Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-06-2024 17:40
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.berg64.se/tourl.aspx?id=4579&[email protected]
Resource
win10v2004-20240508-en
General
-
Target
http://www.berg64.se/tourl.aspx?id=4579&[email protected]
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133638109854411823" msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1181767204-2009306918-3718769404-1000\{D61479A0-794C-4D2A-AB81-D15C19DDA500} msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 2304 wrote to memory of 4796 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 4796 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1980 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1716 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 1716 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 3064 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 3064 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 3064 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 3064 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 3064 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 3064 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 3064 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 3064 2304 msedge.exe msedge.exe PID 2304 wrote to memory of 3064 2304 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.berg64.se/tourl.aspx?id=4579&[email protected]1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=4104,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=5016,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=5244,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5436,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:81⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=5460,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:81⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=5272,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --field-trial-handle=6128,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --field-trial-handle=6336,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3808,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:81⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --field-trial-handle=5816,i,6576818814118437872,11004518367271063231,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:81⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x238,0x23c,0x240,0x234,0x2e8,0x7ffe9330ceb8,0x7ffe9330cec4,0x7ffe9330ced02⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2296,i,12700469485128863462,4040165366188324327,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1940,i,12700469485128863462,4040165366188324327,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:32⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1860,i,12700469485128863462,4040165366188324327,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4456,i,12700469485128863462,4040165366188324327,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4456,i,12700469485128863462,4040165366188324327,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=560,i,12700469485128863462,4040165366188324327,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4124,i,12700469485128863462,4040165366188324327,262144 --variations-seed-version --mojo-platform-channel-handle=1772 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4192,i,12700469485128863462,4040165366188324327,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch DictionariesFilesize
40B
MD520d4b8fa017a12a108c87f540836e250
SHA11ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA2566028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
12KB
MD5967fd8bc75eff7d96ea7fa0e2df2c3fd
SHA1d7dd42cd75b28cfa55a1250696bc1c468a2623bb
SHA2562a2d25da4ef8796d62b2dc42d504ea08ab15a5622cf5ce853ac9c7e69c384581
SHA5123cf84156fe72276057f54518ab6d313bab1e29f4425242c7e369b83fde60d8c8d05751e50711f86b99461dcd6a866f4458399f3e504f0e67b1884a1e721bb4f1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
30KB
MD5a36763e234d72ada96aa45e5aa5d112f
SHA17ce6f7acb9f5b50258e9bfa87ebeadcd8fce43ed
SHA256a1df8aa9f41a850220cd6df9ebdb69e93fe86fe57c8ecea6256635c9958cec36
SHA512ac49c3cfb8e052b21ce11f26045840639bc67b28379df61a1af524b3595c1e8aef17fc9a8561f792cbe61a9e4a65a056b3e79793a55f00538cb7c54901f10240
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
70KB
MD5af778accdd40f6b5599705c624ad5675
SHA19163aad106a4d01722d42ef0ec3d0d993d66e7fe
SHA25652783d8ed07102234d1e0a7e7ee084f1985f60afc49f2176e070ce0659da96f0
SHA5126e6d1a229b11fb4d85585fc5a7d5dde0baf769be7b16472b3e8a97059db7a5f0266547c4d719dd33eb332df9eb91d6849bdd0a69045c5cd89390cd7cc175a1c6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
70KB
MD567ae2a77a400a3f32b0522facf8cceb9
SHA1737c2f03d84ab54914ff6fe1520e465427f2af7a
SHA25615df063bb77a5187dcae553be946792d11f23b04d431cb8bf4dda5f2faa0b1c2
SHA5121bd4fe95351c737d0eafd56ebd704d2dd77f0401887af1cd9096668a910eb98cd2a716c82f7b98c63c6122befabe146cf217933f53c2e9e50c0d650dc1f2c055
-
\??\pipe\crashpad_2304_UGUFVDRCAHLMKFMTMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e