Analysis
- user interaction
yes - max time kernel
7s - max time network
8s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/08/2026, 23:41
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://NA4.docusign.net/Member/Image.aspx?i=logo&l=7afb69a3-0f49-43ae-a8d9-8f4d340b93db
Resource
win10v2004-20260513-en
10 signatures
150 seconds
General
- Target https://NA4.docusign.net/Member/Image.aspx?i=logo&l=7afb69a3-0f49-43ae-a8d9-8f4d340b93db
- Sample260817-3pr3vssthv
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3548 msedge.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314837121141199" msedge.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{406B3ED9-D020-441A-81DB-42E6A9E73344} msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe 784 msedge.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 784 wrote to memory of 5088 784 msedge.exe 85 PID 784 wrote to memory of 3548 784 msedge.exe 86 PID 784 wrote to memory of 3440 784 msedge.exe 87 PID 784 wrote to memory of 3440 784 msedge.exe 87 PID 784 wrote to memory of 3440 784 msedge.exe 87 PID 784 wrote to memory of 4952 784 msedge.exe 88 PID 784 wrote to memory of 4952 784 msedge.exe 88 PID 784 wrote to memory of 692 784 msedge.exe 90 PID 784 wrote to memory of 692 784 msedge.exe 90 PID 784 wrote to memory of 692 784 msedge.exe 90 PID 784 wrote to memory of 3844 784 msedge.exe 91 PID 784 wrote to memory of 3844 784 msedge.exe 91 PID 784 wrote to memory of 3844 784 msedge.exe 91 PID 784 wrote to memory of 3348 784 msedge.exe 92 PID 784 wrote to memory of 3348 784 msedge.exe 92 PID 784 wrote to memory of 3348 784 msedge.exe 92 PID 784 wrote to memory of 772 784 msedge.exe 93 PID 784 wrote to memory of 772 784 msedge.exe 93 PID 784 wrote to memory of 772 784 msedge.exe 93 PID 784 wrote to memory of 2756 784 msedge.exe 97 PID 784 wrote to memory of 4940 784 msedge.exe 98 PID 784 wrote to memory of 2756 784 msedge.exe 97 PID 784 wrote to memory of 4940 784 msedge.exe 98 PID 784 wrote to memory of 4280 784 msedge.exe 100
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://NA4.docusign.net/Member/Image.aspx?i=logo&l=7afb69a3-0f49-43ae-a8d9-8f4d340b93db1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa6ec8c188,0x7ffa6ec8c194,0x7ffa6ec8c1a02⤵PID:5088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,15437869792451376504,1804964875382989166,524288 --field-trial-handle=2256,i,8764928466141054339,7927693271783275585,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:32⤵
- System Time Discovery
PID:3548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,12536852542928566638,17547388576070179296,262144 --field-trial-handle=2256,i,8764928466141054339,7927693271783275585,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:22⤵PID:3440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1404,i,16337989545992012684,1839863045443092538,524288 --field-trial-handle=2256,i,8764928466141054339,7927693271783275585,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:82⤵PID:4952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,18239706651078204054,11710132376797008413,2097152 --field-trial-handle=2256,i,8764928466141054339,7927693271783275585,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:12⤵PID:692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,7866929096786433825,13755335236482014276,2097152 --field-trial-handle=2256,i,8764928466141054339,7927693271783275585,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:12⤵PID:3844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,698081166423177134,18342322750222687318,2097152 --field-trial-handle=2256,i,8764928466141054339,7927693271783275585,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:12⤵PID:3348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,12645628932101133592,15065454417852787721,2097152 --field-trial-handle=2256,i,8764928466141054339,7927693271783275585,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:22⤵PID:772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,13978945628710047907,16053070057662576886,524288 --field-trial-handle=2256,i,8764928466141054339,7927693271783275585,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:82⤵PID:2756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,8131918005657115187,7514430605261394140,524288 --field-trial-handle=2256,i,8764928466141054339,7927693271783275585,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:82⤵PID:4940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,8676007141265458078,12214096479140459826,524288 --field-trial-handle=2256,i,8764928466141054339,7927693271783275585,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:82⤵PID:2072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,8676007141265458078,12214096479140459826,524288 --field-trial-handle=2256,i,8764928466141054339,7927693271783275585,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:82⤵PID:4280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:1608
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
- MD5 77a76342e47369b91c295856d0d136ad
- SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
- SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
- TLSH T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 7KB
- SHA256 b3dafdfd6b96c96aaacee25916922e9bddc8401322a3b7fce4337127b2d82589
- MD5 39c888f56fbe16c2a778fe7a93593b73
- SHA1 3308df321acc717da762f771c49735e234790738
- SHA512 4915a5c6dbfd93435b03357dc33bbf570e8a3e02b47472abadaadcacbb530df3db20952cf4c5a95f0be38493802b755d1ecde1f1bae9904c26c09935147ad836
- SSDEEP 96:KUAAKtePtYhM46SS+4iDlqY+KyLqO+2QYr+ofuVKKOAJ+IKHKS6eUKryI6:iitYhM46SSPiDIYYLqOzQYr+ofdxXvu
- TLSH T1AFE1E55775BB42023C7E2A4C9794C7268E42B5633024A42B7FEC01761EA7E209EFD9DD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 7e263a3677026c83c045f0ecb0428e5fd6f6fa2b1d05326d21c81af048e07e50
- MD5 a33ddb0dc247204be54f5533cf5a3e8f
- SHA1 2a871dbe9068692f12885def0f74e8faebe05f1a
- SHA512 96163559ab7984fce6c05ba281a5aefa2242b4969ee7927a7e34b34c8f3e8e674b5f98ebb3cfcd3809debbbea6da21c65a75865a17986e9f6fb9786b854466b8
- SSDEEP 192:qONy6O7+3hQmiUyQMGttb0cO2coGgGY26U6:qONy61AGt9lOa4x6U6
- TLSH T14502F8357C686CB79EF2AE45FA8737139FA8103BE9962F40D6E85E0C00D765C2343826
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 0e34fa8d189b2f460d2afc1c1051d9a08b97808386d8ee8ce263f275c17b9666
- MD5 647edf3c1ec5fe910ca2bb55e0fdf88a
- SHA1 ec5e3c05ab20f0720257cf4d181d858dec6127ce
- SHA512 b343f96ad2dc5f3ee49990b488369cb2f4f743514c1496e650fbbbae778a2c4804b8414022b95250094bc337eb32bcc6a271e865511c8152ec86ca77443eec0a
- SSDEEP 192:MON96O7+3UQmiUyyMqttb0cO2coaR0EHcNWqCgU6:MON96CIqt9lOaaR30LU6
- TLSH T11B120A356868AC771DE2B585F9C735138FA9412BDA467F80D5EC5D0C01EF6AC234B81A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 c9b9dcae767b5b6b3cf433fe9b4a48c2b103763f1bade121fd91b8e6d68ddb2d
- MD5 fed075db66b614e3cf041bd425eef44e
- SHA1 a5e03804313adc3ddabf7e7353f98ba6e157ff4a
- SHA512 bf5d917c0dd3df424cca9e1a3806238c965320e057bad0156129cb72830b31edce3998b5cf4159d2e7ebf87416d315a174edf5b4da2a20e954e296366b89c841
- TLSH T1CC410B48AAF91108B3B77F57ABF7646E447EB9772E47D45D10110E4E0A23A40C871B37
- MD5 SHA1 SHA512 TLSH