Analysis
-
max time kernel
24s -
max time network
27s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
31-01-2023 16:47
Static task
static1
Behavioral task
behavioral1
Sample
asdf.htm
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
asdf.htm
-
Size
35KB
-
MD5
b411684f2bcb1f1d135ed400b9f691a1
-
SHA1
8a757451427bae6aba39b020a29b2ed12a9e5d76
-
SHA256
01b5eb6e89c5f57ad5aca1ee1812377b64f2212bbf660612924769e8f66fefeb
-
SHA512
d6ed1978d4bc49ab2edc8a29aa1cc5829eae84de930db1450a1ecc0fdb022872d0b2993d383dc94d76a01507c47c20bcd4de0f907630391293495867f1539e32
-
SSDEEP
384:cGoEKUqa70DbOs3QUn6UXqLrIKtUj/rxX+vr:MEH7SqqjnXYrIKte/FX+vr
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\a7fcb950-0a3b-4127-982c-2b5b89df5753.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230131174748.pma setup.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings powershell.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 5044 powershell.exe 5044 powershell.exe 1072 msedge.exe 1072 msedge.exe 332 msedge.exe 332 msedge.exe 1428 identity_helper.exe 1428 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 332 msedge.exe 332 msedge.exe 332 msedge.exe 332 msedge.exe 332 msedge.exe 332 msedge.exe 332 msedge.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5044 powershell.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 332 msedge.exe 332 msedge.exe 332 msedge.exe 332 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 332 wrote to memory of 4892 332 msedge.exe 82 PID 332 wrote to memory of 4892 332 msedge.exe 82 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 2884 332 msedge.exe 85 PID 332 wrote to memory of 1072 332 msedge.exe 86 PID 332 wrote to memory of 1072 332 msedge.exe 86 PID 332 wrote to memory of 4848 332 msedge.exe 87 PID 332 wrote to memory of 4848 332 msedge.exe 87 PID 332 wrote to memory of 4848 332 msedge.exe 87 PID 332 wrote to memory of 4848 332 msedge.exe 87 PID 332 wrote to memory of 4848 332 msedge.exe 87 PID 332 wrote to memory of 4848 332 msedge.exe 87 PID 332 wrote to memory of 4848 332 msedge.exe 87 PID 332 wrote to memory of 4848 332 msedge.exe 87 PID 332 wrote to memory of 4848 332 msedge.exe 87 PID 332 wrote to memory of 4848 332 msedge.exe 87 PID 332 wrote to memory of 4848 332 msedge.exe 87 PID 332 wrote to memory of 4848 332 msedge.exe 87 PID 332 wrote to memory of 4848 332 msedge.exe 87 PID 332 wrote to memory of 4848 332 msedge.exe 87 PID 332 wrote to memory of 4848 332 msedge.exe 87 PID 332 wrote to memory of 4848 332 msedge.exe 87 PID 332 wrote to memory of 4848 332 msedge.exe 87 PID 332 wrote to memory of 4848 332 msedge.exe 87 PID 332 wrote to memory of 4848 332 msedge.exe 87 PID 332 wrote to memory of 4848 332 msedge.exe 87
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge C:\Users\Admin\AppData\Local\Temp\asdf.htm1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5044
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch C:\Users\Admin\AppData\Local\Temp\asdf.htm1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff810be46f8,0x7ff810be4708,0x7ff810be47182⤵PID:4892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,12094523634896070014,4894049790382024731,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:22⤵PID:2884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,12094523634896070014,4894049790382024731,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,12094523634896070014,4894049790382024731,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:82⤵PID:4848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12094523634896070014,4894049790382024731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:3968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12094523634896070014,4894049790382024731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2116,12094523634896070014,4894049790382024731,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4812 /prefetch:82⤵PID:4576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12094523634896070014,4894049790382024731,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:12⤵PID:5056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12094523634896070014,4894049790382024731,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:12⤵PID:2040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12094523634896070014,4894049790382024731,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:12⤵PID:4900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2116,12094523634896070014,4894049790382024731,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5140 /prefetch:82⤵PID:3612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12094523634896070014,4894049790382024731,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:4988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12094523634896070014,4894049790382024731,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:12⤵PID:3492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,12094523634896070014,4894049790382024731,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:82⤵PID:1668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings2⤵
- Drops file in Program Files directory
PID:2796 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x124,0xd8,0x264,0x10c,0x7ff626895460,0x7ff626895470,0x7ff6268954803⤵PID:4984
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,12094523634896070014,4894049790382024731,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1428
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4428