b71f07964071f20aaeb5575d7273e2941853973defa6cb22160e126484d4a5d3

Analysis

max time kernel
145s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
19-02-2025 05:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

manual/manual.htm
Size

80KB
MD5

15036497c764bb502abd48efbb1fac46
SHA1

8b2bfb63b247078767b101581e4c63a8ab8792da
SHA256

0b72ba493a432e307df3a21d59ac255d301f56cc602cbc19b8e05885339bdd77
SHA512

3a5ed6e54384e7cea58bfceff7f47a6eaaacab6f95130b96865de2003882a13d33b76923a5eec41a33575814489e0f598683ef8a62dafad305b51f7caa953a05
SSDEEP

1536:vIyp2DSWFvOo7txeogjFSlPYJ4nA2RnZavtUcmTUna:oEFSZc4A2RnZavecmT7

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2428	msedge.exe
2428	msedge.exe
5116	msedge.exe
5116	msedge.exe
3364	identity_helper.exe
3364	identity_helper.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe
5116	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 2556	5116	msedge.exe	86
PID 5116 wrote to memory of 2556	5116	msedge.exe	86
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 4488	5116	msedge.exe	87
PID 5116 wrote to memory of 2428	5116	msedge.exe	88
PID 5116 wrote to memory of 2428	5116	msedge.exe	88
PID 5116 wrote to memory of 1960	5116	msedge.exe	89
PID 5116 wrote to memory of 1960	5116	msedge.exe	89
PID 5116 wrote to memory of 1960	5116	msedge.exe	89
PID 5116 wrote to memory of 1960	5116	msedge.exe	89
PID 5116 wrote to memory of 1960	5116	msedge.exe	89
PID 5116 wrote to memory of 1960	5116	msedge.exe	89
PID 5116 wrote to memory of 1960	5116	msedge.exe	89
PID 5116 wrote to memory of 1960	5116	msedge.exe	89
PID 5116 wrote to memory of 1960	5116	msedge.exe	89
PID 5116 wrote to memory of 1960	5116	msedge.exe	89
PID 5116 wrote to memory of 1960	5116	msedge.exe	89
PID 5116 wrote to memory of 1960	5116	msedge.exe	89
PID 5116 wrote to memory of 1960	5116	msedge.exe	89
PID 5116 wrote to memory of 1960	5116	msedge.exe	89
PID 5116 wrote to memory of 1960	5116	msedge.exe	89
PID 5116 wrote to memory of 1960	5116	msedge.exe	89
PID 5116 wrote to memory of 1960	5116	msedge.exe	89
PID 5116 wrote to memory of 1960	5116	msedge.exe	89
PID 5116 wrote to memory of 1960	5116	msedge.exe	89
PID 5116 wrote to memory of 1960	5116	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\manual\manual.htm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffca0c46f8,0x7fffca0c4708,0x7fffca0c4718
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,5067428564001812406,488628931928919700,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,5067428564001812406,488628931928919700,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,5067428564001812406,488628931928919700,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5067428564001812406,488628931928919700,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5067428564001812406,488628931928919700,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,5067428564001812406,488628931928919700,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,5067428564001812406,488628931928919700,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5067428564001812406,488628931928919700,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5067428564001812406,488628931928919700,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5067428564001812406,488628931928919700,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5067428564001812406,488628931928919700,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,5067428564001812406,488628931928919700,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4812 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\54df62cf-4b8e-4a1e-b47a-4f1f2e649018.tmp

Filesize
11KB

MD5
bac6a6776f6ea236f4ddb510952fd117

SHA1
4b2c571cdbc3e6173a2d064d8c25289a831ca924

SHA256
bbc50ba17d8ef82df01669799c2171cbb39ae2b6622d31bd4c2b893f92a90ff1

SHA512
a25ae8a61499ea470ac01e82c868300b207fefc255b2ba36bbbaf56dcf49b8a533102b664b3d01f1e45dced9aef9b8aa14e82f8d73a283b090e09e53a918af10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
010f6dd77f14afcb78185650052a120d

SHA1
76139f0141fa930b6460f3ca6f00671b4627dc98

SHA256
80321891fd7f7c02dd4be4e5be09f8e57d49e076c750f8deb300be8f600de2d7

SHA512
6e6c9e348e948b946cfb97478698423e1272c4417bc8540e5daa64858e28be8fda5baf28538aee849f8bb409c17a51c60e48a3f1793e3a86cb27edeb32aa30a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f09c5037ff47e75546f2997642cac037

SHA1
63d599921be61b598ef4605a837bb8422222bef2

SHA256
ba61197fff5ed487084790b869045ab41830bdf6db815503e8e064dd4e4df662

SHA512
280bff6eac4b2b4fe515696223f61531f6b507c4c863ad9eef5ab0b1d65d264eba74fb7c9314b6920922142b8ab7605792211fca11a9a9ef0fc2ae995bf4f473

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
563588e54886a33ceca31536036eaf8a

SHA1
e4b2b81edcdab7bc7ac67f1049bb9bda6ca3d06b

SHA256
4303510791c42f5074b161cd8d1b01baba4216f4929455b2e1d09887d8ea7226

SHA512
48226ccef0c38fc710b0f8de6698b7e3d62b5402c1a9a7cafb94257d92d3b7e2fc394fb43cb6829e0f5b38a44a85197dc20e547812abec1d45c6896c47a1bea8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4b2945037092522d57efc8b9c5e3897e

SHA1
72f928a43aa1335b2219cd2ebd5f8e081a1b0cb5

SHA256
5321dc0206ea57492853edbb534843af6c490aa3d729e9e9958647a027f03cb7

SHA512
cb42df6ef645ba10ccf5f378eec6e5881ca714c5a175499e57d4f7021381b054d573ce8fed79a6e017884e3d5f9e79a4ec28abf72f7f8cde96b8be96aeedc7fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit