1824be1799f0c32c14c5fcb3c5d34c98b9fb4d2b867067b8ddc3d129783812fe

Analysis

max time kernel
145s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
26/02/2025, 23:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

quarantine/imfsCjY.html
Size

162B
MD5

1b7c22a214949975556626d7217e9a39
SHA1

d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256

340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512

ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1280	msedge.exe
1280	msedge.exe
4048	msedge.exe
4048	msedge.exe
1184	identity_helper.exe
1184	identity_helper.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 4064	4048	msedge.exe	86
PID 4048 wrote to memory of 4064	4048	msedge.exe	86
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 2896	4048	msedge.exe	87
PID 4048 wrote to memory of 1280	4048	msedge.exe	88
PID 4048 wrote to memory of 1280	4048	msedge.exe	88
PID 4048 wrote to memory of 2452	4048	msedge.exe	89
PID 4048 wrote to memory of 2452	4048	msedge.exe	89
PID 4048 wrote to memory of 2452	4048	msedge.exe	89
PID 4048 wrote to memory of 2452	4048	msedge.exe	89
PID 4048 wrote to memory of 2452	4048	msedge.exe	89
PID 4048 wrote to memory of 2452	4048	msedge.exe	89
PID 4048 wrote to memory of 2452	4048	msedge.exe	89
PID 4048 wrote to memory of 2452	4048	msedge.exe	89
PID 4048 wrote to memory of 2452	4048	msedge.exe	89
PID 4048 wrote to memory of 2452	4048	msedge.exe	89
PID 4048 wrote to memory of 2452	4048	msedge.exe	89
PID 4048 wrote to memory of 2452	4048	msedge.exe	89
PID 4048 wrote to memory of 2452	4048	msedge.exe	89
PID 4048 wrote to memory of 2452	4048	msedge.exe	89
PID 4048 wrote to memory of 2452	4048	msedge.exe	89
PID 4048 wrote to memory of 2452	4048	msedge.exe	89
PID 4048 wrote to memory of 2452	4048	msedge.exe	89
PID 4048 wrote to memory of 2452	4048	msedge.exe	89
PID 4048 wrote to memory of 2452	4048	msedge.exe	89
PID 4048 wrote to memory of 2452	4048	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\quarantine\imfsCjY.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff368746f8,0x7fff36874708,0x7fff36874718
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,5344871935703245366,431872264833848507,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,5344871935703245366,431872264833848507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,5344871935703245366,431872264833848507,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,5344871935703245366,431872264833848507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,5344871935703245366,431872264833848507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,5344871935703245366,431872264833848507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,5344871935703245366,431872264833848507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,5344871935703245366,431872264833848507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,5344871935703245366,431872264833848507,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,5344871935703245366,431872264833848507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,5344871935703245366,431872264833848507,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,5344871935703245366,431872264833848507,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1828 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
25f87986bcd72dd045d9b8618fb48592

SHA1
c2d9b4ec955b8840027ff6fd6c1f636578fef7b5

SHA256
d8b542281740c12609279f2549f85d3c94e6e49a3a2a4b9698c93cca2dce486c

SHA512
0c8a0d1a3b0d4b30773b8519a3d6e63d92973733da818ca9838599a9639e18df18ce31ebf56f46f6bbb7d89d10c726f4d73781e154d115a6068a3be7dd12b314

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
94bd9c36e88be77b106069e32ac8d934

SHA1
32bd157b84cde4eaf93360112d707056fc5b0b86

SHA256
8f49a43a08e2984636b172a777d5b3880e6e82ad25b427fef3f05b7b4f5c5b27

SHA512
7d4933fae6a279cc330fde4ae9425f66478c166684a30cec9c5c3f295289cf83cbdf604b8958f6db64b0a4b1566db102fbcbdcdb6eca008d86d9a9c8b252ff16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dbb24d164504f325a569b4717af3f34b

SHA1
8646eae93c8874139d5a1a1272bcce3d2335eeb1

SHA256
8a894748357645eb16ef5bcd6ee0acfbb4dfb278bc5e362ac0081d5fd4317fa7

SHA512
af0552ebde3aa89446fc2051518f983624e1f40560642a8d9d495afee86c20e775801a0c703a21c63785840fc90b8de06d6b3dab3b06487497ca9e281376aa9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
690ac393efa65c81b05787f038874229

SHA1
db338df0a274fb22f127b4e073da1efae754c15e

SHA256
d6e60bec2996040b9639f936d124aa6b33a543e9b4e4a9b8c482a596683545e0

SHA512
fddfe8ac715bd2158e69b26f00777a30b46b02287c1c6d3fb495f8463c3220844d62798430fbf05abb3fce3084cbe82c039cf2753969604f30a0f2e74c4b0782

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ad50a53fe7b005cef48df60ef8bd2469

SHA1
7ec7b557dfde99473f9b379a4ca7583f4976a374

SHA256
80feb7d6ba4736405a37d5dff1abf624ad30f246e4b60caf739c2258ac9a3a50

SHA512
7c2059614def99438781a3ae0c77fe0519a2fcf9b021bf5f08b34253cc41dc4239b802a1668144ed6c6229c419df75d9d307e6d2fa5fd569005209207abc69aa

Download Submit