3277cc0295ec15c2ebd576d64ffb4df9d3bfe3e22a894ea3bc9869e3a4c8d13b

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 09:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99106bb7181355263469b14308dcec58.html
Size

48KB
MD5

99106bb7181355263469b14308dcec58
SHA1

11729e94815b350d7d9abdcbe815495eacc78860
SHA256

3277cc0295ec15c2ebd576d64ffb4df9d3bfe3e22a894ea3bc9869e3a4c8d13b
SHA512

c0b1750452a3c981f63534fab0111e7d7377628e18777caf6f97cd89d1788b1081572fb38a39b6127411759649b7411938d78de1965d9359ad2492f67c13edf8
SSDEEP

1536:mSHSSSlgoEGTsBp0MLOfcdn4/y8fPn2dHfU:VleLJ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3048	msedge.exe
3048	msedge.exe
732	msedge.exe
732	msedge.exe
4360	identity_helper.exe
4360	identity_helper.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 732 wrote to memory of 4000	732	msedge.exe	84
PID 732 wrote to memory of 4000	732	msedge.exe	84
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 2136	732	msedge.exe	85
PID 732 wrote to memory of 3048	732	msedge.exe	86
PID 732 wrote to memory of 3048	732	msedge.exe	86
PID 732 wrote to memory of 4684	732	msedge.exe	87
PID 732 wrote to memory of 4684	732	msedge.exe	87
PID 732 wrote to memory of 4684	732	msedge.exe	87
PID 732 wrote to memory of 4684	732	msedge.exe	87
PID 732 wrote to memory of 4684	732	msedge.exe	87
PID 732 wrote to memory of 4684	732	msedge.exe	87
PID 732 wrote to memory of 4684	732	msedge.exe	87
PID 732 wrote to memory of 4684	732	msedge.exe	87
PID 732 wrote to memory of 4684	732	msedge.exe	87
PID 732 wrote to memory of 4684	732	msedge.exe	87
PID 732 wrote to memory of 4684	732	msedge.exe	87
PID 732 wrote to memory of 4684	732	msedge.exe	87
PID 732 wrote to memory of 4684	732	msedge.exe	87
PID 732 wrote to memory of 4684	732	msedge.exe	87
PID 732 wrote to memory of 4684	732	msedge.exe	87
PID 732 wrote to memory of 4684	732	msedge.exe	87
PID 732 wrote to memory of 4684	732	msedge.exe	87
PID 732 wrote to memory of 4684	732	msedge.exe	87
PID 732 wrote to memory of 4684	732	msedge.exe	87
PID 732 wrote to memory of 4684	732	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\99106bb7181355263469b14308dcec58.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa65a746f8,0x7ffa65a74708,0x7ffa65a74718
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,17551933253721107236,10428984089919252942,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,17551933253721107236,10428984089919252942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,17551933253721107236,10428984089919252942,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,17551933253721107236,10428984089919252942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,17551933253721107236,10428984089919252942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,17551933253721107236,10428984089919252942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,17551933253721107236,10428984089919252942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,17551933253721107236,10428984089919252942,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,17551933253721107236,10428984089919252942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,17551933253721107236,10428984089919252942,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,17551933253721107236,10428984089919252942,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,17551933253721107236,10428984089919252942,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e71d66ce903fcba6050e4b99b624fa7

SHA1
139d274762405b422eab698da8cc85f405922de5

SHA256
53b34e24e3fbb6a7f473192fc4dec2ae668974494f5636f0359b6ca27d7c65e3

SHA512
17e2f1400000dd6c54c8dc067b31bcb0a3111e44a9d2c5c779f484a51ada92d88f5b6e6847270faae8ff881117b7ceaaf8dfe9df427cbb8d9449ceacd0480388

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
1dce53a8a7b5c66465ab1f0a1ee933c7

SHA1
8a4cf53362d1e1fb0c751616f32982c06df206d5

SHA256
57b4d892dc10f6f3e3b6638b30d779c0f5598ff9b71f8115f320576941d3b20d

SHA512
a446dc9ce577749fb14f6793effb8f104828aa00eba1e3536d042bf5718e21801bdea6285c18b55d026802237c24b9f8941ad6a391ba08d6aac3dabdad9b5224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f00757ad2cc3a98c61fabd7c04ac8a9a

SHA1
0db8f2582807122f5e7c86816b88ca4543d465cf

SHA256
fca783727131144dc73d5264b2dc85bfe233414bc2a8c21d43664814a8880dc8

SHA512
c65d39b88d070d20307b17969af10b060f0ffd1ab3139b6c7d7f5b1fd6377dd04597fc565da569a1059b59d3b04dc3184781a96b31e9e9bb5efc4a341456bacb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
64b21317f9b6829e43b416494e839f92

SHA1
82a1fdab8e0b5cae1e574d66f01260c349047b28

SHA256
677677e07526fea4eb7f6defab50ea70203cc762a6df81f9e17df7d41bf34a33

SHA512
30297a2156032e73175a969fba588f9b99fdd37936f9f23a8a6bc063ba259f3474e75c51fedb03b2de590060ac32127be796278b1ca2fcc70640d4a70ca50f48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1b1b142e24215f033793d1311e24f6e6

SHA1
74e23cffbf03f3f0c430e6f4481e740c55a48587

SHA256
3dca3ec65d1f4109c6b66a1a47b2477afaf8d15306a523f297283da0eccbe8b1

SHA512
a569385710e3a0dc0d6366476c457927a847a2b2298c839e423c485f7dcce2468a58d20133f6dc81913056fb579957e67f63cf1e20b910d61816210447cd1f1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b65af1ef5355d1bbe5f289ae65ea9dd8

SHA1
2976eec6bfd3491632559d93252c3a078f4cd008

SHA256
65d0ec40cc12d62ddedcb2e34fb54aa3e9db91c7d61a50e65377f5ef1e49300a

SHA512
a833cec7576efb591e404ada68a235174885fc33154025c369c4fe5730ea90a72d1e039d0c666b7b017d8aae6b4fd68ecd150ffc24f6b9d7cb9dfc46c3b5c21c

Download Submit