31873b6c7ff8df53013be90c7d8797c80961b4d5271025d293746180a15f497f

Analysis

max time kernel
149s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25/02/2024, 09:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a36aab05d029451a182054aafaa45829.html
Size

42KB
MD5

a36aab05d029451a182054aafaa45829
SHA1

e500ae80c726df9aad51bf75bd3a1c465e452407
SHA256

31873b6c7ff8df53013be90c7d8797c80961b4d5271025d293746180a15f497f
SHA512

0718a53189cac83acc9a6a0973c85a85fbb853cf8ec3781c26be388ba9c30a9f6a99bd5063c932e853f35477f32a4ee18e8778817c45923c3ea64548ec2dacce
SSDEEP

384:t7KoalGjRgRNAqsqT0Zea3/J/Gf5MeJk0DLkQereVeqLw9gGb6QHMHYK6DRTJRQk:t+oaJCgG9JRQmnn3

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1080	msedge.exe
1080	msedge.exe
3256	msedge.exe
3256	msedge.exe
5652	identity_helper.exe
5652	identity_helper.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 5008	3256	msedge.exe	88
PID 3256 wrote to memory of 5008	3256	msedge.exe	88
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1656	3256	msedge.exe	91
PID 3256 wrote to memory of 1080	3256	msedge.exe	89
PID 3256 wrote to memory of 1080	3256	msedge.exe	89
PID 3256 wrote to memory of 1228	3256	msedge.exe	90
PID 3256 wrote to memory of 1228	3256	msedge.exe	90
PID 3256 wrote to memory of 1228	3256	msedge.exe	90
PID 3256 wrote to memory of 1228	3256	msedge.exe	90
PID 3256 wrote to memory of 1228	3256	msedge.exe	90
PID 3256 wrote to memory of 1228	3256	msedge.exe	90
PID 3256 wrote to memory of 1228	3256	msedge.exe	90
PID 3256 wrote to memory of 1228	3256	msedge.exe	90
PID 3256 wrote to memory of 1228	3256	msedge.exe	90
PID 3256 wrote to memory of 1228	3256	msedge.exe	90
PID 3256 wrote to memory of 1228	3256	msedge.exe	90
PID 3256 wrote to memory of 1228	3256	msedge.exe	90
PID 3256 wrote to memory of 1228	3256	msedge.exe	90
PID 3256 wrote to memory of 1228	3256	msedge.exe	90
PID 3256 wrote to memory of 1228	3256	msedge.exe	90
PID 3256 wrote to memory of 1228	3256	msedge.exe	90
PID 3256 wrote to memory of 1228	3256	msedge.exe	90
PID 3256 wrote to memory of 1228	3256	msedge.exe	90
PID 3256 wrote to memory of 1228	3256	msedge.exe	90
PID 3256 wrote to memory of 1228	3256	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a36aab05d029451a182054aafaa45829.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a44846f8,0x7ff9a4484708,0x7ff9a4484718
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,3737887792985376426,13421457796283817277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,3737887792985376426,13421457796283817277,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,3737887792985376426,13421457796283817277,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3737887792985376426,13421457796283817277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3737887792985376426,13421457796283817277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,3737887792985376426,13421457796283817277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,3737887792985376426,13421457796283817277,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3737887792985376426,13421457796283817277,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3737887792985376426,13421457796283817277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3737887792985376426,13421457796283817277,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3737887792985376426,13421457796283817277,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,3737887792985376426,13421457796283817277,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1268 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d62cefeb0c8fbab806b3b96c7b215c16

SHA1
dc36684019f7ac8a632f5401cc3bedd482526ed7

SHA256
752b0793cf152e9ea51b8a2dc1d7e622c1c1009677d8f29e8b88d3aa9427dd01

SHA512
9fc3968fec094be5ca10a0d927cb829f7f8157425946ebd99a346b7e63c977cb3f37560af1a4bc8f87ab19b43b3ed86fd5b37f89d1a9b2dc86e3c73142c3065b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7ee1c6757da82ca0a9ae699227f619bc

SHA1
72dcf8262c6400dcbb5228afcb36795ae1b8001f

SHA256
62320bde5e037d4ac1aa0f5ff0314b661f13bb56c02432814bffb0bd6e34ed31

SHA512
dca56a99b7463eddf0af3656a4f7d0177a43116f401a6de9f56e5c40a49676cea5c38b6c458f426c6bff11165eec21104cfa9ca3e38af39d43188b36d3f22a0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c343fddd30ba62e56d010ba9486a9f08

SHA1
ab5833119c34c5ffca7c6b3940e5098e0154285b

SHA256
cfa2ba4dcafa92f52445d1d6c2dc9f3d30b2f49cd6edf086c550426056d48bbb

SHA512
335e68f5bd3beeae777c18cf7ad869c143d380947c101b722e911cefec1cd6a460145e7b00443365d728c34f5908aea595ae4a6f9f24e8592e9e85c7ff7a446e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e8a7cf5479712d93e6b6d3a5e879b393

SHA1
f773f3a0819862e6de4a83a82c33b82862e733aa

SHA256
05b786bf35fde5df8138d3a66b24c7f306735ba949c91fb05732a517dd29bd99

SHA512
b17fb3ec5c78bfb9566c78735d5937da75f9b12dc327eed3df0f11b0932cebf99e4c33c691e7d1179d8eabde764f4b5cf3da130faa295c8c80f6706c7fffa635

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a1043fe367a7bcf6739e45853b762f4e

SHA1
e5857e8ae84710aa0e40f94015e1e79e40bb0f2d

SHA256
91a16f765dcb8459471808ad9db580f69ed98a5a69fbbc709401f3dbc7b5b8b0

SHA512
084d853b3164ad59a109053a55e9c1fb2f311394939f2f1495f311bf4a37353a1eeb3224fa3527c8deccd7ba7793ecf6cb3cae27c59dacf4f9dccdc59233f57e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ffd11c545a6b61c33fc16b431857cf7c

SHA1
89234cc3b56439529221637a2e2840f343d0b4d5

SHA256
5b347b9b8196b0854d6398a2a77f6adde7d138c6acf99dd6ed4cb0f7dcd618c6

SHA512
ca1b514335cd03536305a1b4d0d12000ed056e1be9883c97f0d1f23b36ff76a5e20c60a7bd1d3f7c7693f2dc26a7c3267cc34298abded047fe6fb3eccc01dc71

Download Submit