ffa7e80882ffd951133eef2cfba6e3718c8954270f3a716b7fc63e2a64c21e47

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25-02-2024 05:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3049c3a4200cf930d5ce3c0321038e9.html
Size

3KB
MD5

a3049c3a4200cf930d5ce3c0321038e9
SHA1

8a11597e9ddfe0ec0ac89ca40e78c9e10ea16653
SHA256

ffa7e80882ffd951133eef2cfba6e3718c8954270f3a716b7fc63e2a64c21e47
SHA512

498df888b0f308b17409783370fcc8bee0af212770f6c96517be36f6270ec5098da1ced570c940d20b75a4242476fce5590820c07f81a6b884a14ed644738832

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
220	msedge.exe
220	msedge.exe
3248	identity_helper.exe
3248	identity_helper.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe
1040	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 2104	220	msedge.exe	86
PID 220 wrote to memory of 2104	220	msedge.exe	86
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 1208	220	msedge.exe	88
PID 220 wrote to memory of 4832	220	msedge.exe	87
PID 220 wrote to memory of 4832	220	msedge.exe	87
PID 220 wrote to memory of 2992	220	msedge.exe	89
PID 220 wrote to memory of 2992	220	msedge.exe	89
PID 220 wrote to memory of 2992	220	msedge.exe	89
PID 220 wrote to memory of 2992	220	msedge.exe	89
PID 220 wrote to memory of 2992	220	msedge.exe	89
PID 220 wrote to memory of 2992	220	msedge.exe	89
PID 220 wrote to memory of 2992	220	msedge.exe	89
PID 220 wrote to memory of 2992	220	msedge.exe	89
PID 220 wrote to memory of 2992	220	msedge.exe	89
PID 220 wrote to memory of 2992	220	msedge.exe	89
PID 220 wrote to memory of 2992	220	msedge.exe	89
PID 220 wrote to memory of 2992	220	msedge.exe	89
PID 220 wrote to memory of 2992	220	msedge.exe	89
PID 220 wrote to memory of 2992	220	msedge.exe	89
PID 220 wrote to memory of 2992	220	msedge.exe	89
PID 220 wrote to memory of 2992	220	msedge.exe	89
PID 220 wrote to memory of 2992	220	msedge.exe	89
PID 220 wrote to memory of 2992	220	msedge.exe	89
PID 220 wrote to memory of 2992	220	msedge.exe	89
PID 220 wrote to memory of 2992	220	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a3049c3a4200cf930d5ce3c0321038e9.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc9d7846f8,0x7ffc9d784708,0x7ffc9d784718
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,11057817353178548741,3854632419850818237,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,11057817353178548741,3854632419850818237,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,11057817353178548741,3854632419850818237,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11057817353178548741,3854632419850818237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11057817353178548741,3854632419850818237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11057817353178548741,3854632419850818237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,11057817353178548741,3854632419850818237,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,11057817353178548741,3854632419850818237,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11057817353178548741,3854632419850818237,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11057817353178548741,3854632419850818237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11057817353178548741,3854632419850818237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11057817353178548741,3854632419850818237,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,11057817353178548741,3854632419850818237,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4816 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3bde7b7b0c0c9c66bdd8e3f712bd71eb

SHA1
266bd462e249f029df05311255a15c8f42719acc

SHA256
2ccd4a1b56206faa8f6482ce7841636e7bb2192f4cf5258d47e209953a77a01a

SHA512
5fab7a83d86d65e7c369848c5a7d375d9ad132246b57653242c7c7d960123a50257c9e8c4c9a8f22ee861fce357b018236ac877b96c03990a88de4ddb9822818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9cafa4c8eee7ab605ab279aafd19cc14

SHA1
e362e5d37d1a79e7b4a8642b068934e4571a55f1

SHA256
d0817f51aa2fb8c3cae18605dbfd6ec21a6ff3f953171e7ac064648ffdee1166

SHA512
eefd65ffcfb98ac8c3738eb2b3f4933d5bc5b992a1d465b8424903c8f74382ec2c95074290ddbb1001204843bfef59a32b868808a6bee4bc41ee9571515bbac6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
276B

MD5
63e94862b42530f86676ad4d8dad984d

SHA1
3fd2230f79711e641c7d8bc1fc8f6d671319aec8

SHA256
02bd271fbf1d8f8cfeb229ec24d7bfb1c261116853c2e66a3f5d0b3536f59a25

SHA512
8f57ba1d96f3a97a7867f7eb43efd22baea3a78766fd88e87affcbc1e2e1699de833cbe9d78d22fa784ebf9602bd2006ee315ea13aebbcb79b56ec137c7a5aff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
39503d46c7c34c2b20bd3b80955a4f43

SHA1
d7967214abf5cdc0f8b11a90c0007393aca46ebf

SHA256
76321701edf520fca317c63b30a7df7419d4fb271d5b065269081c22032caa60

SHA512
3454ce7541aaf5331ce3a4f0eaf6df5cb9e0b03aa1ad82b4187056d5b2c17654cc3f3da1ecabc6078d576e65c46859f029aa233ccec31df4a31e8f54746291e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
73711c7d9d66e0994ac5e3470b5ff4a3

SHA1
162a070529613e3b93b41df123f18b49fabe98df

SHA256
987dec236392c29350d49fef2c45e6aed272c9add09d2818b01de10ca089dfed

SHA512
5666f35e06cf1c5f70ce44c108827cda50c9ab9eef5277917b5f007d8e7ec8e80415338cf68c59cdd2ebc4272da5607801f9297329813827361989084aa51c56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
644a13a1fa2c82f06ec6adc0eb7131f0

SHA1
01969b8599e8271604475abb34a12885a11068ac

SHA256
29672f87535e5a665aca467d981d25b2ee172df85f4719a3b8aade556ff229e8

SHA512
aa1d65299e1ff65904bf90e3efd1c7d5d29f1377964e45137a9cd386c76cede29d5bfd1faa6543770a5a7034a5d90588e79a84f8a9cf96db34e780dafd9d9ca2

Download Submit