32f2fa940d4b4fe19aca1e53a24e5aac29c57b7c5ee78588325b87f1b649c864

Analysis

max time kernel
112s
max time network
110s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
19-02-2024 16:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2rNoZFnAamRZ2OAMXDHvwuXpenFr1VCCHPLY42HE.html
Size

146B
MD5

9fe3cb2b7313dc79bb477bc8fde184a7
SHA1

4d7b3cb41e90618358d0ee066c45c76227a13747
SHA256

32f2fa940d4b4fe19aca1e53a24e5aac29c57b7c5ee78588325b87f1b649c864
SHA512

c54ad4f5292784e50b4830a8210b0d4d4ee08b803f4975c9859e637d483b3af38cb0436ac501dea0c73867b1a2c41b39ef2c27dc3fb20f3f27519b719ea743db

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid process

1148 msedge.exe
1148 msedge.exe
3576 msedge.exe
3576 msedge.exe
1656 identity_helper.exe
1656 identity_helper.exe
4444 msedge.exe
4444 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

3576 msedge.exe
3576 msedge.exe
3576 msedge.exe
3576 msedge.exe
3576 msedge.exe
3576 msedge.exe
3576 msedge.exe
3576 msedge.exe

pid	process
1148	msedge.exe
1148	msedge.exe
3576	msedge.exe
3576	msedge.exe
1656	identity_helper.exe
1656	identity_helper.exe
4444	msedge.exe
4444	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3576 wrote to memory of 4792	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4792	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 4488	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 1148	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 1148	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2912	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2912	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2912	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2912	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2912	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2912	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2912	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2912	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2912	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2912	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2912	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2912	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2912	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2912	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2912	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2912	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2912	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2912	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2912	3576	msedge.exe	msedge.exe
PID 3576 wrote to memory of 2912	3576	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2rNoZFnAamRZ2OAMXDHvwuXpenFr1VCCHPLY42HE.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff99ef33cb8,0x7ff99ef33cc8,0x7ff99ef33cd8
2⤵
PID:4792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1844,13602764451868880838,7330896808154159887,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1888 /prefetch:2
2⤵
PID:4488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1844,13602764451868880838,7330896808154159887,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1844,13602764451868880838,7330896808154159887,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
2⤵
PID:2912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,13602764451868880838,7330896808154159887,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
2⤵
PID:3308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,13602764451868880838,7330896808154159887,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
2⤵
PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1844,13602764451868880838,7330896808154159887,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1844,13602764451868880838,7330896808154159887,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4716 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,13602764451868880838,7330896808154159887,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
2⤵
PID:3544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,13602764451868880838,7330896808154159887,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
2⤵
PID:4100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,13602764451868880838,7330896808154159887,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
2⤵
PID:3700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,13602764451868880838,7330896808154159887,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
2⤵
PID:688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,13602764451868880838,7330896808154159887,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
2⤵
PID:3004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,13602764451868880838,7330896808154159887,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
2⤵
PID:3352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53b9b1800c90e0f055e0daabb68cc97e

SHA1
beb76399e32e4ca5c634228e2d4001e197249cf0

SHA256
edac0665854b4e7aa3f2b866e6172c71b2e1c6a169a2a04cf1e74102ee9c0e5e

SHA512
87d516b7ae594902b2544e13c6224760e1ec40d676a2f699da3242b5d3a9eb962dc7b3ca7e2a3eed1dac5375cc6fd8379dfe47d127fd3c18a653a05a8f67c31b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
00a455d9d155394bfb4b52258c97c5e5

SHA1
2761d0c955353e1982a588a3df78f2744cfaa9df

SHA256
45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

SHA512
9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4d99a3dd8a2c0fa221b20a88e975df1c

SHA1
a72e4c2ef239bdf48e51f155a5306cd0415107a2

SHA256
d89ed269bb80f3dde08717731ba809c9c6298fd769b171ba51470afa18455776

SHA512
db48e83d45e8f966aa7f2fc3d26b540151224db7a79f4e6d0382b4082645849fe3d36456f70aeffbe42d76829c3a99fc10f344520163a32158adc041fafee4ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5cb16e6dec40356c5a4fde777d035e97

SHA1
4f34c5ab5cd31beab78d152bf76dd29ff7ab2fa2

SHA256
aa87bed8341c479fb572168a8494e6eb71de430522073f43bc48a55d366936b8

SHA512
0caad1b690eaa6b12e5c418f8d848b7c72cae4e92cbb1931058446f930670da359b2d12dbfa49488f040c6bf0eb9d95c002f9ec9545157e4aa20334a2bbd0eeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
c82ad8ad14e526ec66559c47de1a763f

SHA1
b10b0f130da2c65e86f90dea7ee0a7023d5c2113

SHA256
daf64997d996dd9b5fa74cfcf401181709c99c832ecac0765dfa2685a4de2d26

SHA512
77f20db71a5452fe0de763080ca73b3e55cb0f38bce7805eed977eff6d932b7b081f896be7d9baa8758cb0677e12848f60e08dc2b19985dad0476962b0ffcf66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\af48c09a-28aa-440f-b48b-60455e848a1e.tmp

Filesize
5KB

MD5
33a99f4b1b640c7396befc1ca06b161b

SHA1
df491f34f55e0cede87ed92894fe4a80a8b0a672

SHA256
3ff87c07c985f65462d4e72b2478f1b1563c92513e28791b6eb3e29587ad1812

SHA512
b46c404099363e1064420bbc44bdb6cbae6366be78e7fdd5c1fda2aa2fd97486c9a80c6535245680c3612595c121e7040554bdef842856936a9e2c049bc8b2b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
375365898c517a2b1c6ce99c9598f893

SHA1
89ffcddb6cca7db25b5647bf41d3287c068422f9

SHA256
0af69764df64c584809c8964e826fd2d217d2fdbfb1dc04737f4c5d8ca5803ff

SHA512
9e51bcc6248eda4a95ded9035c4e078b099ddfdec6494963397f8070eda25ed5e2995b7ea94f7c9ba7a498550c4359995da76180d9d547b3ab442ec6dd4e16de

Download Submit
\??\pipe\LOCAL\crashpad_3576_FBGONPLGMBHUCCRS

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit