b995eebc057427e28d052793c55280014de8c14887ef941ad2c1b525659b625a

Analysis

max time kernel
145s
max time network
126s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
22/02/2024, 15:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

18KB
MD5

42d00a66e5ccfe8440b857504cc8a25a
SHA1

79e98d697ba773de48999f2061eaaaa875b629af
SHA256

b995eebc057427e28d052793c55280014de8c14887ef941ad2c1b525659b625a
SHA512

69195b8aba39134c9ebb86f2e5d4f31551fc4bd92a5521bf0166b84cd0b34efcd1bf8ef94a4f23fbd2ca15f7e77129058cfc32f853a565f816acb93230e8c0eb
SSDEEP

384:rUaDpmReVoOs42N9ylKeGMYU8HhhbMiu7HsN2we7PdVJCBXQL:rUaBVoOs42ryI1MyBhb7gDvJQQL

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3536	msedge.exe
3536	msedge.exe
3152	msedge.exe
3152	msedge.exe
2052	identity_helper.exe
2052	identity_helper.exe
4080	msedge.exe
4080	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3152 wrote to memory of 3164	3152	msedge.exe	17
PID 3152 wrote to memory of 3164	3152	msedge.exe	17
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 952	3152	msedge.exe	79
PID 3152 wrote to memory of 3536	3152	msedge.exe	80
PID 3152 wrote to memory of 3536	3152	msedge.exe	80
PID 3152 wrote to memory of 2216	3152	msedge.exe	81
PID 3152 wrote to memory of 2216	3152	msedge.exe	81
PID 3152 wrote to memory of 2216	3152	msedge.exe	81
PID 3152 wrote to memory of 2216	3152	msedge.exe	81
PID 3152 wrote to memory of 2216	3152	msedge.exe	81
PID 3152 wrote to memory of 2216	3152	msedge.exe	81
PID 3152 wrote to memory of 2216	3152	msedge.exe	81
PID 3152 wrote to memory of 2216	3152	msedge.exe	81
PID 3152 wrote to memory of 2216	3152	msedge.exe	81
PID 3152 wrote to memory of 2216	3152	msedge.exe	81
PID 3152 wrote to memory of 2216	3152	msedge.exe	81
PID 3152 wrote to memory of 2216	3152	msedge.exe	81
PID 3152 wrote to memory of 2216	3152	msedge.exe	81
PID 3152 wrote to memory of 2216	3152	msedge.exe	81
PID 3152 wrote to memory of 2216	3152	msedge.exe	81
PID 3152 wrote to memory of 2216	3152	msedge.exe	81
PID 3152 wrote to memory of 2216	3152	msedge.exe	81
PID 3152 wrote to memory of 2216	3152	msedge.exe	81
PID 3152 wrote to memory of 2216	3152	msedge.exe	81
PID 3152 wrote to memory of 2216	3152	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffbd8d3cb8,0x7fffbd8d3cc8,0x7fffbd8d3cd8
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1844,11768102193200869826,9681800554448755964,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1844,11768102193200869826,9681800554448755964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1844,11768102193200869826,9681800554448755964,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,11768102193200869826,9681800554448755964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,11768102193200869826,9681800554448755964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1844,11768102193200869826,9681800554448755964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,11768102193200869826,9681800554448755964,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,11768102193200869826,9681800554448755964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1844,11768102193200869826,9681800554448755964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,11768102193200869826,9681800554448755964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,11768102193200869826,9681800554448755964,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1844,11768102193200869826,9681800554448755964,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5560 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3b1e59e67b947d63336fe9c8a1a5cebc

SHA1
5dc7146555c05d8eb1c9680b1b5c98537dd19b91

SHA256
7fccd8c81f41a2684315ad9c86ef0861ecf1f2bf5d13050f760f52aef9b4a263

SHA512
2d9b8f574f7f669c109f7e0d9714b84798e07966341a0200baac01ed5939b611c7ff75bf1978fe06e37e813df277b092ba68051fae9ba997fd529962e2e5d7b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0e10a8550dceecf34b33a98b85d5fa0b

SHA1
357ed761cbff74e7f3f75cd15074b4f7f3bcdce0

SHA256
5694744f7e6c49068383af6569df880eed386f56062933708c8716f4221cac61

SHA512
fe6815e41c7643ddb7755cc542d478814f47acea5339df0b5265d9969d02c59ece6fc61150c6c75de3f4f59b052bc2a4f58a14caa3675daeb67955b4dc416d3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
660b18671e11a8a1e70cfd69ebf4b461

SHA1
930f6575f8549353f25ce826bbff7e33d049f09d

SHA256
f27de83c5deaf9b552a78801d23808072e89aef690820290ca7a455939d8bb88

SHA512
26dabc1eec2204bee030dc5bf49bd7d96344c774fe9b0d0c45c5f61475aedd05d2d43f74db3c19214198f3aca6f0c9fe1d34ddb372a93da4408ede56ae90a802

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d5e2b523b9468b552995c9bceb63229a

SHA1
4aec85ed0c115fe663e426d7b6901ca6f18f0420

SHA256
86c16676a03c9de30b06e69809c28cd316dd621527af868d6fc3c5ada9e6f37d

SHA512
310820dd7a2d021ba2ced6ec478f02e21d5bd33bb3ada073e0fb4c6d0e232719a8a186ef3a1603d5c69594471a0fa95dcbe4c42531b1f1c7ae04facefb6383e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1735231f1b13517b33ac31f396a93116

SHA1
daad2a018ee0f244913f92137bd91ac1022e55d9

SHA256
b99353e49ecd7b9e961bdde5e1128a8a2fa037c5f88e2bbfc5d1ac975aa443bc

SHA512
da2ce6b46c31c540a9aa9bf8d68cfd357689b579b87aabd00227e485113c937b47e4a7460279bd9d69470c817be376418ad144d45e16116440f2d8c73967555d

Download Submit