2b6c66d770b14bcdf281a55af5067ac7937e3523b236a4758de6bf7fb1706e25

Analysis

max time kernel
147s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 05:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ae7b82e5d84fd5e500ee69f49b755ff.html
Size

67KB
MD5

9ae7b82e5d84fd5e500ee69f49b755ff
SHA1

5aa0b6f0f3ca8692ee3570081b8b2643de5c59ff
SHA256

2b6c66d770b14bcdf281a55af5067ac7937e3523b236a4758de6bf7fb1706e25
SHA512

0c395101aba82cc08d7cd96e0dc996eaae88421dc0a562208c6cfbef9a7b38030473806022d2014d389b3adfd8e72fbb9136342bcaac39b8c28b7d5a01510c8d
SSDEEP

1536:TIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SZQxJ:CQxqyRvA5IIvAF

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe
5052	msedge.exe
5052	msedge.exe
5060	identity_helper.exe
5060	identity_helper.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 3216	5052	msedge.exe	84
PID 5052 wrote to memory of 3216	5052	msedge.exe	84
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 4632	5052	msedge.exe	86
PID 5052 wrote to memory of 1144	5052	msedge.exe	85
PID 5052 wrote to memory of 1144	5052	msedge.exe	85
PID 5052 wrote to memory of 4456	5052	msedge.exe	87
PID 5052 wrote to memory of 4456	5052	msedge.exe	87
PID 5052 wrote to memory of 4456	5052	msedge.exe	87
PID 5052 wrote to memory of 4456	5052	msedge.exe	87
PID 5052 wrote to memory of 4456	5052	msedge.exe	87
PID 5052 wrote to memory of 4456	5052	msedge.exe	87
PID 5052 wrote to memory of 4456	5052	msedge.exe	87
PID 5052 wrote to memory of 4456	5052	msedge.exe	87
PID 5052 wrote to memory of 4456	5052	msedge.exe	87
PID 5052 wrote to memory of 4456	5052	msedge.exe	87
PID 5052 wrote to memory of 4456	5052	msedge.exe	87
PID 5052 wrote to memory of 4456	5052	msedge.exe	87
PID 5052 wrote to memory of 4456	5052	msedge.exe	87
PID 5052 wrote to memory of 4456	5052	msedge.exe	87
PID 5052 wrote to memory of 4456	5052	msedge.exe	87
PID 5052 wrote to memory of 4456	5052	msedge.exe	87
PID 5052 wrote to memory of 4456	5052	msedge.exe	87
PID 5052 wrote to memory of 4456	5052	msedge.exe	87
PID 5052 wrote to memory of 4456	5052	msedge.exe	87
PID 5052 wrote to memory of 4456	5052	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9ae7b82e5d84fd5e500ee69f49b755ff.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeccba46f8,0x7ffeccba4708,0x7ffeccba4718
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,9275333935982591832,18080957244379309698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,9275333935982591832,18080957244379309698,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,9275333935982591832,18080957244379309698,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9275333935982591832,18080957244379309698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9275333935982591832,18080957244379309698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,9275333935982591832,18080957244379309698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,9275333935982591832,18080957244379309698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9275333935982591832,18080957244379309698,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9275333935982591832,18080957244379309698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9275333935982591832,18080957244379309698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9275333935982591832,18080957244379309698,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,9275333935982591832,18080957244379309698,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4908 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
efc9c7501d0a6db520763baad1e05ce8

SHA1
60b5e190124b54ff7234bb2e36071d9c8db8545f

SHA256
7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

SHA512
bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
308B

MD5
98f194da8b9163901105217fb6b52cad

SHA1
d2fa51d26f1e424dd90b27b3bbd0a6ee44d9bcd3

SHA256
882de428316035904134975c819c12fe68da5c8986a78a0bb76a1bfc14f30f99

SHA512
4e9489702e55c9148a1c85464608846382fada7c7f0827be864c12a04cd093304dff814450def5581dd5d90a73312ee84bfc57daf6a8775ff2d5e1253a58c5a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3a012fcd80d398e7b5cb048bc19653c8

SHA1
81b70dd682f2a137eba29bf17c979729fb9b21cb

SHA256
ba7471f0b61bb9d76f5e46977db5d224d12898017406a59cc816ca2d8bf6aa20

SHA512
29e7ef26d0d8079e990d6e7c4aaca83e159c1898ac784e3ee2ecef5282335da3c5c04e5138dda85011eb6655d9d5fa8514ce70afa808df94a6f3540440b9aa91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0682c9ad3ae6d4ea2cbdc86d8698df1b

SHA1
3fba00bccdbd4cb4e0406547e214b9d654514ac8

SHA256
dbbadd4f34d1d5a400c1334ae707c6f5d9a9084da0b88c57868544fb26ad7774

SHA512
73b29abd84997b0c72d2a6e946d06a51443a76d9b94154e617d54b2d5c25231302eeb8da0376b7971c0a9d84bd8bb6160760087c4b2475d261af5fb2f5ac34a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
97543280eac61a3f1e15860f4cb246e0

SHA1
dbf4d14bc545850dc0647fbbde897cfe66ff97dc

SHA256
b2125355be42c0c5c2d5c883c8ad850ec5854492f1f652aa40bb82eda858ff36

SHA512
040fcfa85ee00a24001793a62f5d18b5250000a2027acf16327d80d3cfb106d46ce8df4e5d5badb5ca876eac24c58484f7e269e172da2c8b6ea14c61d7950fe7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
121510c1483c9de9fdb590c20526ec0a

SHA1
96443a812fe4d3c522cfdbc9c95155e11939f4e2

SHA256
cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

SHA512
b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6d360c85384060f03d75ff04ad50331b

SHA1
f3ae34f804e01abccbce9e646b56474964ac3535

SHA256
8a52644013880b4727b8349a726eb6deb0488616e37530ae2f0d574d4c89edae

SHA512
5e53a236cb7178ac79266b12be8e544fd36f681cd7e10241ee651649019f7657c0168b735653643e54eed7d0935a4f02da7659c629e45dc8a665d2a79299c35b

Download Submit