4c9acf9fa885bf772564bfaa6771b776b45d0e8daa3ce0bf89b05f4d87085686

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 00:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Burst Royale 0.9/Engine/FxCEF/error/en-US/error.html
Size

3KB
MD5

a80ce5096a8c14231cdc7125c0e41dfe
SHA1

5ed2d7eb3fd5d12e7465c0728934c83443bbc2a1
SHA256

976675c7bbf80db12765a17985f492f3386dea55c11cba78517234218eeed83c
SHA512

06284ad305e89d947aa74bf5f7c30f2243c29396d5f07c3643750ea587ef760d9e2fb663bc7699d4aafab189d05e5d9e20c739e99a339a4ebb8ce4b94b24d8ef

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
820	msedge.exe
820	msedge.exe
1844	msedge.exe
1844	msedge.exe
2000	identity_helper.exe
2000	identity_helper.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 4544	1844	msedge.exe	81
PID 1844 wrote to memory of 4544	1844	msedge.exe	81
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 3112	1844	msedge.exe	83
PID 1844 wrote to memory of 820	1844	msedge.exe	84
PID 1844 wrote to memory of 820	1844	msedge.exe	84
PID 1844 wrote to memory of 2864	1844	msedge.exe	85
PID 1844 wrote to memory of 2864	1844	msedge.exe	85
PID 1844 wrote to memory of 2864	1844	msedge.exe	85
PID 1844 wrote to memory of 2864	1844	msedge.exe	85
PID 1844 wrote to memory of 2864	1844	msedge.exe	85
PID 1844 wrote to memory of 2864	1844	msedge.exe	85
PID 1844 wrote to memory of 2864	1844	msedge.exe	85
PID 1844 wrote to memory of 2864	1844	msedge.exe	85
PID 1844 wrote to memory of 2864	1844	msedge.exe	85
PID 1844 wrote to memory of 2864	1844	msedge.exe	85
PID 1844 wrote to memory of 2864	1844	msedge.exe	85
PID 1844 wrote to memory of 2864	1844	msedge.exe	85
PID 1844 wrote to memory of 2864	1844	msedge.exe	85
PID 1844 wrote to memory of 2864	1844	msedge.exe	85
PID 1844 wrote to memory of 2864	1844	msedge.exe	85
PID 1844 wrote to memory of 2864	1844	msedge.exe	85
PID 1844 wrote to memory of 2864	1844	msedge.exe	85
PID 1844 wrote to memory of 2864	1844	msedge.exe	85
PID 1844 wrote to memory of 2864	1844	msedge.exe	85
PID 1844 wrote to memory of 2864	1844	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\Burst Royale 0.9\Engine\FxCEF\error\en-US\error.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8344446f8,0x7ff834444708,0x7ff834444718
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,3275001700117833280,2919381306646085422,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,3275001700117833280,2919381306646085422,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,3275001700117833280,2919381306646085422,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3275001700117833280,2919381306646085422,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3275001700117833280,2919381306646085422,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,3275001700117833280,2919381306646085422,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,3275001700117833280,2919381306646085422,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3275001700117833280,2919381306646085422,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3275001700117833280,2919381306646085422,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3275001700117833280,2919381306646085422,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3275001700117833280,2919381306646085422,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,3275001700117833280,2919381306646085422,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4612 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
afd1255c8ac9686fb2560c9cb62d3716

SHA1
4b93d0f3397d38194d13a2da1be16186a85c75ed

SHA256
f01489e0367ff815c848002177789263f257a67b4d27fc33d64ebfb7455258a5

SHA512
4956160014232fbcc57bee343a5c2f4a028017b487fac7ab9ad03380d7a52b294f0734e8a28b214a7b7bc361802bce3b9335332d23d3aca707e7c7cd06aa5e13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
52b5f121ce2b306c7e25104850a71ae4

SHA1
a56ec556f7b429fe63a57fdec80aedef2e9ead88

SHA256
5b554855714c9e510ed7b49cd929efbdf3ea39a60842f6e1fdb6b31adcdd01df

SHA512
14c56d92674c6d14f8fd8a95c980ed18abaf8ae638cb666fb2419cf8cccd150d48d8b74b560bc23177ef729118b8ec4dcbcc3c37fe3d930dedda34433305375e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
38a45237018357a8d84e152cd5f1849e

SHA1
164415dd592d47eec876259678d88e0f7bc34ca8

SHA256
1720b6bf7347ddf6eb4c509b2505a05a0735fb9ae9051f6e8c3e55ac07772695

SHA512
1850df038202df5fcc2eb634933888bdf90b4c8b987bd36a55db6cc49130a6eab029219ed96be9c0940446675c8eac6c8b7c477c7a5154390a0906bc01869416

Download Submit