3a3be4d63ea60273d2a4eda55d735e5f5066d564b9512ef0852e075e684bdd46

Analysis

max time kernel
145s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
31/01/2025, 16:38 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LICENSES.chromium.html
Size

7.9MB
MD5

0e3e4362f785aff0b9e1852b1064c0f1
SHA1

a42ccb51e72bdcb5bb905a62efaa28857def3a17
SHA256

bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d
SHA512

193b57efc5f5971fbd9e4ea1a80b34aadcc2a814ff49c4c06afe972bf327e98ff0498217a8bdef984b10fdec6e7858a6fb88c0b14936e0c6b404387a426b87f2
SSDEEP

24576:dbTj6ck6f5kVWS6RqLsWN3Omfpe666A6f6X6TTHW9GqpaE:tEx/i

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe
4160	msedge.exe
4160	msedge.exe
1944	identity_helper.exe
1944	identity_helper.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe
2108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe
4160	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 3644	4160	msedge.exe	84
PID 4160 wrote to memory of 3644	4160	msedge.exe	84
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 1144	4160	msedge.exe	85
PID 4160 wrote to memory of 4452	4160	msedge.exe	86
PID 4160 wrote to memory of 4452	4160	msedge.exe	86
PID 4160 wrote to memory of 3952	4160	msedge.exe	87
PID 4160 wrote to memory of 3952	4160	msedge.exe	87
PID 4160 wrote to memory of 3952	4160	msedge.exe	87
PID 4160 wrote to memory of 3952	4160	msedge.exe	87
PID 4160 wrote to memory of 3952	4160	msedge.exe	87
PID 4160 wrote to memory of 3952	4160	msedge.exe	87
PID 4160 wrote to memory of 3952	4160	msedge.exe	87
PID 4160 wrote to memory of 3952	4160	msedge.exe	87
PID 4160 wrote to memory of 3952	4160	msedge.exe	87
PID 4160 wrote to memory of 3952	4160	msedge.exe	87
PID 4160 wrote to memory of 3952	4160	msedge.exe	87
PID 4160 wrote to memory of 3952	4160	msedge.exe	87
PID 4160 wrote to memory of 3952	4160	msedge.exe	87
PID 4160 wrote to memory of 3952	4160	msedge.exe	87
PID 4160 wrote to memory of 3952	4160	msedge.exe	87
PID 4160 wrote to memory of 3952	4160	msedge.exe	87
PID 4160 wrote to memory of 3952	4160	msedge.exe	87
PID 4160 wrote to memory of 3952	4160	msedge.exe	87
PID 4160 wrote to memory of 3952	4160	msedge.exe	87
PID 4160 wrote to memory of 3952	4160	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeb53146f8,0x7ffeb5314708,0x7ffeb5314718
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,16425515196142798014,16261212681718392032,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,16425515196142798014,16261212681718392032,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,16425515196142798014,16261212681718392032,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16425515196142798014,16261212681718392032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16425515196142798014,16261212681718392032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,16425515196142798014,16261212681718392032,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,16425515196142798014,16261212681718392032,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16425515196142798014,16261212681718392032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16425515196142798014,16261212681718392032,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16425515196142798014,16261212681718392032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16425515196142798014,16261212681718392032,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,16425515196142798014,16261212681718392032,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3452 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3612

Network

DNS

136.32.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

136.32.126.40.in-addr.arpa

IN PTR

Response
DNS

86.49.80.91.in-addr.arpa

Remote address:

8.8.8.8:53

Request

86.49.80.91.in-addr.arpa

IN PTR

Response
DNS

197.87.175.4.in-addr.arpa

Remote address:

8.8.8.8:53

Request

197.87.175.4.in-addr.arpa

IN PTR

Response
DNS

206.23.85.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

206.23.85.13.in-addr.arpa

IN PTR

Response
DNS

21.49.80.91.in-addr.arpa

Remote address:

8.8.8.8:53

Request

21.49.80.91.in-addr.arpa

IN PTR

Response
DNS

172.210.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.210.232.199.in-addr.arpa

IN PTR

Response
DNS

31.243.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

31.243.111.52.in-addr.arpa

IN PTR

Response

No results found

8.8.8.8:53

136.32.126.40.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

136.32.126.40.in-addr.arpa
8.8.8.8:53

86.49.80.91.in-addr.arpa

dns

70 B
145 B
1
1

DNS Request

86.49.80.91.in-addr.arpa
224.0.0.251:5353

582 B
9
8.8.8.8:53

197.87.175.4.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

197.87.175.4.in-addr.arpa
8.8.8.8:53

206.23.85.13.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

206.23.85.13.in-addr.arpa
8.8.8.8:53

21.49.80.91.in-addr.arpa

dns

70 B
145 B
1
1

DNS Request

21.49.80.91.in-addr.arpa
8.8.8.8:53

172.210.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.210.232.199.in-addr.arpa
8.8.8.8:53

31.243.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

31.243.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0504c0d0b9c007a767de8a404f2ec484

SHA1
73b1066ce283079341bc94a3e5c65535f0523145

SHA256
3469f4679beea250ce59f3fa4721e48f81587735f44e0fa2b70638b78dbf8a2d

SHA512
c6c0c6edbaab3b92832c4140916e99ca6725b79e5d3a43ad59ebd94a567458ef79923e2236b43344ecb6fd75442d0c7779b024edbd1bf9035a2a86ba7e5ce606

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
50236cd957789ed0d1b6564c7f0ecfae

SHA1
4c9e4dac57ab9ffb5bc55154d6ff89f1e6c1d5f4

SHA256
5820467c07d06249a1462b7c9deeb0801a8a6475ea19637397b9bbbc95f90fcd

SHA512
1cbf4be5224fecf811bf81361d6d282810de016194b17e2002d510287d384048272215b813838912eebcdddb1f657ade0aa3c122871c9d636b6a8fa8e74535d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
06f4bdd9db094e977e1efbeba9445e35

SHA1
02bcedd3f5d8cb268b91a71a4f76126762fb0e48

SHA256
2a172f3a2768be761de0771587b5ee7be1f3da00c8785beb68e253e802560e8b

SHA512
89d8bdf56eb2a94922d451ef9699f6fe73ca73dfb2bcbbc16e6b5e9a2bb9545aeca7fdced806b15521296872674e77c357ed98d3ac97f49cdb8cf5e6ad70c493

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8351264522b1705bd560e274ac53a5dc

SHA1
b7598bb6f09076a01340d7ef99881ecaac62793d

SHA256
94c234c4e97d868fe01b263a94ac854e14cfe00f5354afee265e1141bed3b1a3

SHA512
fb01d2c2e8fe540ce15c11d134896cfd533d336ba75abfb52c7788d35e3d1c156c75da00673b79f6c52507a3439618eb2625c9d2b0f2c24b194f38c19b46e377

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4e3721e2897635046ccc32405058c6ea

SHA1
4628d40c22aa0b9b5c390c717fd2860d6c96dfca

SHA256
2974d63a687f24b90cec16dcb42c79ff776b8e5f651a361473b9973f1e210cfe

SHA512
7eec7f786c5654da923d8292c937ba624cebc2569f0a4d664688b63b810ee9326eec8dc33e0b8a3309ceb52045ef1e8b2da7bc09c69a49495f9b4686da36bfa1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.