Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12-02-2024 17:53
Static task
static1
Behavioral task
behavioral1
Sample
GY8pjz6GQt.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
GY8pjz6GQt.html
Resource
win10v2004-20231215-en
General
-
Target
GY8pjz6GQt.html
-
Size
17KB
-
MD5
16193f8a52e66a020a30e284bf3f2feb
-
SHA1
31c0dd94c0bc8647355c1a28ce875a526d915459
-
SHA256
a31502acc5ef351d13aebc71605823112d352e4e0cba794032ddb47cb6dcb9fa
-
SHA512
26a118e3f9a387fbb03b0328988579dcdb49db14d80ed9adfb9c12a402c5cf361564cd0694e2caf97903e07c08cd06f1a474406b69437145861c67978b51409b
-
SSDEEP
192:hXxy0bUPqCTUCDaCny+ZRZr4J0DqVuxtTFNoZ+cmBNEZRr8w5me58F0cjiobF5F5:hXsSTR/Me58F0y7F9p60OhrfSt
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 952 msedge.exe 952 msedge.exe 1296 msedge.exe 1296 msedge.exe 1424 identity_helper.exe 1424 identity_helper.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe 2596 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe 1296 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1296 wrote to memory of 4160 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 4160 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 412 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 952 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 952 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 4320 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 4320 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 4320 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 4320 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 4320 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 4320 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 4320 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 4320 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 4320 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 4320 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 4320 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 4320 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 4320 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 4320 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 4320 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 4320 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 4320 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 4320 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 4320 1296 msedge.exe msedge.exe PID 1296 wrote to memory of 4320 1296 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\GY8pjz6GQt.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff437946f8,0x7fff43794708,0x7fff437947182⤵PID:4160
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,18410351720051368415,12239141463439796444,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:952 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,18410351720051368415,12239141463439796444,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:22⤵PID:412
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,18410351720051368415,12239141463439796444,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:82⤵PID:4320
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18410351720051368415,12239141463439796444,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:2684
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18410351720051368415,12239141463439796444,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:2132
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,18410351720051368415,12239141463439796444,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:82⤵PID:4520
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,18410351720051368415,12239141463439796444,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1424 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18410351720051368415,12239141463439796444,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:12⤵PID:4684
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18410351720051368415,12239141463439796444,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:12⤵PID:3696
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18410351720051368415,12239141463439796444,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:12⤵PID:2224
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,18410351720051368415,12239141463439796444,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:12⤵PID:5116
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,18410351720051368415,12239141463439796444,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5416 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2596
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3328
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1552
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d5564ccbd62bac229941d2812fc4bfba
SHA10483f8496225a0f2ca0d2151fab40e8f4f61ab6d
SHA256d259ff04090cbde3b87a54554d6e2b8a33ba81e9483acbbe3e6bad15cbde4921
SHA512300cda7933e8af577bdc1b20e6d4279d1e418cdb0571c928b1568bfea3c231ba632ccb67313ae73ddeae5586d85db95caffaedd23e973d437f8496a8c5a15025
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
5KB
MD5dcb65bf4e5f51ade5379319f91d29b31
SHA1f150739a4ca06c2d336bbd740f8bcca6b0a5385c
SHA256d25766fb4b4b2c841a0fb82ca93e4214bab53ff2a8980cdd36312875b0d6dd3a
SHA512becef1ad0dde282e861f46d50c4a3a4a7f2e18a7ea130039d71e43c2ef103696e7e4509bdbe03300e6dc4b28496c8e7bc9e4754741d22e0def89aacbd93fcb26
-
Filesize
5KB
MD51ff3803e87c51905e9fb736ae190756e
SHA1c4c6751e461ff827059e695833d296fe340862c8
SHA2564612c5ffa9caedf9dc1bf68638bb83c3850b717bbad1965f29916b685168b5a0
SHA512e449770c01e46421e1d5ce8b88012b336f0fa31f1e2070d5e712183ceb82d92537c74bc0428ecc03091a7913096298f83a0ee083b574f361c8ab462f02a3f560
-
Filesize
24KB
MD51d1c7c7f0b54eb8ba4177f9e91af9dce
SHA12b0f0ceb9a374fec8258679c2a039fbce4aff396
SHA256555c13933eae4e0b0e992713ed8118e2980442f89fbdfb06d3914b607edbbb18
SHA5124c8930fe2c805c54c0076408aba3fbfb08c24566fba9f6a409b5b1308d39c7b26c96717d43223632f1f71d2e9e68a01b43a60031be8f1ca7a541fe0f56f4d9f2
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5d9274090ac2d07a63a2d5f024b7f57c7
SHA17304ef497c4c906ba56d8bf93c1d0c531be0e311
SHA256efd03f2cd1bdb66416925b1c57659c250e7ca4d1cc0af1fc73dfa21b91d0a99b
SHA512e6aa856d9aa770078498f2d308999665b9e0a291d41423620d8ffbb6ee28daf9e6fa3a3203342361174e78aa3d2cb54ff4eb5412624e403541eb86ff265bb561
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e