49bc02c1ca83818dafa48d6d7b5de85fde8b1c909495fd10b16d6263231dca8a

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25-02-2024 13:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3e171a50969043f0e170c31b3125414.html
Size

5KB
MD5

a3e171a50969043f0e170c31b3125414
SHA1

a92c9e8d4bf509b559f22f05f5171dee98ae8e59
SHA256

49bc02c1ca83818dafa48d6d7b5de85fde8b1c909495fd10b16d6263231dca8a
SHA512

37d111b2569e43a87584f426ec4e4d8d312bb7cceed7c6d72a0c9553c0c524d0570fae332b0b75e9591261779ea813a0e5320c808dc85eec3f66548372728c47
SSDEEP

96:Z+Xr5k9WDZU4xwwZihTYFbNf3XXr5k9ZBDZU4HKkWVTATxXr5k9ZBDZU4cS/+xX0:k7ohTYLftScVTATrSSSFCWKit

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1904	msedge.exe
1904	msedge.exe
4052	identity_helper.exe
4052	identity_helper.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 212	1904	msedge.exe	42
PID 1904 wrote to memory of 212	1904	msedge.exe	42
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 3932	1904	msedge.exe	87
PID 1904 wrote to memory of 1072	1904	msedge.exe	86
PID 1904 wrote to memory of 1072	1904	msedge.exe	86
PID 1904 wrote to memory of 4496	1904	msedge.exe	88
PID 1904 wrote to memory of 4496	1904	msedge.exe	88
PID 1904 wrote to memory of 4496	1904	msedge.exe	88
PID 1904 wrote to memory of 4496	1904	msedge.exe	88
PID 1904 wrote to memory of 4496	1904	msedge.exe	88
PID 1904 wrote to memory of 4496	1904	msedge.exe	88
PID 1904 wrote to memory of 4496	1904	msedge.exe	88
PID 1904 wrote to memory of 4496	1904	msedge.exe	88
PID 1904 wrote to memory of 4496	1904	msedge.exe	88
PID 1904 wrote to memory of 4496	1904	msedge.exe	88
PID 1904 wrote to memory of 4496	1904	msedge.exe	88
PID 1904 wrote to memory of 4496	1904	msedge.exe	88
PID 1904 wrote to memory of 4496	1904	msedge.exe	88
PID 1904 wrote to memory of 4496	1904	msedge.exe	88
PID 1904 wrote to memory of 4496	1904	msedge.exe	88
PID 1904 wrote to memory of 4496	1904	msedge.exe	88
PID 1904 wrote to memory of 4496	1904	msedge.exe	88
PID 1904 wrote to memory of 4496	1904	msedge.exe	88
PID 1904 wrote to memory of 4496	1904	msedge.exe	88
PID 1904 wrote to memory of 4496	1904	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a3e171a50969043f0e170c31b3125414.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb0c7a46f8,0x7ffb0c7a4708,0x7ffb0c7a4718
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,4956422069087700571,10406092167387352285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,4956422069087700571,10406092167387352285,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,4956422069087700571,10406092167387352285,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4956422069087700571,10406092167387352285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4956422069087700571,10406092167387352285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,4956422069087700571,10406092167387352285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,4956422069087700571,10406092167387352285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4956422069087700571,10406092167387352285,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4956422069087700571,10406092167387352285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4956422069087700571,10406092167387352285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4956422069087700571,10406092167387352285,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,4956422069087700571,10406092167387352285,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3092 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3bde7b7b0c0c9c66bdd8e3f712bd71eb

SHA1
266bd462e249f029df05311255a15c8f42719acc

SHA256
2ccd4a1b56206faa8f6482ce7841636e7bb2192f4cf5258d47e209953a77a01a

SHA512
5fab7a83d86d65e7c369848c5a7d375d9ad132246b57653242c7c7d960123a50257c9e8c4c9a8f22ee861fce357b018236ac877b96c03990a88de4ddb9822818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9cafa4c8eee7ab605ab279aafd19cc14

SHA1
e362e5d37d1a79e7b4a8642b068934e4571a55f1

SHA256
d0817f51aa2fb8c3cae18605dbfd6ec21a6ff3f953171e7ac064648ffdee1166

SHA512
eefd65ffcfb98ac8c3738eb2b3f4933d5bc5b992a1d465b8424903c8f74382ec2c95074290ddbb1001204843bfef59a32b868808a6bee4bc41ee9571515bbac6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
179B

MD5
efc8e9bcdf38e0e974864b336b0ef08b

SHA1
2e1f719dd14cb231febf31e6d75316575318564d

SHA256
460e7df466ddcb5ee05c71000e25f4ec25a3767dea8c146bd2871a163cb1c8eb

SHA512
06964513a4af499233ae4d3296df92c841cb8f38d97838aef74026ffaa79841b20e1ba54d6a55d99acd7af2b5536c01b4f68f93b1cfb7badd040a7711c78131d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4cb488e68a55662ca964b41fb6964ed7

SHA1
d9e53b0c5fd7a667736df860a9644dd546501c91

SHA256
c5a9cfb5c3930a7c144ecfdfda51dd9ba521f78ce6a6b7c33e481ceeab480d2b

SHA512
699aa2fb0a50286a3f8f085d726f77f8935d4fa4d0561b5bfbed6baf5d522ddfd97fefe5444bd81ddcc00fac2872808a2a570399ca1444beb8a6446343e0dfb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
65b1d079b451a4771096c27cfd6d6a94

SHA1
c5034b2b56a144fecd70972493d6120feeee4988

SHA256
89f0e5f8c0722d60e0d1861566962c16241cafccbe4330e6ccbfd54db1ed3f3a

SHA512
ea73b3931fed812d8adc151da9c0bef62e151bb1342687335ae274642a1e882a099d334a63eaad2d1830e475040b690e978cc292b9f506a1cefab81b3b5284fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a10186ee-0c54-4091-b19d-97ed0be0ae6f.tmp

Filesize
11KB

MD5
1888dd59d6513eadeb80d93379a2a591

SHA1
f517283de408139220d39bfe49ad954d9aa7457c

SHA256
7bd384b79edad9a4c08744e0d3c603be187f583406c7cf27084f00d8bc83e3a3

SHA512
07978ffdabbcecfdf9f6070e7faad784fb99f8e459f3e5b8949f0737fa680bcee702d8f826fbdb65a6c7772dcc1252136b3148fa7d2b229f42c3925b8aedd8d5

Download Submit