hxxps://paste[.]fo/9253e43132b4

Resubmissions

01-01-2025 23:30

250101-3hlx9ssqak 3

03-11-2024 12:27

241103-pm75eawrhr 10

03-11-2024 12:08

241103-pa16bstcrf 8

Analysis

max time kernel
118s
max time network
97s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
01-01-2025 23:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://paste.fo/9253e43132b4

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
2472	msedge.exe
2472	msedge.exe
1896	identity_helper.exe
1896	identity_helper.exe
2700	msedge.exe
2700	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 1548	2472	msedge.exe	77
PID 2472 wrote to memory of 1548	2472	msedge.exe	77
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 1700	2472	msedge.exe	78
PID 2472 wrote to memory of 3424	2472	msedge.exe	79
PID 2472 wrote to memory of 3424	2472	msedge.exe	79
PID 2472 wrote to memory of 3504	2472	msedge.exe	80
PID 2472 wrote to memory of 3504	2472	msedge.exe	80
PID 2472 wrote to memory of 3504	2472	msedge.exe	80
PID 2472 wrote to memory of 3504	2472	msedge.exe	80
PID 2472 wrote to memory of 3504	2472	msedge.exe	80
PID 2472 wrote to memory of 3504	2472	msedge.exe	80
PID 2472 wrote to memory of 3504	2472	msedge.exe	80
PID 2472 wrote to memory of 3504	2472	msedge.exe	80
PID 2472 wrote to memory of 3504	2472	msedge.exe	80
PID 2472 wrote to memory of 3504	2472	msedge.exe	80
PID 2472 wrote to memory of 3504	2472	msedge.exe	80
PID 2472 wrote to memory of 3504	2472	msedge.exe	80
PID 2472 wrote to memory of 3504	2472	msedge.exe	80
PID 2472 wrote to memory of 3504	2472	msedge.exe	80
PID 2472 wrote to memory of 3504	2472	msedge.exe	80
PID 2472 wrote to memory of 3504	2472	msedge.exe	80
PID 2472 wrote to memory of 3504	2472	msedge.exe	80
PID 2472 wrote to memory of 3504	2472	msedge.exe	80
PID 2472 wrote to memory of 3504	2472	msedge.exe	80
PID 2472 wrote to memory of 3504	2472	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://paste.fo/9253e43132b4
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff858863cb8,0x7ff858863cc8,0x7ff858863cd8
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,6624435932811106257,9582750646110471057,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,6624435932811106257,9582750646110471057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,6624435932811106257,9582750646110471057,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6624435932811106257,9582750646110471057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6624435932811106257,9582750646110471057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6624435932811106257,9582750646110471057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,6624435932811106257,9582750646110471057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6624435932811106257,9582750646110471057,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6624435932811106257,9582750646110471057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6624435932811106257,9582750646110471057,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,6624435932811106257,9582750646110471057,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4644 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6624435932811106257,9582750646110471057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6624435932811106257,9582750646110471057,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6624435932811106257,9582750646110471057,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:2780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aad1d98ca9748cc4c31aa3b5abfe0fed

SHA1
32e8d4d9447b13bc00ec3eb15a88c55c29489495

SHA256
2a07cac05ffcf140a9ad32e58ef51b32ecccf1e3ab5ef4e656770df813a8944e

SHA512
150ebf7e37d20f88b21ab7ea0793afe1d40b00611ed36f0cf1ac1371b656d26f11b08a84dbb958891c79776fae04c9c616e45e2e211d292988a5709857a3bf72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cb557349d7af9d6754aed39b4ace5bee

SHA1
04de2ac30defbb36508a41872ddb475effe2d793

SHA256
cfc24ed7d1c2e2c6585f53db7b39aa2447bf9212487b0a3c8c2a7d8e7e5572ee

SHA512
f0cf51f42d975d720d613d09f201435bf98c6283ae5bc033207f4ada93b15e49743a235a1cfb1b761bde268e2f7f8561aa57619b99bff67a36820bc1a4d0ec4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
bb08ce839f9354cbd1595b208e2ef4a4

SHA1
228287677f627ec0dca7237e8aa44771888ddeab

SHA256
bbf09ee29acb069ee9567fc3e139f817e76d544dfdbf9718f6fdbafc37ba9f6d

SHA512
acc4100bc0d285ae885dd31322cacd1e17727877047cec9c30ee7b4aca3fd055dfe96bd8735ff3a7b599836465905a205b90b4d75ae94c302b5ccc5373e01e6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
905df17ee313eaa598eab5e9ff36b6b2

SHA1
14a16766965da5beedc1520fb868351bacc2078c

SHA256
4ea7186d33e34d401729a2de494173b1655e24b44e23c4aaa16517f22a2067cc

SHA512
e7163e2f8e1fee429d048c6ba3aa47859680d5b330e221dbc4c1a4e247629625d42bb5555566a8c0c02de28b2eccfc2a2cb326cde09a02af2aef90b4c2206b56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
91caf89d9ba98e90ebde0a29713b0ec2

SHA1
741a50723e10c18cc3f4115db9c03e3c5bace4bf

SHA256
841d46a1d30ab30c1604c6d38324eb719c157fc662f9029c6ba4b04de1c7e26f

SHA512
05be99cd693e499c74c099f13041b65cee25336b2b69aae97caa227728be95a29d60897c866cfa2a6c0c17c9c4ca7cb7285e0a9a481836be8d9769c6cd6364cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5e4b419a8cd38651a021f508146447a8

SHA1
a79e6ef09d07e1945b762d557136d2e646b39c8a

SHA256
09569397b9471df50bb439bc524f0dfdab01ab286879100f44ad33229dbf9669

SHA512
3b3f1b6d93e39495795d81bca31a42600984b7196c704d71304781a41857dc9a312d85a5b0a5ecf6ac97e60d0d6a4cb67ad7d390c081525f948244f841632c9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8573bc5633c60db1fe60c38de8410527

SHA1
1c9bfc01edba3408387e64a2474338996c2429f3

SHA256
32a5c6e732615283ee64d8cc1425ac93c08083ecf4d13cb0234e49ec11601799

SHA512
5964f80596e9c026887a72050092ec2f9f0c8d8fe9561b40b665bc7cfc6753ff9f6077fb230c62f87aace5a3736d859f5778e08a1ece114cd2f2dff782809094

Download Submit