6ba21a8c315d98a15ed22097a912dede9b3af98b28eba02a91dd9a9f7812291c

Analysis

max time kernel
139s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/02/2024, 16:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1293133.html
Size

29KB
MD5

ada2c6120725ddfae9927348decbbf34
SHA1

50ae7c2632ef9d90bf13330b58ddd39c30461a31
SHA256

6ba21a8c315d98a15ed22097a912dede9b3af98b28eba02a91dd9a9f7812291c
SHA512

5447da62dd181cd8ad97730d4bdf3e776e077839119e8ae2d949f95c830ab4a1d0cea1ea7d1948b0b72749bc1061aa56da07a5080750508cc328eb0d692bc445
SSDEEP

768:nEDemBFv1s61XITT9iDiniRotQj/7H+fqGQGr2dJXf2pF+c:Sns61XITxio8/QQGr2dJXf2pkc

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
892	vlc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
1888	msedge.exe
1888	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
892	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1888	msedge.exe
1888	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
892	vlc.exe
892	vlc.exe
892	vlc.exe
892	vlc.exe
892	vlc.exe
892	vlc.exe
892	vlc.exe
892	vlc.exe
892	vlc.exe
892	vlc.exe
892	vlc.exe
892	vlc.exe
892	vlc.exe
892	vlc.exe
892	vlc.exe
892	vlc.exe

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
892	vlc.exe
892	vlc.exe
892	vlc.exe
892	vlc.exe
892	vlc.exe
892	vlc.exe
892	vlc.exe
892	vlc.exe
892	vlc.exe
892	vlc.exe
892	vlc.exe
892	vlc.exe
892	vlc.exe
892	vlc.exe
892	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
892	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 1696	1888	msedge.exe	83
PID 1888 wrote to memory of 1696	1888	msedge.exe	83
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 3692	1888	msedge.exe	84
PID 1888 wrote to memory of 4648	1888	msedge.exe	85
PID 1888 wrote to memory of 4648	1888	msedge.exe	85
PID 1888 wrote to memory of 1596	1888	msedge.exe	86
PID 1888 wrote to memory of 1596	1888	msedge.exe	86
PID 1888 wrote to memory of 1596	1888	msedge.exe	86
PID 1888 wrote to memory of 1596	1888	msedge.exe	86
PID 1888 wrote to memory of 1596	1888	msedge.exe	86
PID 1888 wrote to memory of 1596	1888	msedge.exe	86
PID 1888 wrote to memory of 1596	1888	msedge.exe	86
PID 1888 wrote to memory of 1596	1888	msedge.exe	86
PID 1888 wrote to memory of 1596	1888	msedge.exe	86
PID 1888 wrote to memory of 1596	1888	msedge.exe	86
PID 1888 wrote to memory of 1596	1888	msedge.exe	86
PID 1888 wrote to memory of 1596	1888	msedge.exe	86
PID 1888 wrote to memory of 1596	1888	msedge.exe	86
PID 1888 wrote to memory of 1596	1888	msedge.exe	86
PID 1888 wrote to memory of 1596	1888	msedge.exe	86
PID 1888 wrote to memory of 1596	1888	msedge.exe	86
PID 1888 wrote to memory of 1596	1888	msedge.exe	86
PID 1888 wrote to memory of 1596	1888	msedge.exe	86
PID 1888 wrote to memory of 1596	1888	msedge.exe	86
PID 1888 wrote to memory of 1596	1888	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1293133.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff965d146f8,0x7ff965d14708,0x7ff965d14718
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,2894962265486863830,16114831121649324727,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,2894962265486863830,16114831121649324727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,2894962265486863830,16114831121649324727,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,2894962265486863830,16114831121649324727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,2894962265486863830,16114831121649324727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4508

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\GrantSync.au"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
efc9c7501d0a6db520763baad1e05ce8

