 wrote to memory of 2588 3948 msedge.exe 85 PID 3948 wrote to memory of 2588 3948 msedge.exe 85 PID 3948 wrote to memory of 2588 3948 msedge.exe 85 PID 3948 wrote to memory of 2588 3948 msedge.exe 85 PID 3948 wrote to memory of 2588 3948 msedge.exe 85 PID 3948 wrote to memory of 2588 3948 msedge.exe 85 PID 3948 wrote to memory of 2588 3948 msedge.exe 85 PID 3948 wrote to memory of 2588 3948 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://url.us.m.mimecastprotect.com/s/V08hCjRBPnsn7y7vhRhYImlo2K?domain=paypal.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80bd346f8,0x7ff80bd34708,0x7ff80bd347182⤵PID:2448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,1020478513491072308,10921908196351732526,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵PID:3188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,1020478513491072308,10921908196351732526,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,1020478513491072308,10921908196351732526,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:82⤵PID:2588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1020478513491072308,10921908196351732526,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:3372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1020478513491072308,10921908196351732526,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵PID:3784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1020478513491072308,10921908196351732526,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:12⤵PID:4348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1020478513491072308,10921908196351732526,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:12⤵PID:2060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,1020478513491072308,10921908196351732526,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:82⤵PID:4488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,1020478513491072308,10921908196351732526,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1020478513491072308,10921908196351732526,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:12⤵PID:4612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1020478513491072308,10921908196351732526,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:12⤵PID:3260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1020478513491072308,10921908196351732526,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:12⤵PID:5112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1020478513491072308,10921908196351732526,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:12⤵PID:1976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,1020478513491072308,10921908196351732526,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4236
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2528
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5000
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD56960857d16aadfa79d36df8ebbf0e423
SHA1e1db43bd478274366621a8c6497e270d46c6ed4f
SHA256f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32
SHA5126deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe
-
Filesize
152B
MD5f426165d1e5f7df1b7a3758c306cd4ae
SHA159ef728fbbb5c4197600f61daec48556fec651c1
SHA256b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841
SHA5128d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6
-
Filesize
215KB
MD52be38925751dc3580e84c3af3a87f98d
SHA18a390d24e6588bef5da1d3db713784c11ca58921
SHA2561412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b
SHA5121341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize576B
MD543888cab28d7209c06fd6bd1bc2d3477
SHA13686194287e0827b32caafd67f6baf537fdce805
SHA256088a33b52f96994c8d652283364ef7db2759559f0552b997bae2c3db9f503bdf
SHA512c18d0639032ce42dc9ff2b08c11efeece7413c73224cb628546a97a15d9f1842a2523e431d715508fcc6fefb63e92aa164f52cd9850d6d608aa75500620226e3
-
Filesize
1KB
MD5cca9115c419d52b9112246b1347b4ade
SHA13e5d5b8368cb333b5e22b151eb08c752c82f74ae
SHA256fa76ee732ba3e2a3b59456db48d49fabf27a91c9d938d4c10950573e33186978
SHA5126d0b4f08e4c38cf96b7edd43028f717481b91bd53fc1d4c14fe9326c950fe84f2f60d003828b1d539f9bda5b3463aeeac3b68d242974bf3424843c67d5b42574
-
Filesize
6KB
MD521cf63a9ffd9591c888989be37430910
SHA16858e773b7e24111602fe13aca44820d4791065d
SHA2566da3fb5ff7750a1c5b912979b797cace1a6dfc326ad34f483f609a99671addda
SHA5120f32376c9dbcd4d56d0e2294c4c0858046db7a98a2b0958d41110e9181ede2a1b125fc2a522359283f99c8a56ce7e476af69536133aeda6b7f8749dea753a39d
-
Filesize
5KB
MD59592bffac65f0942579f163a74b2f98b
SHA1b8388cfbd4c4ad37f8361842e5a122ef186a7a35
SHA256eee5fd61f1f6fe1e3abca9c078aaf7ae908399ff662f69207582bcaf0ac2ec17
SHA5127a4e3aa1e24bd3e75b4f085f30cf337fa23b98067c6503ebe2d472e5852f9d3714097bd48f4de1f38bf82fbab8ffdcbd52f6ba93d9c91e8b6a8bb482bb8e5a1f
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD556433f82d3979918805ffe3100b564ec
SHA18b9147df21a326800af32758ddb12a1416729002
SHA256299a4aacef8345bfd8f76d3b4f223262966c7c0759f3d5e6f965fe42397f1867
SHA5123a6b531c920efa322b2801289b7dea3cd0ffbc985fc5b126387347b846d7e3fcd252d21bcf2fda498013b609a69159f83e6e0474740da7c7b904e9a3776dbdff