9a608094143dec8752f5f3e2df783f4a49e99755956eba6d4cb555c6bae6b040

Resubmissions

24/02/2024, 03:53

240224-efpdlshc71 1

24/02/2024, 03:52

240224-ee6w9shc6t 1

24/02/2024, 03:50

240224-edxbfagd38 1

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

9KB
MD5

51603aeba05941e1cb0d60c740b579d6
SHA1

4e5283a765cd34203d4dd5d376b6acec52d15a06
SHA256

9a608094143dec8752f5f3e2df783f4a49e99755956eba6d4cb555c6bae6b040
SHA512

2c9bd9ad3cf9c321810c2add635ede02e9c2adf0c1e5c5e44c55074d34590485e0e21734968c02030b9cd12123dbc63dc9ba7be3b941cf0d705edadb44f9a7a3
SSDEEP

192:Q7i7b6AZIULdJkEiJWC7oXEwvbeyf+IgnIZLx:f6EpLdJkEiJWC7hyfVV

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1632	msedge.exe
1632	msedge.exe
940	msedge.exe
940	msedge.exe
4988	identity_helper.exe
4988	identity_helper.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe
940	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 3972	940	msedge.exe	27
PID 940 wrote to memory of 3972	940	msedge.exe	27
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1196	940	msedge.exe	87
PID 940 wrote to memory of 1632	940	msedge.exe	86
PID 940 wrote to memory of 1632	940	msedge.exe	86
PID 940 wrote to memory of 2404	940	msedge.exe	88
PID 940 wrote to memory of 2404	940	msedge.exe	88
PID 940 wrote to memory of 2404	940	msedge.exe	88
PID 940 wrote to memory of 2404	940	msedge.exe	88
PID 940 wrote to memory of 2404	940	msedge.exe	88
PID 940 wrote to memory of 2404	940	msedge.exe	88
PID 940 wrote to memory of 2404	940	msedge.exe	88
PID 940 wrote to memory of 2404	940	msedge.exe	88
PID 940 wrote to memory of 2404	940	msedge.exe	88
PID 940 wrote to memory of 2404	940	msedge.exe	88
PID 940 wrote to memory of 2404	940	msedge.exe	88
PID 940 wrote to memory of 2404	940	msedge.exe	88
PID 940 wrote to memory of 2404	940	msedge.exe	88
PID 940 wrote to memory of 2404	940	msedge.exe	88
PID 940 wrote to memory of 2404	940	msedge.exe	88
PID 940 wrote to memory of 2404	940	msedge.exe	88
PID 940 wrote to memory of 2404	940	msedge.exe	88
PID 940 wrote to memory of 2404	940	msedge.exe	88
PID 940 wrote to memory of 2404	940	msedge.exe	88
PID 940 wrote to memory of 2404	940	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffceb4546f8,0x7ffceb454708,0x7ffceb454718
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,15479040630429718051,5929641695864601179,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,15479040630429718051,5929641695864601179,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,15479040630429718051,5929641695864601179,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15479040630429718051,5929641695864601179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15479040630429718051,5929641695864601179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,15479040630429718051,5929641695864601179,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,15479040630429718051,5929641695864601179,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15479040630429718051,5929641695864601179,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15479040630429718051,5929641695864601179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15479040630429718051,5929641695864601179,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15479040630429718051,5929641695864601179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,15479040630429718051,5929641695864601179,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2764 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3bde7b7b0c0c9c66bdd8e3f712bd71eb

SHA1
266bd462e249f029df05311255a15c8f42719acc

SHA256
2ccd4a1b56206faa8f6482ce7841636e7bb2192f4cf5258d47e209953a77a01a

SHA512
5fab7a83d86d65e7c369848c5a7d375d9ad132246b57653242c7c7d960123a50257c9e8c4c9a8f22ee861fce357b018236ac877b96c03990a88de4ddb9822818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9cafa4c8eee7ab605ab279aafd19cc14

SHA1
e362e5d37d1a79e7b4a8642b068934e4571a55f1

SHA256
d0817f51aa2fb8c3cae18605dbfd6ec21a6ff3f953171e7ac064648ffdee1166

SHA512
eefd65ffcfb98ac8c3738eb2b3f4933d5bc5b992a1d465b8424903c8f74382ec2c95074290ddbb1001204843bfef59a32b868808a6bee4bc41ee9571515bbac6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
254B

MD5
430fed0ccb885f5229089b351923913d

SHA1
c3110846b6f89019cd4ab37859b64cc8a58608ce

SHA256
bb9eec7b7be041129e6e427da5220f628550f8c62d7182ee17b1bdd98f6989e4

SHA512
7b3bdd42da263a976bd92f229cc4bfdc38743247e6adab8358f503f18df521c428e9eaf2a4a782565df3eabb20005b389198e920ffceb242331cfc18a45f7e4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7eae0c3a1732c1889e81b45bc4a34237

SHA1
589a399a68da46c403b523746c06d1392921a0f4

SHA256
be0e54c115798253416844848fac840e6bb4f7befdd6ed1073d80ff063a74623

SHA512
184367a2a2002880c8391a91d1ae4957c4d7449d430df0fc62fedd6f10d52b0f03f1d79a5606ef9997329ed995fdefc1fd069da369e07ef725320c99ed66291e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4d3daf520cb43d4187c753248a224b75

SHA1
2a7eecc2f7ec69c2e21effc61b0976d164f2df41

SHA256
ed6a9fcc0454e45f4c0eab6b21b5a20a361a4eca5aebe043b67751109ecb2e3b

SHA512
1b706a645e5f1cc80e89affc0b841486b9c3cc0427a12f84843f46dd5081badbf23a88eea3301ec729d3a5c828d2ee58cf33682ff33d8379f3e373eb62ba64e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ae2f454077be0b9651cf3d7bb37717ee

SHA1
6dbce7c609743ce430f44154efa1a0ac62dcc1d3

SHA256
6330dfc8a5a85ec55ff336bae87f6372971d0fefda87eee36fb4732758793342

SHA512
d1d6925ea95e0724e716a973e651ee8f37348fb4fee329a2c3f8bfa8bc5fc3e7867d634feaa95166060ce8d2b64befdf6c2a7d9b3b6988db81c1dff34d7929ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
70e427153cfe66bbee4986d939666301

SHA1
c2f2b9c7d091ed5fab7ef0380e5671ccb23fce88

SHA256
4c7892db965022e8460ebfe1fa73cb134f340b2dbf4f2a19a45548662798f113

SHA512
421a7c23881ba295d19b7fd308675ef0d56cf78e72c3dfe1eaf7ce06b750b6282ab8ce492e4cd1db65682c5d64efe257a09202b9e0247513cb167e399259fd03

Download Submit