Analysis
- user interaction
yes - max time kernel
1s - max time network
10s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 14:02
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://brew.sh
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target http://brew.sh
- Sample260804-rcljrsscqd
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1172 msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe - Suspicious use of SendNotifyMessage 25 IoCs
pid Process 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1448 wrote to memory of 3420 1448 msedge.exe 85 PID 1448 wrote to memory of 1172 1448 msedge.exe 87 PID 1448 wrote to memory of 1128 1448 msedge.exe 88 PID 1448 wrote to memory of 1236 1448 msedge.exe 89 PID 1448 wrote to memory of 1128 1448 msedge.exe 88 PID 1448 wrote to memory of 1128 1448 msedge.exe 88 PID 1448 wrote to memory of 1236 1448 msedge.exe 89 PID 1448 wrote to memory of 2016 1448 msedge.exe 90 PID 1448 wrote to memory of 1504 1448 msedge.exe 91 PID 1448 wrote to memory of 2016 1448 msedge.exe 90 PID 1448 wrote to memory of 2016 1448 msedge.exe 90 PID 1448 wrote to memory of 1504 1448 msedge.exe 91 PID 1448 wrote to memory of 1504 1448 msedge.exe 91 PID 1448 wrote to memory of 3340 1448 msedge.exe 92 PID 1448 wrote to memory of 4880 1448 msedge.exe 93 PID 1448 wrote to memory of 3340 1448 msedge.exe 92 PID 1448 wrote to memory of 3340 1448 msedge.exe 92 PID 1448 wrote to memory of 4880 1448 msedge.exe 93 PID 1448 wrote to memory of 4880 1448 msedge.exe 93
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://brew.sh1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x218,0x23c,0x240,0x214,0x24c,0x7ffb1b7cc188,0x7ffb1b7cc194,0x7ffb1b7cc1a02⤵PID:3420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,16285138472333203691,15982948183065717298,524288 --field-trial-handle=2376,i,17261568400671609900,17040435574887855991,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:32⤵
- System Time Discovery
PID:1172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,4319571174290438558,6597693376541582105,262144 --field-trial-handle=2376,i,17261568400671609900,17040435574887855991,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:22⤵PID:1128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,17307554760835329610,3658897876781434283,524288 --field-trial-handle=2376,i,17261568400671609900,17040435574887855991,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:82⤵PID:1236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,10994369054852074170,17280266615971341813,2097152 --field-trial-handle=2376,i,17261568400671609900,17040435574887855991,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:12⤵PID:2016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,16316546893237074375,18133101511178979903,2097152 --field-trial-handle=2376,i,17261568400671609900,17040435574887855991,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:12⤵PID:1504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,1624837832982435946,15427975624384938106,2097152 --field-trial-handle=2376,i,17261568400671609900,17040435574887855991,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:12⤵PID:3340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,4479990706814521903,10727567845190219611,2097152 --field-trial-handle=2376,i,17261568400671609900,17040435574887855991,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:22⤵PID:4880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3672,i,9413941939426632273,10619612710789438402,2097152 --field-trial-handle=2376,i,17261568400671609900,17040435574887855991,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:12⤵PID:1868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,12583215506134051382,8734759639203951916,524288 --field-trial-handle=2376,i,17261568400671609900,17040435574887855991,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:82⤵PID:1568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3440,i,4000223574369010605,5677768239420766533,524288 --field-trial-handle=2376,i,17261568400671609900,17040435574887855991,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:82⤵PID:636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,5477711782386357830,17594120588847328017,524288 --field-trial-handle=2376,i,17261568400671609900,17040435574887855991,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:82⤵PID:2468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,5477711782386357830,17594120588847328017,524288 --field-trial-handle=2376,i,17261568400671609900,17040435574887855991,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:82⤵PID:2028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:5088
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
- Size 105KB
- SHA256 aa0d78ec9cd90e7c6714bdce5235de1fc6b7c3088a6cd8f6e6d2c1cebea7d661
- MD5 63134f635628c0af90baed8399868c70
- SHA1 0a02b0ee6e4253e3534f292530612cd9f5f16106
- SHA512 3c98f5f62643131db7887f04a33b0ca1c1c00b00c63332d61c392e6bf04039e1f5ce53adff3458c5b96f00e8454a916a07ab2c53d268c7a0bedbef781bef81f0
- SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
- TLSH T123B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
- MD5 ef105d8d3e87a813544857290c28833d
- SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
- SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
- TLSH T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
- MD5 338a3c92e96cad1510815c958fc76de7
- SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
- SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
- TLSH T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 4KB
- SHA256 885c77b04f9f870c3a0a313dee1ed22f46dc54031231371c0aced1a342e88a55
- MD5 eb34a7056d569d4393c0d37e7ee3b1c8
- SHA1 cbfbcf40d53c7a581168bdb01cea7bd81a242381
- SHA512 3354d6b6979a8db0f0e584d816fcbf2385a417b6186b385cbe5a9f398d8e668583d3686575c93bd2fd90b7d5b5b5d80cb762ef567754644bbe3ea98172d550f0
- SSDEEP 24:KdiflELfEyEREIaENdEBEhEx4ElEB+EsIjEdExKiEOhaEzEx1EELEhSmETMEW8E6:KV9IhKe0sbyV1INKGQAayIfKXK0Pyf
- TLSH T1E8916221F2BB53413D3E391C959087274682B9633418E86B7FB840B55E6BE250EFD8DD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 fa8c4fadb292f89078f3ba8175ba62ae902af456a28839a757a985b4c85b5025
- MD5 0bea0b98f9e33a727f8302898997af19
- SHA1 f6dec4c427adf23f852ca02f80909b549d36f6ad
- SHA512 514919ac16efa4c363fc2bb6eff7b946406fea76043a8b18fb2a30b35cea1c30ce10b98f0b0aaeffea60e33969962c6e0c790e75a1fe1435c39369dc39645adf
- SSDEEP 192:gONv6kDfQmiUyW2Z9035jzorkbravWQiVaU6:gONv6gheZ9g8kyv0oU6
- TLSH T12602D93568782CBB8EF3AE49B54B27275FE5112BEAD52F84DAE8171C40C765C2306837
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 c18aa75dc13c3ff79ba1569ec845251daa896244ba54960e82eda64b20e2c80f
- MD5 431e44e50c935961977f2e93924c23b2
- SHA1 8901085468925ac0f152a3ae95ca2aa499c4c316
- SHA512 04645713c7f246a8b7f4c4c5ce62456568360fb9a1e055d6148d7fadc698db793a2ebfe9e982f87ef7c5c05b73839e932b5c8dda04f40beca64fd016e6386029
- SSDEEP 192:4ONe6kEQmiUyc2C9035jzorkbrav7XHNNofcRSqRU6:4ONe6JeC9g8kyv7XLoghU6
- TLSH T129122C3264786C6B5DD3A955F04732239EE5412BEBC97F94D9EC2B1C04DF25C230A823
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 53a42f5bdf6d2df5c473b5988fce32e5c5713524adae42458e6ad75de316bc75
- MD5 77c0c06faf3e8de068fca455f74ae078
- SHA1 f36dc8fb474e869089587cb519058244f3e48db2
- SHA512 24f9cd79f222e336bd9d3ef069df317d6814515e575dabe787b4d98633843d554b07167182d24e6d76ab89f1974e2be4293ac06e9eb0d4c963fc23411a310881
- TLSH T16D41F65CBAFA1148B3B66E1AABF6A86E447F78772F06956D10010E4F0623A00D5B1B37
- MD5 SHA1 SHA512 TLSH