1034679412b050c355e32b5cddae279940ca9c93816649abcba4236952c56a75

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9FubM.html
Size 18KB
Sample240224-wtnsnsbc8v
SHA256 1034679412b050c355e32b5cddae279940ca9c93816649abcba4236952c56a75
MD5 e2ee0a9c0cabf58df7fcbdf621ad92be
SHA1 54750311422132f6f668d95f289d69274d092d22
SHA512 e20015e0a8ee381df7ea1cdbec9d546184894f07f8a61eb745b99d9918762a504db79eb3ecb5c15409d1613c6dfa5cc21589ad934b180c7eb04f50c7bc695b90
SSDEEP 192:8TF92JICf98Ftf2I0pLI0pdhgf98Ftf5JKPF5iRj//ZjQ+mNDsiHiMi6ieFM:8TF9pFWhNFqiFRjnKIiHiMi6iyM
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4060	msedge.exe
4060	msedge.exe
60	identity_helper.exe
60	identity_helper.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 1896	4060	msedge.exe	87
PID 4060 wrote to memory of 1896	4060	msedge.exe	87
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 1396	4060	msedge.exe	89
PID 4060 wrote to memory of 4588	4060	msedge.exe	88
PID 4060 wrote to memory of 4588	4060	msedge.exe	88
PID 4060 wrote to memory of 2872	4060	msedge.exe	90
PID 4060 wrote to memory of 2872	4060	msedge.exe	90
PID 4060 wrote to memory of 2872	4060	msedge.exe	90
PID 4060 wrote to memory of 2872	4060	msedge.exe	90
PID 4060 wrote to memory of 2872	4060	msedge.exe	90
PID 4060 wrote to memory of 2872	4060	msedge.exe	90
PID 4060 wrote to memory of 2872	4060	msedge.exe	90
PID 4060 wrote to memory of 2872	4060	msedge.exe	90
PID 4060 wrote to memory of 2872	4060	msedge.exe	90
PID 4060 wrote to memory of 2872	4060	msedge.exe	90
PID 4060 wrote to memory of 2872	4060	msedge.exe	90
PID 4060 wrote to memory of 2872	4060	msedge.exe	90
PID 4060 wrote to memory of 2872	4060	msedge.exe	90
PID 4060 wrote to memory of 2872	4060	msedge.exe	90
PID 4060 wrote to memory of 2872	4060	msedge.exe	90
PID 4060 wrote to memory of 2872	4060	msedge.exe	90
PID 4060 wrote to memory of 2872	4060	msedge.exe	90
PID 4060 wrote to memory of 2872	4060	msedge.exe	90
PID 4060 wrote to memory of 2872	4060	msedge.exe	90
PID 4060 wrote to memory of 2872	4060	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9FubM.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff98ebb46f8,0x7ff98ebb4708,0x7ff98ebb4718
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,16826989639571840994,5954210825150710437,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,16826989639571840994,5954210825150710437,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,16826989639571840994,5954210825150710437,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16826989639571840994,5954210825150710437,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16826989639571840994,5954210825150710437,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,16826989639571840994,5954210825150710437,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,16826989639571840994,5954210825150710437,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16826989639571840994,5954210825150710437,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16826989639571840994,5954210825150710437,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16826989639571840994,5954210825150710437,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16826989639571840994,5954210825150710437,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,16826989639571840994,5954210825150710437,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4820 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 35947f71e9cd4bda79e78d028d025dff5fe99c07ea9c767e487ca45d33a5c770
MD5 1f6d41bf10dc1ec1ca4e14d350bbc0b1
SHA1 7a62b23dc3c19e16930b5108d209c4ec937d7dfb
SHA512 046d6c2193a89f4b1b7f932730a0fc72e9fc95fbdb5514435a3e2a73415a105e4f6fa7d536ae6b24638a6aa97beb5c8777e03f597bb4bc928fa8b364b7192a13
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7f55f63c6b77511999eee973415c1f313f81bc0533a36b041820dd4e84f9879b
MD5 4254f7a8438af12de575e00b22651d6c
SHA1 a3c7bde09221129451a7bb42c1707f64b178e573
SHA512 e6a3244139cd6e09cef7dab531bff674847c7ca77218bd1f971aa9bf733a253ac311571b8d6a3fe13e13da4f506fec413f3b345a3429e09d7ceb821a7017ec70
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 313B
SHA256 502b4d507f9386bf34e9925c559a3b654659457f88f9ca463001d2ec25b80d11
MD5 cac4993f5f950937b09ec030e3bdea2a
SHA1 a35a732b965aca92f41a1a5223ef5aa0594ef862
SHA512 9a745817f3f7eaaef05f063bd4249dea8f2f7198deef3d9d9d297a7e9a90a6201de1e9e3a0a9ffd71013612e64e8c77e4da9f1b4587d0eb900c30b1a74d62721
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 82a6385340c931779138ff91850ce5cdacafc6ecf964e8518ec5d0ee2c640797
MD5 6f8cf6772f3081f036907a445a87e8d0
SHA1 79e3fb6b78dd68806eeeb542958814f92507b773
SHA512 3adee796d6966df6997b78f1e382854285fbd217e00e359951d928e100b30b0101ae3128d457a28ac938411f0712336d116143631d28e10715e25974f03f3aa4
SSDEEP 96:n8kpSxm/FQYmqo1jduxwpvWMoiVmdeHlDhfbMmb+UWQyV+VD7ziEwb:n8kpPOjxGGWMXltTMmb+rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 45855329c87c0c69a5bc46e276434d6adfe20b562a7899ef55ded18711e951b1
MD5 abd196e28aa6d846cb9b5f79fb50ecb3
SHA1 d190b91fdf95c24ac0c4b9ae3c4bff8ae3074655
SHA512 ade384efba621e7453198755b47b95c8b99d0bec00c666081979931feb05202d8d48b04ad69143a5e5b41f4c8afee8ee5473c134f882bc080fb0fafefff54b40
SSDEEP 96:n8kpSxm/Fnmqo1jNuxwpvWMoiVmdeHlDhfbMmb+UWQyV+VD7AiEwb:n8kpP8jx2GWMXltTMmb+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c40dd947de073581c9b37d47691c3b1a895fd1080145e31fc94f2f973d1eae80
MD5 a41c2f55ad0cee40b6ad7bd88d9df878
SHA1 34c4074b97c4dafb8d666ffc6538a3e58bd6dcee
SHA512 ba37611f7b6f1cc5427bf32ebe868bc86ed41e9cde6730735a6973493dc3fcc708ea515b9dda3b780b2ecd246d465a8c62951ef3b7d7b6d6079e93b5ac02539d
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupzMANyde2RUPgQWbC59xUXt:A9iIxuERzA83h09RZxYor50Fd59E1Mev
MD5 SHA1 SHA512 SSDEEP

Submit Download