Analysis
- user interaction
yes - max time kernel
1s - max time network
7s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/08/2026, 09:06
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://d18i3cdlz4qzra.cloudfront.net
Resource
win10v2004-20260513-en
7 signatures
150 seconds
General
- Target http://d18i3cdlz4qzra.cloudfront.net
- Sample260807-k2177a1elf
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1732 msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe - Suspicious use of FindShellTrayWindow 33 IoCs
pid Process 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe 2328 msedge.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2328 wrote to memory of 1444 2328 msedge.exe 85 PID 2328 wrote to memory of 1732 2328 msedge.exe 86 PID 2328 wrote to memory of 4436 2328 msedge.exe 87 PID 2328 wrote to memory of 4436 2328 msedge.exe 87 PID 2328 wrote to memory of 4436 2328 msedge.exe 87 PID 2328 wrote to memory of 2844 2328 msedge.exe 89 PID 2328 wrote to memory of 2844 2328 msedge.exe 89 PID 2328 wrote to memory of 940 2328 msedge.exe 90 PID 2328 wrote to memory of 940 2328 msedge.exe 90 PID 2328 wrote to memory of 940 2328 msedge.exe 90 PID 2328 wrote to memory of 2060 2328 msedge.exe 91 PID 2328 wrote to memory of 2060 2328 msedge.exe 91 PID 2328 wrote to memory of 2060 2328 msedge.exe 91 PID 2328 wrote to memory of 4964 2328 msedge.exe 93 PID 2328 wrote to memory of 4964 2328 msedge.exe 93 PID 2328 wrote to memory of 4964 2328 msedge.exe 93 PID 2328 wrote to memory of 3276 2328 msedge.exe 92 PID 2328 wrote to memory of 3276 2328 msedge.exe 92 PID 2328 wrote to memory of 3276 2328 msedge.exe 92
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://d18i3cdlz4qzra.cloudfront.net1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffa9c43c188,0x7ffa9c43c194,0x7ffa9c43c1a02⤵PID:1444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,13754264472444153569,15850515222269716641,524288 --field-trial-handle=2152,i,15634412988076931658,122777994633797945,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:32⤵
- System Time Discovery
PID:1732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,495957887107097632,10900040930758382655,262144 --field-trial-handle=2152,i,15634412988076931658,122777994633797945,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:4436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,13582357371031362498,8392919137960786969,524288 --field-trial-handle=2152,i,15634412988076931658,122777994633797945,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:82⤵PID:2844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,6181155676812455598,42730920656360071,2097152 --field-trial-handle=2152,i,15634412988076931658,122777994633797945,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:12⤵PID:940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,10054334127174822196,17282988257895703873,2097152 --field-trial-handle=2152,i,15634412988076931658,122777994633797945,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:12⤵PID:2060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,5477493541789783981,15443178012806750130,2097152 --field-trial-handle=2152,i,15634412988076931658,122777994633797945,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:12⤵PID:3276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,4000513151764604373,10511056197958661414,2097152 --field-trial-handle=2152,i,15634412988076931658,122777994633797945,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:22⤵PID:4964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3860,i,743088876621798547,13037069508765792608,2097152 --field-trial-handle=2152,i,15634412988076931658,122777994633797945,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:12⤵PID:2600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5264,i,4465875693400403554,18082769781789899610,2097152 --field-trial-handle=2152,i,15634412988076931658,122777994633797945,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:12⤵PID:1768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,11420247743877605605,9596405716516281243,524288 --field-trial-handle=2152,i,15634412988076931658,122777994633797945,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:82⤵PID:976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,6736073534840554707,12940441202296927896,524288 --field-trial-handle=2152,i,15634412988076931658,122777994633797945,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:82⤵PID:4832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,15369274068478981727,1370834195579337901,524288 --field-trial-handle=2152,i,15634412988076931658,122777994633797945,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:82⤵PID:4092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,15369274068478981727,1370834195579337901,524288 --field-trial-handle=2152,i,15634412988076931658,122777994633797945,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:82⤵PID:2356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:4452
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
- Size 105KB
- SHA256 cc6205dfc0ad92d30fb9ee805c729d53c836cff0462f2e045a52fbf9353b96ba
- MD5 f562913e5926d98801f903f9ab792282
- SHA1 8891dadd21fb366e56ca3e18b52a40681e1c6bd5
- SHA512 4b1aaca6f81fabe0474d092b453cb6d7540505c123db6a819cbbd5d6f8b61b43326519262ad010d1ef93e3bc712b9067ba041231fbb887f2053b2fb964c01056
- SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7w:fwUQC5VwBIiElEd2K57P7w
- TLSH T12AB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
- MD5 da79f81681859af2b76762aa37a5f73e
- SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
- SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
- TLSH T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 4KB
- SHA256 a0b07f17b68eb344e5d61d2676324459814ef3a4de6ded29deae8772d3c2664d
- MD5 bd5ec5df55421dc07aa04236fcb94353
- SHA1 7b9941b2f0eb31251593c87f33ba4f4d69a50ecf
- SHA512 643e132d8b96e48118c8117baa26edd20bbcfcbcf8c1f4d6cf4844e48d4ccda9c92632c13d29549fb760ac944c925ac7fac14ea51fce241a38817699799e8c64
- SSDEEP 24:KdWf5qra4dsYU4M4+fIjuUKiXhaYU1E2ESmKMb8WJyXYafNWHacdwMI44k+bIjyS:K4TINKEkY7yFTI1KQE4ofIdKwswbyW
- TLSH T1A991610532BF02153CBE381CA2A096974A427A637504E43F77A900724E67F262EFDDED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 0c22799df8ec7bae7fe21863320a38e0026893924202852dea96b7ba7ebfb044
- MD5 7db556cf6206877ab308677e303c590c
- SHA1 03dafe1079dd574c4980136dbd2c07918fd886ad
- SHA512 a7f8ce9fc17240fef7174d73d93d466df3de169d9d61c27294a528263f71e255fca30422b7cc787706634d252b3fe133562124c5436105e37e20bbccc2eeb3ba
- SSDEEP 192:EONo6hZ0QmiUyyEpc/+jVQO1L75wOZwHx1WU6:EONo6oupu+uOdC2wHWU6
- TLSH T10E02EA3568786C778EE2AE45F48737239FE5217BE9916F84D6E86B1D00C769C2307832
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 9fed4668f3277e01bda807828867a1c5f51f578b888e75cc63ea1bbd6d60eee9
- MD5 341ce242a7f48b4412b680dd06e2769a
- SHA1 bddfb0393dd2612a82ba08737b8c54904bff21f1
- SHA512 ad380119986ccb31b61b13e86c90bc3705188f401a3bbc99ae89265e8d4f66ec9563fc8af683c2a2e5cfec0efc4ca3c49ee864d24f4556025e9856252c2202dd
- SSDEEP 192:lONt6hZEQmiUyxEJc/+jVQO1LKc+2Bz5cOqw3q6U6:lONt6Q3Ju+uOdKc+209w9U6
- TLSH T19C12EA366968AC274DE2A551F48736538EE55167E9857FC0D5DC3F1C04DB6AC230BC11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 75d0cc915cb0b946f6c54cc19f51fc0c9f36fb74e2f28b530837ca21709315d4
- MD5 f7f29afb57f9a59da8262071e13c8ef5
- SHA1 525b75c9f49d2e002d6595c8be5e26298582e80b
- SHA512 52e1957ec394e7d3ae9cc26551d968024ad4eb5df680aaccc02865f8f4b3e02c930bcb7372304e1b37d127c9583a9474b6262ce860bb0f71cf9c057836922d28
- TLSH T14E41479CA7FD1058B3B36E5AAFF7A46D48BBB9732E06D05E00110D4F0622B40D961737
- MD5 SHA1 SHA512 TLSH