7bf1e56ca4d5c193f33c400336e9c204aaf9c6315712b3354d5567538c42e567

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 00:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9a530285a3a74222f0612d0ce0822971.html
Size

37KB
MD5

9a530285a3a74222f0612d0ce0822971
SHA1

ffc9605cfa6341bc91a28142890464983a7e728e
SHA256

7bf1e56ca4d5c193f33c400336e9c204aaf9c6315712b3354d5567538c42e567
SHA512

a6ca6cca0e7ecd50ef36349525be1bf0bf3bc68028b0a153031585d2a35dcdce470148cbcc340202d4dfb46f128f21e3f574e63f15b5f55ccc7a3616c2f21126
SSDEEP

768:3JGyrleugEQ0XOUUOOQ/hyyVC4ifjQQ7XX0tz3rwFszCkaRvFTZwqMJ:3o8leutQ0XJtz3rwFszCkaRvFTZwjJ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
928	msedge.exe
928	msedge.exe
1216	msedge.exe
1216	msedge.exe
4640	identity_helper.exe
4640	identity_helper.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe
1216	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 3192	1216	msedge.exe	84
PID 1216 wrote to memory of 3192	1216	msedge.exe	84
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 5020	1216	msedge.exe	86
PID 1216 wrote to memory of 928	1216	msedge.exe	85
PID 1216 wrote to memory of 928	1216	msedge.exe	85
PID 1216 wrote to memory of 2768	1216	msedge.exe	87
PID 1216 wrote to memory of 2768	1216	msedge.exe	87
PID 1216 wrote to memory of 2768	1216	msedge.exe	87
PID 1216 wrote to memory of 2768	1216	msedge.exe	87
PID 1216 wrote to memory of 2768	1216	msedge.exe	87
PID 1216 wrote to memory of 2768	1216	msedge.exe	87
PID 1216 wrote to memory of 2768	1216	msedge.exe	87
PID 1216 wrote to memory of 2768	1216	msedge.exe	87
PID 1216 wrote to memory of 2768	1216	msedge.exe	87
PID 1216 wrote to memory of 2768	1216	msedge.exe	87
PID 1216 wrote to memory of 2768	1216	msedge.exe	87
PID 1216 wrote to memory of 2768	1216	msedge.exe	87
PID 1216 wrote to memory of 2768	1216	msedge.exe	87
PID 1216 wrote to memory of 2768	1216	msedge.exe	87
PID 1216 wrote to memory of 2768	1216	msedge.exe	87
PID 1216 wrote to memory of 2768	1216	msedge.exe	87
PID 1216 wrote to memory of 2768	1216	msedge.exe	87
PID 1216 wrote to memory of 2768	1216	msedge.exe	87
PID 1216 wrote to memory of 2768	1216	msedge.exe	87
PID 1216 wrote to memory of 2768	1216	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9a530285a3a74222f0612d0ce0822971.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff837bc46f8,0x7ff837bc4708,0x7ff837bc4718
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,12356424329115667998,14245277220829102098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,12356424329115667998,14245277220829102098,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,12356424329115667998,14245277220829102098,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12356424329115667998,14245277220829102098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12356424329115667998,14245277220829102098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,12356424329115667998,14245277220829102098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,12356424329115667998,14245277220829102098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12356424329115667998,14245277220829102098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12356424329115667998,14245277220829102098,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12356424329115667998,14245277220829102098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12356424329115667998,14245277220829102098,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,12356424329115667998,14245277220829102098,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4852 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
84381d71cf667d9a138ea03b3283aea5

SHA1
33dfc8a32806beaaafaec25850b217c856ce6c7b

SHA256
32dd52cc3142b6e758bd60adead81925515b31581437472d1f61bdeda24d5424

SHA512
469bfac06152c8b0a82de28e01f7ed36dc27427205830100b1416b7cd8d481f5c4369e2ba89ef1fdd932aaf17289a8e4ede303393feab25afc1158cb931d23a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
975B

MD5
c1811d911931a32c9b256f7c54759659

SHA1
4c33291fd427cdd3a65c740bd61b7985b9dd2cff

SHA256
3fc9561c682bf79488faf39fe4ea2f24580e1a0528c80ef3988bac9c283b250c

SHA512
76433ee5220087e79046034f0d80315f4238f3c3288e56c3f8245f1968484756bc8f79e17a7f89420d8b461509fd5b3a2907877a62cda081a9bbc2e689f3aa5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2ebe6b547ea6479851a310e5f2122cf0

SHA1
2fc441ce887af7274e83fccf56923c3f225a1e40

SHA256
8132ebaf8be0e0f78b92fdb568c5e24bcdf1bdd4b16256b739f88e757ccecc62

SHA512
529e4d66b2d98913d306a5062332c2869d79b1fe054dee69fcae7ca39e32de5aa92a7326ac84855ae3e67970e9fcc3e6f9f0e36f5e8d55d9d2bdd1782a509e1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2d7c9eef1505298b990df08ade89720c

SHA1
25a2c495a61fbbece25f9dbe20a2278f9558eb0c

SHA256
09dd508cea9f6e4e8c0274611a137da7267207ef5619f9c05b899b16874e8d40

SHA512
fcf2a5850057b2ed203d51a20fb4223310dc83e610b41adc8a53d22dc195910c00e3cc69a4effb4eb0f8babffcb37e57a971ccf2ff472ca828b73e9602ccdd7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bf2ed363b04e3fa2ebfc2458bff16c3b

SHA1
5b8457f13ce4e7053135dd0a7a9e28894b4d3713

SHA256
fbf7712b06e224762794d7f0fa2f9a776d1d98aefec894b0b1c78d4cea9593aa

SHA512
ba6d8d94cd233d395f4fd9fa24b92af03e8a12d1019ecaa853e57fb8fddfa3cf9ff42a271963050c7aa6f07822f9fedeb067b40fabdb5c0cff7e144922556c38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
35f77ec6332f541cd8469e0d77af0959

SHA1
abaec73284cee460025c6fcbe3b4d9b6c00f628c

SHA256
f0be4c5c99b216083bd9ee878f355e1aa508f94feb14aeebcfba4648d85563a7

SHA512
e0497dbe48503ebbf6a3c9d188b9637f80bccf9611a9e663d9e4493912d398c6b2a9eab3f506e5b524b3dabbca7bb5a88f882a117b03a3b39f43f291b59870c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
044f8f7b46e5b776d6bbf8f10b3b0c05

SHA1
8c9fa47158cf1b1ddf964577006a0c775558acdd

SHA256
3a39d59006942f4d44ffba87ebd26a22cb4f6c4ee68f9a5cfb0159f484cd8db6

SHA512
63c2f507a5aa738191a6c5d564caec590e45134ff66d6db8f4b43e6ecfb6949dde3517e8c118e2f9d63c3bb8837ea73f3d6e45c5ace4fa5e9776818b336d01fe

Download Submit