eb12fcc0441007f9094746c05ee0ea177cd497e903765fe13357d848b7a01924

Analysis

max time kernel
150s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25-02-2024 05:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2f9b2edebe63fd456e03cdc9a7c22b3.html
Size

43KB
MD5

a2f9b2edebe63fd456e03cdc9a7c22b3
SHA1

3097c2838dd5be57c395365efbf8b4d488aa9034
SHA256

eb12fcc0441007f9094746c05ee0ea177cd497e903765fe13357d848b7a01924
SHA512

5140f979ca1721b57667c4c6372175c6fe8a797de91d2938f38ecb84618e208f4ab370b386731cb3f79c35b87230094b205dccf4307a0c8668609f3412567460
SSDEEP

768:sSWIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SZZ:MIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqC

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4156	msedge.exe
4156	msedge.exe
956	msedge.exe
956	msedge.exe
2452	identity_helper.exe
2452	identity_helper.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe
956	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 4248	956	msedge.exe	84
PID 956 wrote to memory of 4248	956	msedge.exe	84
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4448	956	msedge.exe	86
PID 956 wrote to memory of 4156	956	msedge.exe	87
PID 956 wrote to memory of 4156	956	msedge.exe	87
PID 956 wrote to memory of 2744	956	msedge.exe	88
PID 956 wrote to memory of 2744	956	msedge.exe	88
PID 956 wrote to memory of 2744	956	msedge.exe	88
PID 956 wrote to memory of 2744	956	msedge.exe	88
PID 956 wrote to memory of 2744	956	msedge.exe	88
PID 956 wrote to memory of 2744	956	msedge.exe	88
PID 956 wrote to memory of 2744	956	msedge.exe	88
PID 956 wrote to memory of 2744	956	msedge.exe	88
PID 956 wrote to memory of 2744	956	msedge.exe	88
PID 956 wrote to memory of 2744	956	msedge.exe	88
PID 956 wrote to memory of 2744	956	msedge.exe	88
PID 956 wrote to memory of 2744	956	msedge.exe	88
PID 956 wrote to memory of 2744	956	msedge.exe	88
PID 956 wrote to memory of 2744	956	msedge.exe	88
PID 956 wrote to memory of 2744	956	msedge.exe	88
PID 956 wrote to memory of 2744	956	msedge.exe	88
PID 956 wrote to memory of 2744	956	msedge.exe	88
PID 956 wrote to memory of 2744	956	msedge.exe	88
PID 956 wrote to memory of 2744	956	msedge.exe	88
PID 956 wrote to memory of 2744	956	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a2f9b2edebe63fd456e03cdc9a7c22b3.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbec3846f8,0x7ffbec384708,0x7ffbec384718
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,5557820879089466124,14929751923437323083,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,5557820879089466124,14929751923437323083,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,5557820879089466124,14929751923437323083,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5557820879089466124,14929751923437323083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5557820879089466124,14929751923437323083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5557820879089466124,14929751923437323083,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5557820879089466124,14929751923437323083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,5557820879089466124,14929751923437323083,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,5557820879089466124,14929751923437323083,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5557820879089466124,14929751923437323083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,5557820879089466124,14929751923437323083,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,5557820879089466124,14929751923437323083,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5112 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
360dd5debf8bf7b89c4d88d29e38446c

SHA1
65afff8c78aeb12c577a523cb77cd58d401b0f82

SHA256
3d9debe659077c04b288107244a22f1b315bcf7495bee75151a9077e71b41eef

SHA512
0ee5b81f0acc82befa24a4438f2ca417ae6fac43fa8c7f264b83b4c792b1bb8d4cecb94c6cbd6facc120dc10d7e4d67e014cdb6b4db83b1a1b60144bb78f7542

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6fbbaffc5a50295d007ab405b0885ab5

SHA1
518e87df81db1dded184c3e4e3f129cca15baba1

SHA256
b9cde79357b550b171f70630fa94754ca2dcd6228b94f311aefe2a7f1ccfc7b6

SHA512
011c69bf56eb40e7ac5d201c1a0542878d9b32495e94d28c2f3b480772aa541bfd492a9959957d71e66f27b3e8b1a3c13b91f4a21756a9b8263281fd509c007b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\02a644db-db0b-40db-ae5a-8e353f6bd96e.tmp

Filesize
6KB

MD5
7cda451798556a203719b5487c1b7e1f

SHA1
7e1e48a1c87c4f1fe1a6d624994bc7a7e88d79ec

SHA256
1be7f3ce5db241c235e466c38d08191fb2e995e304cef9d440500bf2446440e3

SHA512
95874e91d691cbb3cd446c8c859bbca3246871e6b4033d3d1ddc712f007efc63defa8c2c2cc28c6f775fe2f39061cda91228edd928e28f0d8fc40229ee0a5ef8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
512B

MD5
ef6a2dc8763f70c6915e15b140c0ec0d

SHA1
5aecfdadc5bcc161adcf52634e71d11defb29eb4

SHA256
5b28322950dbee0c590470a8bd0ce5b441b0661b83e29d6189c8019822b1703c

SHA512
f9f7adf4fe3bdd4a2b01d2a958546ec897bf3225454a748e3a823e20d3f5c3b2b9033c5979127d4c7eca08b18f34289852ca1a72d1a0a6bf9856ddbf46640699

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
256168780b229282c7324fe5aa53471a

SHA1
4a3ddafced9756afa735c30794d905a3e6e5b2bf

SHA256
11ec870e0469c949e61df348262eb3d95433f5728a5756f9662ff903e434c2ad

SHA512
7d2dc1f96f72cab2dc295f056d8979d8401952958479446256b72b7cf475dd54d7656af60b3665637acf610e2c28feb053ec1740f1af990711ec7bcc64018edd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
36ff96992606e60f202e85db70023b35

SHA1
140d87ab42118e0c06c029fdc2431b841a194231

SHA256
dbb744cb1d18b4c2bbc2cf90fb80ba0ab695786ca1b526f4af4a46b36f2b547c

SHA512
1e5dbda73509f378eefd6b33b9ee9126829687fb3a7c13b3a1121c94216a70e1b56bb3ec534c111355f308c635f5cb3b67a849c7dc9224cefd1cf1c5cd986977

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
384409de55b4c327e929fee20d600cb3

SHA1
5fcaba7923016fba27f60826cd8d964a79cb0049

SHA256
591bb0bfcf5de125e5062bfa52b0535a4af5c5426d4b236503a9343c3e1df58d

SHA512
7c15dea21a0ceaee71b4eb302d8e2f18758d522429bfec567d213838a3ff13f3f1b995360bd45a083f0825e343389ecea12d87a9733df56180dc5a0113332c0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5925406c0c654398a61233a205777b2c

SHA1
0ee154d0d1ef118621e0458113ccbaa810aa5a26

SHA256
5c26962f5cbcb4d154ebdb758f1683d98978495c455880398670c8edffeadfc2

SHA512
66744bec3a1b2b87ed037998b94896e0c926c8028d3647d77c165630c5f39adec7f340943f115c63c5aef5fb5c811cf2c72152536f091e7c0b8af6cac39cfe48

Download Submit