5240aac6da8ae3811da25b32d3b38ba3dfdab0071d2249b9d55e395adf87eaa1

Analysis

max time kernel
151s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 18:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

21KB
MD5

f8cb6ca668690ec93015054ec95040ad
SHA1

dfbeb1669a9c8bd542e09bd1f1a5b1a768207e97
SHA256

4d3613e36d577a4fc7b934a951c8507be4ea7331a466039cbb4b0a22613e48a8
SHA512

696843e3ecba0608143bba6f4ce6e36412119a30401b66741d901154a9bf0c77f9abdc6e031c5bad928a153c92a7a9df8275c02f04802c712cfa62bdc86ce769
SSDEEP

384:1SFpvsxuNjCUY9QpqS2PEfASfaU/1RFUvMotdvu3hl:1o9ADUY9QpqS2PEfASfaBM+dvahl

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2220	msedge.exe
2220	msedge.exe
4508	msedge.exe
4508	msedge.exe
1236	identity_helper.exe
1236	identity_helper.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 4860	4508	msedge.exe	86
PID 4508 wrote to memory of 4860	4508	msedge.exe	86
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2228	4508	msedge.exe	88
PID 4508 wrote to memory of 2220	4508	msedge.exe	89
PID 4508 wrote to memory of 2220	4508	msedge.exe	89
PID 4508 wrote to memory of 4136	4508	msedge.exe	90
PID 4508 wrote to memory of 4136	4508	msedge.exe	90
PID 4508 wrote to memory of 4136	4508	msedge.exe	90
PID 4508 wrote to memory of 4136	4508	msedge.exe	90
PID 4508 wrote to memory of 4136	4508	msedge.exe	90
PID 4508 wrote to memory of 4136	4508	msedge.exe	90
PID 4508 wrote to memory of 4136	4508	msedge.exe	90
PID 4508 wrote to memory of 4136	4508	msedge.exe	90
PID 4508 wrote to memory of 4136	4508	msedge.exe	90
PID 4508 wrote to memory of 4136	4508	msedge.exe	90
PID 4508 wrote to memory of 4136	4508	msedge.exe	90
PID 4508 wrote to memory of 4136	4508	msedge.exe	90
PID 4508 wrote to memory of 4136	4508	msedge.exe	90
PID 4508 wrote to memory of 4136	4508	msedge.exe	90
PID 4508 wrote to memory of 4136	4508	msedge.exe	90
PID 4508 wrote to memory of 4136	4508	msedge.exe	90
PID 4508 wrote to memory of 4136	4508	msedge.exe	90
PID 4508 wrote to memory of 4136	4508	msedge.exe	90
PID 4508 wrote to memory of 4136	4508	msedge.exe	90
PID 4508 wrote to memory of 4136	4508	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8ca046f8,0x7ffa8ca04708,0x7ffa8ca04718
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,10004933133531336779,11156599743737085338,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,10004933133531336779,11156599743737085338,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,10004933133531336779,11156599743737085338,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10004933133531336779,11156599743737085338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10004933133531336779,11156599743737085338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10004933133531336779,11156599743737085338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10004933133531336779,11156599743737085338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,10004933133531336779,11156599743737085338,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1964 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,10004933133531336779,11156599743737085338,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1964 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10004933133531336779,11156599743737085338,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10004933133531336779,11156599743737085338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10004933133531336779,11156599743737085338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10004933133531336779,11156599743737085338,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,10004933133531336779,11156599743737085338,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5300 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
360dd5debf8bf7b89c4d88d29e38446c

SHA1
65afff8c78aeb12c577a523cb77cd58d401b0f82

SHA256
3d9debe659077c04b288107244a22f1b315bcf7495bee75151a9077e71b41eef

SHA512
0ee5b81f0acc82befa24a4438f2ca417ae6fac43fa8c7f264b83b4c792b1bb8d4cecb94c6cbd6facc120dc10d7e4d67e014cdb6b4db83b1a1b60144bb78f7542

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6fbbaffc5a50295d007ab405b0885ab5

SHA1
518e87df81db1dded184c3e4e3f129cca15baba1

SHA256
b9cde79357b550b171f70630fa94754ca2dcd6228b94f311aefe2a7f1ccfc7b6

SHA512
011c69bf56eb40e7ac5d201c1a0542878d9b32495e94d28c2f3b480772aa541bfd492a9959957d71e66f27b3e8b1a3c13b91f4a21756a9b8263281fd509c007b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
317B

MD5
76a9908501cf2c7d122d06478264aee2

SHA1
637e997f3208c09475ba9c4f6263c692145410d4

SHA256
dd0cb2d27e8c79be70bdd1ac345b5bcdcbdfbf4949109d32799c8d725104f6bc

SHA512
54dcbed803647e0f7c5bd2da76f27d0536821fdf968b70e7e61cc2814d0ea02917d89aa3c953a7fcba9ee0df3b853d3d69e2c2e35ea7d0ae47d4b8ee0453aa26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c805b8a0292a3c44f5298e5c6d479370

SHA1
5a0c13768a582ba81d9780410c8a213234a8f460

SHA256
aa6b000ae690e6f6415a496a154be67cf1a99b0c4a48bf6c37c68b497573fa36

SHA512
12382f88c88961d7c0722f234dd088843351a522f629307a640b01e2e6296a468d4324fe226befe85f1e2df2ffa972661018b2557ba37ad70804144f457ddf80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
85082a94c6c43ac4923d58e5cafbf148

SHA1
919c922eec1af04d48725fbed69fa08906cafac6

SHA256
502bc93ad7bd218b646d31590d4098208c84901a2194b23f4115aff884296112

SHA512
13acf9b9b390fe5106c33e507370a5644daa6b984dc981595f3b2b85e5363778f165b861aed6f750d0e3d3df5ae46acd5ce7e1f32bbcc0689f66893f02c15d6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
878245ffd0315bb74bc0099ba1b63ea4

SHA1
2b7805b2b465980c838b4748747f440fc38a9b76

SHA256
76c1d3c89c54ad6cf8657fb37520d7a294e5ca136070f52149b67cc1e0b9c9e9

SHA512
ef7ca047b26ad52514b2c36b4115ffa2451811aade41880d98c30d3798c635368665f5899d0dbfcefad68c3e42596be251b313a851a37af9268e9928e2c464de

Download Submit