Analysis
-
max time kernel
71s -
max time network
75s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-01-2025 23:37
Static task
static1
URLScan task
urlscan1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1816 msedge.exe 1816 msedge.exe 2748 msedge.exe 2748 msedge.exe 2072 identity_helper.exe 2072 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe 2748 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2748 wrote to memory of 3644 2748 msedge.exe 82 PID 2748 wrote to memory of 3644 2748 msedge.exe 82 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 3336 2748 msedge.exe 83 PID 2748 wrote to memory of 1816 2748 msedge.exe 84 PID 2748 wrote to memory of 1816 2748 msedge.exe 84 PID 2748 wrote to memory of 4968 2748 msedge.exe 85 PID 2748 wrote to memory of 4968 2748 msedge.exe 85 PID 2748 wrote to memory of 4968 2748 msedge.exe 85 PID 2748 wrote to memory of 4968 2748 msedge.exe 85 PID 2748 wrote to memory of 4968 2748 msedge.exe 85 PID 2748 wrote to memory of 4968 2748 msedge.exe 85 PID 2748 wrote to memory of 4968 2748 msedge.exe 85 PID 2748 wrote to memory of 4968 2748 msedge.exe 85 PID 2748 wrote to memory of 4968 2748 msedge.exe 85 PID 2748 wrote to memory of 4968 2748 msedge.exe 85 PID 2748 wrote to memory of 4968 2748 msedge.exe 85 PID 2748 wrote to memory of 4968 2748 msedge.exe 85 PID 2748 wrote to memory of 4968 2748 msedge.exe 85 PID 2748 wrote to memory of 4968 2748 msedge.exe 85 PID 2748 wrote to memory of 4968 2748 msedge.exe 85 PID 2748 wrote to memory of 4968 2748 msedge.exe 85 PID 2748 wrote to memory of 4968 2748 msedge.exe 85 PID 2748 wrote to memory of 4968 2748 msedge.exe 85 PID 2748 wrote to memory of 4968 2748 msedge.exe 85 PID 2748 wrote to memory of 4968 2748 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://stenmcomnmunity.com/105382409641⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ff9e4f646f8,0x7ff9e4f64708,0x7ff9e4f647182⤵PID:3644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,8029675492375851611,12784019157384416585,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:22⤵PID:3336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,8029675492375851611,12784019157384416585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,8029675492375851611,12784019157384416585,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:82⤵PID:4968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,8029675492375851611,12784019157384416585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:1912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,8029675492375851611,12784019157384416585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:4908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,8029675492375851611,12784019157384416585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:12⤵PID:448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,8029675492375851611,12784019157384416585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 /prefetch:82⤵PID:1080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,8029675492375851611,12784019157384416585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,8029675492375851611,12784019157384416585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:12⤵PID:4408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,8029675492375851611,12784019157384416585,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:12⤵PID:1448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,8029675492375851611,12784019157384416585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:12⤵PID:4664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,8029675492375851611,12784019157384416585,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:12⤵PID:3384