SHA1
60b5e190124b54ff7234bb2e36071d9c8db8545f

SHA256
7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

SHA512
bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
948B

MD5
81bd5d365f42ad17b6ca3b2fff5429ae

SHA1
45b3c56830bc1d48eed86d037886bf5927222d61

SHA256
3716e6fc8e9ad61713c9c6959f424c5dba8c4f374326e3a526a1b598958a6633

SHA512
4e4861a8cffeff65f188b0eebcf8b2aa33537005268ca336c0b3662ae605ce796aaa293c31c6839cbb85577dad13cbeb6ef4a99a3730dde6a96918e63f2e5567

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e9dc1f299be29b4a1e775c07924d1f1d

SHA1
a437cc3cb445d0872e04cf7eddf01b46318f0ccd

SHA256
1d93307257384bca6174235928bd22df73416d2047c30ced9302e9f3954c67af

SHA512
384051b9925ef73c6d2a3b1b7bed48b259397feefc24a4924e59182cb818752ce0223b4c01f8e7ca1b3e7f281ae58961937849c90aae25995b3e7b3f7f8ccb69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9743541ed185e5f314cc0b1cd591359f

SHA1
45aaeb6942f4393324e9f039865f4039630e17a8

SHA256
8255a0135bb20cf3516725f84dd5e85810fd43cf56696c13b052b65d2472d45c

SHA512
1181b17ccfec4a19984590e73eeb95b3fcec59e69959042cbadf74fdbd576d99514f7d8ba65e949f2d1c1786acf9aada9d2acf8d471f47b86d9f9719af52f869

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
16d1a159ad8d2a2f38eb8056b28bc002

SHA1
c0d5e9c0b183baa46628584608585b8cdfcfc1f6

SHA256
eeb2646c24bdae3a147fae0542d20b8659c5dc69a4f234684fa864beab0bb37d

SHA512
5de1286f6b5c0185edc0ddb276505f15ff77a37b81015f4c6d5d76deedbcf48eb69da421067e8b6f8781d8040270f1a0d948b145c7d2b6e510e4663275e7a632

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
121510c1483c9de9fdb590c20526ec0a

SHA1
96443a812fe4d3c522cfdbc9c95155e11939f4e2

SHA256
cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

SHA512
b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
64bac5b8450c8b43c2817ca2b8d0eaab

SHA1
0c4eca806deb914271ec803e9f710bf1017c8a34

SHA256
6153076208fe45fc7e591d5524ddfb41b586fc26c06c8a408069f478ed6ede96

SHA512
1258fc2acba32b19f3e4794c19977de5253d7efa34d6b7f8ff284cc6194bb5c78280976d7e120a0bd00f10d4d729640111ad18bcf8f081171855ce0c48ea419b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ba61b01c8aedc5fb1441c23dc03abb4b

SHA1
ade6c15e7153cfac56d832ca148cc64567731c3c

SHA256
98cb19557ccb07bfd3eba00409009a6d6cf053e34ec29ea562d88c3c9c09a0fc

SHA512
b389a7bb4a92684688fb9c7dc359b99dd956033150c5bd2d937f8759859c438c666a44c1b7f1c1b3f7667dc6ecc761d2bb34367ea0b6033757b8f970fe600c3c

