d04fdbe697b0216206c9fca2e49e274c6c50afddf7552330026d75f762cd0a3c

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 05:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9aef34114ab8238de9b380385f56b0e4.html
Size

3.5MB
MD5

9aef34114ab8238de9b380385f56b0e4
SHA1

ce10579c5ee6dc685a755963fec18ad5db3bdaaf
SHA256

d04fdbe697b0216206c9fca2e49e274c6c50afddf7552330026d75f762cd0a3c
SHA512

238cf676a76469dd41058e584d2c331d8e2fdb5ae2e621fd55b05f529d288096eee941583e0e9c1309c0dd4b00fe8542c1c0b953f49ae8d3ad18eb5c50fa344e
SSDEEP

12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6Nu/:jvpjte4tT6s/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2480	msedge.exe
2480	msedge.exe
1952	msedge.exe
1952	msedge.exe
3360	identity_helper.exe
3360	identity_helper.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe
748	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe
1952	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1332	1952	msedge.exe	85
PID 1952 wrote to memory of 1332	1952	msedge.exe	85
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 3928	1952	msedge.exe	87
PID 1952 wrote to memory of 2480	1952	msedge.exe	86
PID 1952 wrote to memory of 2480	1952	msedge.exe	86
PID 1952 wrote to memory of 2180	1952	msedge.exe	88
PID 1952 wrote to memory of 2180	1952	msedge.exe	88
PID 1952 wrote to memory of 2180	1952	msedge.exe	88
PID 1952 wrote to memory of 2180	1952	msedge.exe	88
PID 1952 wrote to memory of 2180	1952	msedge.exe	88
PID 1952 wrote to memory of 2180	1952	msedge.exe	88
PID 1952 wrote to memory of 2180	1952	msedge.exe	88
PID 1952 wrote to memory of 2180	1952	msedge.exe	88
PID 1952 wrote to memory of 2180	1952	msedge.exe	88
PID 1952 wrote to memory of 2180	1952	msedge.exe	88
PID 1952 wrote to memory of 2180	1952	msedge.exe	88
PID 1952 wrote to memory of 2180	1952	msedge.exe	88
PID 1952 wrote to memory of 2180	1952	msedge.exe	88
PID 1952 wrote to memory of 2180	1952	msedge.exe	88
PID 1952 wrote to memory of 2180	1952	msedge.exe	88
PID 1952 wrote to memory of 2180	1952	msedge.exe	88
PID 1952 wrote to memory of 2180	1952	msedge.exe	88
PID 1952 wrote to memory of 2180	1952	msedge.exe	88
PID 1952 wrote to memory of 2180	1952	msedge.exe	88
PID 1952 wrote to memory of 2180	1952	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9aef34114ab8238de9b380385f56b0e4.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa73e346f8,0x7ffa73e34708,0x7ffa73e34718
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,7386411522153630711,10290934677840117592,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,7386411522153630711,10290934677840117592,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,7386411522153630711,10290934677840117592,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7386411522153630711,10290934677840117592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7386411522153630711,10290934677840117592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,7386411522153630711,10290934677840117592,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,7386411522153630711,10290934677840117592,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7386411522153630711,10290934677840117592,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7386411522153630711,10290934677840117592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7386411522153630711,10290934677840117592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7386411522153630711,10290934677840117592,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,7386411522153630711,10290934677840117592,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1256 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
200e5abe592f2aef55c2bf8105c791ab

SHA1
1cb08703041f36a2791ad066898a41e5b89cec12

SHA256
bf01bc11a10120d3a100776d29fe578580351e2f70f5a31b7b33c1297f4f4376

SHA512
70283c39fe8bd65b2d1e1ca34bba71f6cf3b1f4a6d79ba7851bd4c7d7ae60290cf2ef3c01dcedb0b93bf9dd6ec6d910466580f71b34b2c1e1fc0c52fb1408930

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d6e17218d9a99976d1a14c6f6944c96

SHA1
9e54a19d6c61d99ac8759c5f07b2f0d5faab447f

SHA256
32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93

SHA512
3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
981B

MD5
01f6014763b2687d701ae26879bda825

SHA1
3401fcf68b1515c21927aa82b02d6c36eb163681

SHA256
8545e091269e2ddf606fe1a77a052042496a1d4ad57673c3f201f23b9dd852b1

SHA512
2d7fa29b59e509efc05ae271511f6fdaabfe04912257a73d5e85723397b2aea0427a8e7d1d18560be605cf1879169b6812ec485d543206654c7bb17e75924480

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0a090fbb6619af75d900ce37c4e6370e

SHA1
9a07c1402a5584f13a3e01801c5020684ebd8acf

SHA256
35e915e5d95cf8094d92b7acd411121b22d9a48b1d7e2f86d46356ececdba2a5

SHA512
ff9bdf15404f721aca74a07b1653426d6cc0d9eab92dbae0a6b6ba276782491921cd41123231967e69939b1233f7479cefd60e8879fc271c0724569d99c8889b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3c76bf8cc2785494b4aedf9c030b7e0e

SHA1
1364f862fce325ee93844db3c5cf134e95c0415f

SHA256
bb443e51ee0434817651d707c4fb7e3cd4f2cbe149a9ea42691761a66ea7314c

SHA512
ffa5d2a5f793da1b8de9660406519d35768a8fd61571070cfa3e1331308053a56ae04e6c13526203986d0c7dcb4d2d8568c82c244329a38fca55597f71a47296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
c2ef1d773c3f6f230cedf469f7e34059

SHA1
e410764405adcfead3338c8d0b29371fd1a3f292

SHA256
185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521

SHA512
2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5794af5408a188662cd2b521f5aa0400

SHA1
4d2d445fa59eddf279cea11aec990c2ce33efea2

SHA256
cb2b681c68a3e8843f7ad65268ab6fabbe611ea4f4d1db6f94d69093dff3a22d

SHA512
bf2d55557a4fd70d4fecbd713553dab917b96aa7838fc870b502d72adff7dc11cb99e0ed9b1f158786729d431074f4b12083d6118d778acb41b6eb3a686125f4

Download Submit