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4664
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3236
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5fab8d8d865e33fe195732aa7dcb91c30
SHA12637e832f38acc70af3e511f5eba80fbd7461f2c
SHA2561b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea
SHA51239a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43
-
Filesize
152B
MD536988ca14952e1848e81a959880ea217
SHA1a0482ef725657760502c2d1a5abe0bb37aebaadb
SHA256d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6
SHA512d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize528B
MD5271625ac938f59209386d5d306f845df
SHA18286b135acbde9fa33a4513b93367311f07534d0
SHA2568974af8768a1a1ec71e6eb4e2e7d5de5dd28fe43180b77863aebdc92b8178552
SHA512f0a86900d182ffe6d5d8b8c9755f9641a1a5775451ec822bc919343ae0232a7ac9fb17228b934d9731476b6dcedb197b94bab000e7673ebc69d6cff5b2ee3366
-
Filesize
1KB
MD5468dcc6f695d761c181c05ffd3c91a4c
SHA188bb2ce4a7fef3fbf6c4263816cb7de5f522ba4e
SHA256761c8241c7d10c3914ef3aa84ccc15b526fdcd0184aae52aaa8f0fe0138b1b07
SHA51235c5d98d95f911765461e0421ea8f7a3e2c4217549254ec69aae15ce0f224cf94d91d6ded2d8e307ae9e59d55aaffe01075d3b116b6f57ca08ebe6d633287d15
-
Filesize
6KB
MD55e6c12c3200f3d4c36628290549911c2
SHA1339382eb5f1bdde660d70956b55bf8ea4f1dcb5d
SHA2565600183e92f6fdb66d7cfb8fd072379db4f5e96859b4bcf03e2836e90770cd0c
SHA51209e654056e72eda221c3ebab4a18b6338de27ad3b3ac14377e04fb8338c785dc9d2ae15ff66bd31216efc78fa8db4a1c0d2bc1c69e9c6075cbc6b904915c208f
-
Filesize
5KB
MD5ef520525d148091b72c77c79ab460c59
SHA106253b69205caad0f8a1d5dfd7515f2f949eef62
SHA25616ffe41d12171941bf22aefa06b6c574ffc12d9a86e7a51c56f4464c3855f2e3
SHA5125038d0bbc37c4953df8221bba08c6034681cb2de2eb486a83ab29f4b996e33f43e045266b5807fea935672c9f2db34986fc50cc3802c078c5ef7cfb6278b554d
-
Filesize
6KB
MD5b9eabe491aa4b54746a8e4e55a617d64
SHA1f80afd5c27c97ef0153e1f10c123a99dbd3bd0ac
SHA2568630e0e24ddb489e2eca0aa82dea2ff4d4538a44dc74d43f60d7159416d97077
SHA5128c5a66a2e60ba7bb4ee02cf30e09e6be49fae47bebb03ffe06883ef195d9e89226ed0350591dd506b1dacac62d293f2c5526ffd24e93dc6ed1d06f701c73f2fe
-
Filesize
6KB
MD51e6c19d1ba7872505a5d72024603f42a
SHA13e59bd101b01f73c709a68e72fcbcaaac758188b
SHA256cf1152914ab282fd2f7521d88dc731c97f91007e62303326a3c07809fa874658
SHA5121306a4dd6c5ddf8986afdd03903f0bda535e0239bc770bf0fa09a73c0b1e2e656bd0f2b8443a327a93c3db407d0abff45069e1cd225c562276548d8efa7eff9d
-
Filesize
1KB
MD5fe3ed3648219e38f816f28a5851c0be0
SHA1136112fc7d8ad13112896cc43f60d8761c9b9ed6
SHA25677677ad7cf051490567c366a6f1754278751534f34a5681f1972c18ae9ae4cb3
SHA51246b53390ed7abd6a96501ae661749d6bb69dbcad7b7a8441506c1f5c45dba71a903fadecb1034d999175f444e7c56f5032af4ae3cb401d6356fce7242783d49c
-
Filesize
1KB
MD5cd0605e15f2d8ead08de12a13fc0a6c5
SHA10095660005c9c225e54edf32e539a28fdf8a99ae
SHA2566cdba5e0aff3cb528e973531179f342104b41114d668022d671f11ae62d684f2
SHA512386b2895d562c25d34a8e735ea9f54a9e9ca40b84e1c1ea7faf392e7f1633fa0c28b4028d105410692b78c7b01a7fe7a1a71055c2bc883ba9dc7ff93d734de71
-
Filesize
1KB
MD5bde7d1f3ba37a932efa129e42ddc48a5
SHA13e31be8cac385d433e000c4633a85fc7cd4c085d
SHA256e9e70a7228a7374571653e0ecc84008149d7872eb9a73dd8c206410cc8d95a29
SHA512533e4d68c582f3a5506a9b32c74ea352bb6f43dd51f162a8b6e024e266b9f9d5cb6e79f58ff4daefe23baa4d82d5bee3420fb3db8928fea9f64a41f998b6d13a
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5a983a7de2d2ff7cf4b79231cf8407dd8
SHA1552d71234f9d00afaf122c48e66c6e6cb366b480
SHA25680b568a9d502e993189b3bd111c414765cef7d569323f2ff3061708b57ee4b78
SHA512c636037fe314257d11ef04c0c395cf581711260d1fa93d1e2c7ee66ddc07f78f3a0ba4418a9c36121ead124459cd6ed1a6c22f52016b4988679b409087138928
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84