Download Submit
memory/892-189-0x00007FF966C70000-0x00007FF966C88000-memory.dmp

Filesize
96KB

Download
memory/892-196-0x00007FF965AA0000-0x00007FF965AB8000-memory.dmp

Filesize
96KB

Download
memory/892-173-0x00007FF955C60000-0x00007FF955F14000-memory.dmp

Filesize
2.7MB

Download
memory/892-179-0x00007FF965610000-0x00007FF965627000-memory.dmp

Filesize
92KB

Download
memory/892-178-0x00007FF9663F0000-0x00007FF966408000-memory.dmp

Filesize
96KB

Download
memory/892-181-0x00007FF956FB0000-0x00007FF956FC7000-memory.dmp

Filesize
92KB

Download
memory/892-184-0x00007FF955C40000-0x00007FF955C51000-memory.dmp

Filesize
68KB

Download
memory/892-183-0x00007FF956850000-0x00007FF95686D000-memory.dmp

Filesize
116KB

Download
memory/892-182-0x00007FF956F90000-0x00007FF956FA1000-memory.dmp

Filesize
68KB

Download
memory/892-180-0x00007FF9651F0000-0x00007FF965201000-memory.dmp

Filesize
68KB

Download
memory/892-185-0x00007FF955940000-0x00007FF955B40000-memory.dmp

Filesize
2.0MB

Download
memory/892-186-0x00007FF955C00000-0x00007FF955C3F000-memory.dmp

Filesize
252KB

Download
memory/892-187-0x00007FF953440000-0x00007FF9544EB000-memory.dmp

Filesize
16.7MB

Download
memory/892-188-0x00007FF965B60000-0x00007FF965B81000-memory.dmp

Filesize
132KB

Download
memory/892-170-0x00007FF67E0A0000-0x00007FF67E198000-memory.dmp

Filesize
992KB

Download
memory/892-190-0x00007FF965B40000-0x00007FF965B51000-memory.dmp

Filesize
68KB

Download
memory/892-192-0x00007FF965B00000-0x00007FF965B11000-memory.dmp

Filesize
68KB

Download
memory/892-191-0x00007FF965B20000-0x00007FF965B31000-memory.dmp

Filesize
68KB

Download
memory/892-194-0x00007FF965AE0000-0x00007FF965AFB000-memory.dmp

Filesize
108KB

Download
memory/892-171-0x00007FF95B6A0000-0x00007FF95B6D4000-memory.dmp

Filesize
208KB

Download
memory/892-195-0x00007FF965AC0000-0x00007FF965AD1000-memory.dmp

Filesize
68KB

Download
memory/892-197-0x00007FF965A70000-0x00007FF965AA0000-memory.dmp

Filesize
192KB

Download
memory/892-202-0x00007FF965A00000-0x00007FF965A67000-memory.dmp

Filesize
412KB

Download
memory/892-204-0x00007FF965970000-0x00007FF965981000-memory.dmp

Filesize
68KB

Download
memory/892-203-0x00007FF965990000-0x00007FF9659FF000-memory.dmp

Filesize
444KB

Download
memory/892-205-0x00007FF965910000-0x00007FF965966000-memory.dmp

Filesize
344KB

Download
memory/892-208-0x00007FF965890000-0x00007FF9658A7000-memory.dmp

Filesize
92KB

Download
memory/892-209-0x00007FF965860000-0x00007FF965883000-memory.dmp

Filesize
140KB

Download
memory/892-207-0x00007FF9658B0000-0x00007FF9658D4000-memory.dmp

Filesize
144KB

Download
memory/892-210-0x00007FF965840000-0x00007FF965851000-memory.dmp

Filesize
68KB

Download
memory/892-216-0x00007FF965820000-0x00007FF965832000-memory.dmp

Filesize
72KB

Download
memory/892-219-0x00007FF9567E0000-0x00007FF9567F2000-memory.dmp

Filesize
72KB

Download
memory/892-206-0x00007FF9658E0000-0x00007FF965908000-memory.dmp

Filesize
160KB

Download
memory/892-225-0x00007FF956390000-0x00007FF956427000-memory.dmp

Filesize
604KB

Download
memory/892-232-0x00007FF955820000-0x00007FF955932000-memory.dmp

Filesize
1.1MB

Download
memory/892-236-0x00007FF955C60000-0x00007FF955F14000-memory.dmp

Filesize
2.7MB

Download
memory/892-235-0x00007FF95B6A0000-0x00007FF95B6D4000-memory.dmp

Filesize
208KB

Download
memory/892-233-0x00007FF67E0A0000-0x00007FF67E198000-memory.dmp

Filesize
992KB

Download
memory/892-238-0x00007FF953440000-0x00007FF9544EB000-memory.dmp

Filesize
16.7MB

Download