c55179e27258d8b7e77cdebf32980c4f3a28f66288f3cbd5d0b155ad5251c998

Analysis

max time kernel
145s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 10:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

houduan/app/index.html
Size

3KB
MD5

6ebd47891799326867ee297d82cdbc45
SHA1

2552eb64ced970460fe76c1e2ddb7cec3b48bcd9
SHA256

c0ae90dd9dd5989081247e8ae295f033f0d34653ac05df1c6617404a51f2a73f
SHA512

6c62ed51ab0172682d4e1d3a57051452e1155c6892e1064fe25ff9796b131d6c1f3a9cd7fddfb82056e660ba25f63ca481ece1ce65961d5a2dc3270690d308cb

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
896	msedge.exe
896	msedge.exe
2056	msedge.exe
2056	msedge.exe
2704	identity_helper.exe
2704	identity_helper.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 3608	2056	msedge.exe	50
PID 2056 wrote to memory of 3608	2056	msedge.exe	50
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 4324	2056	msedge.exe	89
PID 2056 wrote to memory of 896	2056	msedge.exe	88
PID 2056 wrote to memory of 896	2056	msedge.exe	88
PID 2056 wrote to memory of 4476	2056	msedge.exe	90
PID 2056 wrote to memory of 4476	2056	msedge.exe	90
PID 2056 wrote to memory of 4476	2056	msedge.exe	90
PID 2056 wrote to memory of 4476	2056	msedge.exe	90
PID 2056 wrote to memory of 4476	2056	msedge.exe	90
PID 2056 wrote to memory of 4476	2056	msedge.exe	90
PID 2056 wrote to memory of 4476	2056	msedge.exe	90
PID 2056 wrote to memory of 4476	2056	msedge.exe	90
PID 2056 wrote to memory of 4476	2056	msedge.exe	90
PID 2056 wrote to memory of 4476	2056	msedge.exe	90
PID 2056 wrote to memory of 4476	2056	msedge.exe	90
PID 2056 wrote to memory of 4476	2056	msedge.exe	90
PID 2056 wrote to memory of 4476	2056	msedge.exe	90
PID 2056 wrote to memory of 4476	2056	msedge.exe	90
PID 2056 wrote to memory of 4476	2056	msedge.exe	90
PID 2056 wrote to memory of 4476	2056	msedge.exe	90
PID 2056 wrote to memory of 4476	2056	msedge.exe	90
PID 2056 wrote to memory of 4476	2056	msedge.exe	90
PID 2056 wrote to memory of 4476	2056	msedge.exe	90
PID 2056 wrote to memory of 4476	2056	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\houduan\app\index.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc3fe46f8,0x7ffcc3fe4708,0x7ffcc3fe4718
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,10551410043448866260,12465653172476791779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,10551410043448866260,12465653172476791779,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,10551410043448866260,12465653172476791779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10551410043448866260,12465653172476791779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10551410043448866260,12465653172476791779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,10551410043448866260,12465653172476791779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,10551410043448866260,12465653172476791779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10551410043448866260,12465653172476791779,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10551410043448866260,12465653172476791779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10551410043448866260,12465653172476791779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10551410043448866260,12465653172476791779,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,10551410043448866260,12465653172476791779,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2472 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1af9fbc1d4655baf2df9e8948103d616

SHA1
c58d5c208d0d5aab5b6979b64102b0086799b0bf

SHA256
e83daa7b2af963dbb884d82919710164e2337f0f9f5e5c56ee4b7129d160c135

SHA512
714d0ff527a8a24ec5d32a0a2b74e402ee933ea86e42d3e2fb5615c8345e6c09aa1c2ddf2dea53d71c5a666483a3b494b894326fea0cc1d8a06d3b32ec9397d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aa6f46176fbc19ccf3e361dc1135ece0

SHA1
cb1f8c693b88331e9513b77efe47be9e43c43b12

SHA256
2f5ba493c7c4192e9310cea3a96cfec4fd14c6285af6e3659627ab177e560819

SHA512
5d26fdffebeb1eb5adde9f7da19fe7069e364d3f68670013cb0cc3e2b40bf1fbcb9bdebbfe999747caf141c88ccd53bd4acf2074283e4bde46b8c28fbae296f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4c0809ff4ab805fc3cb4d18db8530b82

SHA1
12247e7714b8ab4bb3caf424044dd3e3c1745101

SHA256
5ffc5f5c01de21770031d9e05623f6f9c20af7571dd2790424ccb3c7f6f1cf67

SHA512
6deeaae7e14b36dcf5c08107984dfa2f171b0553202c6c7a84b6ca8193133d7a79e9adf44ce8cc07900becffd963e14f61175c5a4559dcc4ba156fdf90335a47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
16de8885fc317afc850b033683c3a0f4

SHA1
25dc6777c075becb612efac4bc4ade7cc10d5320

SHA256
55eeb45a4125e8cdc0082cc739cda4c714318a0c43f082a579b94a9a7856ed26

SHA512
d0e6ce94ee149c8c8b54907c6cfb96e7b39bee7c912d8d39b7dfcb0604198131aa15c86f6066e45d68b3c4dc0be37ee563deb74b5b9afab8782ef6fd11a52f66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a8be7e3735c5a7798d152307c6e787e2

SHA1
16e5dc3d18d351d950a9cda3a1e0610bf2b668d3

SHA256
957d0c076b787d96430650f5f7e5dfdb69a1b30e2233bddc55abfcd401e44900

SHA512
4dad4f8aec3c6eac395fcdef3c112133759341acf4c12b8056d7c1e91c8f97cf36ad6c9e077761c77dd888640c0b47faa24a3a134bf8157d794a975c12bd4dea

Download Submit