bd787af43a6db8c587731896e5caed3ad6a78a6089a6f908add73867b70e9b27

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 13:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a200d5e05fe405177f7d258c9fe9b93c.html
Size

3.5MB
MD5

a200d5e05fe405177f7d258c9fe9b93c
SHA1

b0fd816b8827e022f119551ab7a039e7d44052df
SHA256

bd787af43a6db8c587731896e5caed3ad6a78a6089a6f908add73867b70e9b27
SHA512

713bc85149f6cc6fdbbae3ddf7abfb0ccf33844baeba8eefd93cecaecc998955a0cf3016b4528c89ff41e39416e29246fbfe512f7a66ea38ffed0390e68f8986
SSDEEP

12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NuS:jvpjte4tT6sS

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2932	msedge.exe
2932	msedge.exe
392	msedge.exe
392	msedge.exe
760	identity_helper.exe
760	identity_helper.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 3660	392	msedge.exe	47
PID 392 wrote to memory of 3660	392	msedge.exe	47
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 4492	392	msedge.exe	89
PID 392 wrote to memory of 2932	392	msedge.exe	90
PID 392 wrote to memory of 2932	392	msedge.exe	90
PID 392 wrote to memory of 4580	392	msedge.exe	91
PID 392 wrote to memory of 4580	392	msedge.exe	91
PID 392 wrote to memory of 4580	392	msedge.exe	91
PID 392 wrote to memory of 4580	392	msedge.exe	91
PID 392 wrote to memory of 4580	392	msedge.exe	91
PID 392 wrote to memory of 4580	392	msedge.exe	91
PID 392 wrote to memory of 4580	392	msedge.exe	91
PID 392 wrote to memory of 4580	392	msedge.exe	91
PID 392 wrote to memory of 4580	392	msedge.exe	91
PID 392 wrote to memory of 4580	392	msedge.exe	91
PID 392 wrote to memory of 4580	392	msedge.exe	91
PID 392 wrote to memory of 4580	392	msedge.exe	91
PID 392 wrote to memory of 4580	392	msedge.exe	91
PID 392 wrote to memory of 4580	392	msedge.exe	91
PID 392 wrote to memory of 4580	392	msedge.exe	91
PID 392 wrote to memory of 4580	392	msedge.exe	91
PID 392 wrote to memory of 4580	392	msedge.exe	91
PID 392 wrote to memory of 4580	392	msedge.exe	91
PID 392 wrote to memory of 4580	392	msedge.exe	91
PID 392 wrote to memory of 4580	392	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a200d5e05fe405177f7d258c9fe9b93c.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdccdf46f8,0x7ffdccdf4708,0x7ffdccdf4718
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,14350665907724942056,10742066144262258674,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,14350665907724942056,10742066144262258674,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,14350665907724942056,10742066144262258674,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14350665907724942056,10742066144262258674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14350665907724942056,10742066144262258674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,14350665907724942056,10742066144262258674,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,14350665907724942056,10742066144262258674,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14350665907724942056,10742066144262258674,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14350665907724942056,10742066144262258674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14350665907724942056,10742066144262258674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14350665907724942056,10742066144262258674,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:68
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,14350665907724942056,10742066144262258674,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5308 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e189354a800c436e6cec7c07e6c0feea

SHA1
5c84fbda33c9276736ff3cb01d30ff34b032f781

SHA256
826adca1e688de79a3ec5b91c75990927fb2a33ae717f474608c68336053f427

SHA512
ceb069a5e83a634503e253846fa17b8bf7aaa539c3353ce61251633d69068e24c5eadd1b496f43058790d2b513e65d2c0b0213730813d0b58bb82a00596e05e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9e3e150cfe464e9ebf0a6db1aa5e7a2

SHA1
3cb184e2781c07ac000661bf82e3857a83601813

SHA256
2325a6292907263d1fb089a09f22fbcc6bad56f4961d427efdef1abaef097bcc

SHA512
f5eb1e76eb9441cf5000d8d4db9296077b61714ead5012779c084b37f4bba07614055738f5dce69b13b25975d9b7c03eab049b7685eee09b23fd8d4a7d71a039

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
981B

MD5
c634003b42c47fee4a5e5b658ffcdbd6

SHA1
4419f5c8daef7a89d097c86a7fd274dfff582822

SHA256
e71d5570bc0b42ab2c6a88a4ad0033cb5fec51824cc9074339dbf1abf90edf32

SHA512
855cd3978e1bb207f9c423d4c0a6bd6766a069b632c692423edec316dbd5d9f00f14e9abca765171cfa0d20f117ae8ad268101c20a8740f70f1b3e052f0006c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
91c882e8bbd2fb13f4021eb2d7035d62

SHA1
88ac37024ead3a26708921e173968fe16747f78d

SHA256
825568349e6a659fff08decb6bfa0d43bec0a09d0014135ec99fe5561493546e

SHA512
13c52e385c637aad264cf3c4c92a7e0e83cba9bd76a7587da1bd34061b2296ffd0fb38005bbc79419d0dffe4ee4ffe865831c29fc1a4eddcc57805e37bbcd901

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a3829cdd079e5bae9de61eca6ec2e698

SHA1
b64e4fc7888fbacd1e6498f1890726d34e0e7077

SHA256
3cb422344403211d198ba64bc02a75f18927746bbad22def6478a16cdc962961

SHA512
24155b25a160103fe76821db53a57617785ebe789bea9cc3acd95f2f88b20915224f1fd38cf5e8b0deaf2a4435856d0e21579547e95a4f74cd10e31f3d60c1c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
154ecf0b01856168ba5bbc9d147a0518

SHA1
1c866e0742a7af55c69994be136c0a95378986ff

SHA256
bf76a036ddf7e1cce0c2ab72b92cc5a584ad15555082e63aa4693fcd7392b789

SHA512
7d923867ae9277956d4d0da1edb313c350ab930fc496cdb0453dcfc00af217b363e653f753e35c29d68fb0a868bb18e8c57ed078d9ad68ec1914627a2ac54249

Download Submit