b1d1c0b582636f3f9f067b2ff0053cd038f2dccbb93d4d3f0c76940a36251671

Analysis

max time kernel
30s
max time network
15s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 22:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

index.html
Size

1KB
MD5

8e0a9e37a0ab6079cca42a80d6351de8
SHA1

6df7c5bd7073a728e8a3ed552288d477e74d56df
SHA256

b1d1c0b582636f3f9f067b2ff0053cd038f2dccbb93d4d3f0c76940a36251671
SHA512

9a19f8281c218ceb7472ea1adb5ae5a2a6826fa9f7d26a8846a81576eb61da5e2e3355e4ed8896dac5a4816cce8e7b25ae2e20eb4aa061dd7e51fc46001718d9

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3868	msedge.exe
3868	msedge.exe
2140	msedge.exe
2140	msedge.exe
5040	identity_helper.exe
5040	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2140	msedge.exe
2140	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2964	2140	msedge.exe	78
PID 2140 wrote to memory of 2964	2140	msedge.exe	78
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 1952	2140	msedge.exe	89
PID 2140 wrote to memory of 3868	2140	msedge.exe	90
PID 2140 wrote to memory of 3868	2140	msedge.exe	90
PID 2140 wrote to memory of 4724	2140	msedge.exe	91
PID 2140 wrote to memory of 4724	2140	msedge.exe	91
PID 2140 wrote to memory of 4724	2140	msedge.exe	91
PID 2140 wrote to memory of 4724	2140	msedge.exe	91
PID 2140 wrote to memory of 4724	2140	msedge.exe	91
PID 2140 wrote to memory of 4724	2140	msedge.exe	91
PID 2140 wrote to memory of 4724	2140	msedge.exe	91
PID 2140 wrote to memory of 4724	2140	msedge.exe	91
PID 2140 wrote to memory of 4724	2140	msedge.exe	91
PID 2140 wrote to memory of 4724	2140	msedge.exe	91
PID 2140 wrote to memory of 4724	2140	msedge.exe	91
PID 2140 wrote to memory of 4724	2140	msedge.exe	91
PID 2140 wrote to memory of 4724	2140	msedge.exe	91
PID 2140 wrote to memory of 4724	2140	msedge.exe	91
PID 2140 wrote to memory of 4724	2140	msedge.exe	91
PID 2140 wrote to memory of 4724	2140	msedge.exe	91
PID 2140 wrote to memory of 4724	2140	msedge.exe	91
PID 2140 wrote to memory of 4724	2140	msedge.exe	91
PID 2140 wrote to memory of 4724	2140	msedge.exe	91
PID 2140 wrote to memory of 4724	2140	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\index.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaddf046f8,0x7ffaddf04708,0x7ffaddf04718
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,337018664327102547,9228494758254104673,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,337018664327102547,9228494758254104673,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,337018664327102547,9228494758254104673,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,337018664327102547,9228494758254104673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,337018664327102547,9228494758254104673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,337018664327102547,9228494758254104673,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,337018664327102547,9228494758254104673,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d62cefeb0c8fbab806b3b96c7b215c16

SHA1
dc36684019f7ac8a632f5401cc3bedd482526ed7

SHA256
752b0793cf152e9ea51b8a2dc1d7e622c1c1009677d8f29e8b88d3aa9427dd01

SHA512
9fc3968fec094be5ca10a0d927cb829f7f8157425946ebd99a346b7e63c977cb3f37560af1a4bc8f87ab19b43b3ed86fd5b37f89d1a9b2dc86e3c73142c3065b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7ee1c6757da82ca0a9ae699227f619bc

SHA1
72dcf8262c6400dcbb5228afcb36795ae1b8001f

SHA256
62320bde5e037d4ac1aa0f5ff0314b661f13bb56c02432814bffb0bd6e34ed31

SHA512
dca56a99b7463eddf0af3656a4f7d0177a43116f401a6de9f56e5c40a49676cea5c38b6c458f426c6bff11165eec21104cfa9ca3e38af39d43188b36d3f22a0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
63cb90f0caf2487e2023d574472c0f91

SHA1
a8efa26b75e341a4daf8d1ef8af5b31541c905b3

SHA256
8551f2ce0763cc39ea7e0882c158bbdc1f32ab84c3b9af6e86a239c31bb0ad9a

SHA512
5c7e127de8ae374c970603435d44b477c930fd3c2dc13af139a6148affb338b73acee5db381b4e14feefdf9aac212957617e034295c6b317561c7bb8b8910819

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aa7d8ebf1fe16966a7503efc577d9513

SHA1
a9354166d6cb9a27fb9a08b47604dc9dc74420fe

SHA256
b98422ef0f7e886ee8a881f23504d4c1c6fd512760c1d2f4bb91d8dba705e29a

SHA512
304edc8351307c0e91e1423db7aaa58a323cd58e105628add6bbfbccdc4553b1986f441ebdc483f1418d34ad84e7a0ad2ef0aaaefa69af08cf96743c756cb12f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d5c0b2ce85231624f2359bddc414127c

SHA1
e3b09664031ab62d06cd35b9c85c2ce66868b540

SHA256
88c618307dc4564ee67970ad981841008f00cd8e6c63dd3579672d1a2e406842

SHA512
72a9d5b9196b77faf5e06de7a51177f8b87527b385516d59866c3d8679e834a958d92881877897ac2b1f5763a745ed5266419fa4fe806ee111bf5d3b4ff7d9ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e8e1b7ffe2fa21525f24c0c437de1190

SHA1
4da4a031c0fe89dec7f459c8b4adef39052837ab

SHA256
6a313c5821c66ccfb2820a927acc320271a53b7b97e1837eee89089c322ef0d5

SHA512
6a80fa18e1850b8f050905397d3cc9931f1cd7d1259beb77b580128abdef26ad2d4252e0cc38e29004ec57123b98c780892128ead14aa02b4430c8379b3d4338

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e9a45a1aeecefd221f70e30ffbbd41b5

SHA1
f2a77661275231ca7e7405828ff66a19a2505ddc

SHA256
0f0eeb7c54ef957acd656035814eccab330d66beb2912b7dd710c4e5a99c340f

SHA512
fc6db4695dab501829ec3d25c5f71ce8ac73d0b8d04ae1034197e30c5337427aca9baaea6c8cf5c42e2511dd9de8bf06e9fd7bc3dbde580da125a803cbfea438

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit