46628bb59f21cb6f35d4e7f60ba515e6c21fb6a2d4a48536711be4ebd5405261

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25-02-2024 11:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3ae9dd1a0a23f63b92672d4765e9616.html
Size

3.5MB
MD5

a3ae9dd1a0a23f63b92672d4765e9616
SHA1

ea38a5a9fed0a9a18a12047aa2eb7146367a89ff
SHA256

46628bb59f21cb6f35d4e7f60ba515e6c21fb6a2d4a48536711be4ebd5405261
SHA512

777a90d891932027fd21e020b95b7def3f7970332ed68849023f4e1d5219140eabea82718e4a9d6a559424c28cb893a6db4e68ac2008d79d50da0577726771f8
SSDEEP

12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6Nu/:jvpjte4tT6s/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4344	msedge.exe
4344	msedge.exe
2232	msedge.exe
2232	msedge.exe
5440	identity_helper.exe
5440	identity_helper.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 4520	2232	msedge.exe	53
PID 2232 wrote to memory of 4520	2232	msedge.exe	53
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 2680	2232	msedge.exe	90
PID 2232 wrote to memory of 4344	2232	msedge.exe	89
PID 2232 wrote to memory of 4344	2232	msedge.exe	89
PID 2232 wrote to memory of 4864	2232	msedge.exe	91
PID 2232 wrote to memory of 4864	2232	msedge.exe	91
PID 2232 wrote to memory of 4864	2232	msedge.exe	91
PID 2232 wrote to memory of 4864	2232	msedge.exe	91
PID 2232 wrote to memory of 4864	2232	msedge.exe	91
PID 2232 wrote to memory of 4864	2232	msedge.exe	91
PID 2232 wrote to memory of 4864	2232	msedge.exe	91
PID 2232 wrote to memory of 4864	2232	msedge.exe	91
PID 2232 wrote to memory of 4864	2232	msedge.exe	91
PID 2232 wrote to memory of 4864	2232	msedge.exe	91
PID 2232 wrote to memory of 4864	2232	msedge.exe	91
PID 2232 wrote to memory of 4864	2232	msedge.exe	91
PID 2232 wrote to memory of 4864	2232	msedge.exe	91
PID 2232 wrote to memory of 4864	2232	msedge.exe	91
PID 2232 wrote to memory of 4864	2232	msedge.exe	91
PID 2232 wrote to memory of 4864	2232	msedge.exe	91
PID 2232 wrote to memory of 4864	2232	msedge.exe	91
PID 2232 wrote to memory of 4864	2232	msedge.exe	91
PID 2232 wrote to memory of 4864	2232	msedge.exe	91
PID 2232 wrote to memory of 4864	2232	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a3ae9dd1a0a23f63b92672d4765e9616.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ab5646f8,0x7ff8ab564708,0x7ff8ab564718
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,15868860719279237565,13157098171199580472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,15868860719279237565,13157098171199580472,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,15868860719279237565,13157098171199580472,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15868860719279237565,13157098171199580472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15868860719279237565,13157098171199580472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,15868860719279237565,13157098171199580472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,15868860719279237565,13157098171199580472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15868860719279237565,13157098171199580472,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15868860719279237565,13157098171199580472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15868860719279237565,13157098171199580472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15868860719279237565,13157098171199580472,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,15868860719279237565,13157098171199580472,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4668 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
343e73b39eb89ceab25618efc0cd8c8c

SHA1
6a5c7dcfd4cd4088793de6a3966aa914a07faf4c

SHA256
6ea83db86f592a3416738a1f1de5db00cd0408b0de820256d09d9bee9e291223

SHA512
54f321405b91fe397b50597b80564cff3a4b7ccb9aaf47cdf832a0932f30a82ed034ca75a422506c7b609a95b2ed97db58d517089cd85e38187112525ca499cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d4c957a0a66b47d997435ead0940becf

SHA1
1aed2765dd971764b96455003851f8965e3ae07d

SHA256
53fa86fbddf4cdddab1f884c7937ba334fce81ddc59e9b2522fec2d19c7fc163

SHA512
19cd43e9756829911685916ce9ac8f0375f2f686bfffdf95a6259d8ee767d487151fc938e88b8aada5777364a313ad6b2af8bc1aa601c59f0163cbca7c108fbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
981B

MD5
b4b17b08ce082303e225938269acd694

SHA1
53ce06306f2aabf488636aae75c9b0e5c0327073

SHA256
2110ec131118086c50a921f4ec3fef83e0f06f4eb99a1863ccff3bbed2a475d4

SHA512
082f6d055165220a3a6e710b4b7d366878c4c9b38bccc7052d7a473c78ec34fa380aea74666bbb0beb397c2339028d3f74f60e9a3ae6292184490ae0f9ecc7b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0cd533232de92354234f5a18e2e59375

SHA1
4081fcc5a0495ca000cf7c3560155484a06d77fc

SHA256
ff5968ad307e00d2644110e20ae048606016988e4476d582b03bb85fc85b835d

SHA512
42063f8ff5ffcc98081ba96341c43bd2b561574a8519b26a5e1140495257f01234dedc04304db143d2627feb92197c08e50021bddf0c87b0b0c4211ea9ba496e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
885fea915db884892234462f684fb3ee

SHA1
ca0483e635db70da472cc914f05097c5f7b0af91

SHA256
80929c72a47bf92b23f37b901e298bfd6e872824ae26e409cce0a48433218763

SHA512
cffeb6d87bdc6bf1d18bcee7de57340ddd430b4474d266732724496c480bb02badc352b67b5a22bd7ca2275c77e870e15a9112768bb9cae6cb85df5ade6317f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
168d570c4c09ee7ec9b81044e6c38f96

SHA1
8020298264755d013c9f7ea602f15466f4ba6f23

SHA256
90f47b77e2694fd4971caa236bc72b1172e623e1ac4a839eb03622650853563f

SHA512
290f5500d92422e3cc7808f5414cfa899b9e1a47449ce4672353cfcfbb1a84ee2f2a017fb6316dee855598e42fed4ac1655508a19f4e81aa29913375f6efc874

Download Submit