f03742e99af5a001e907791199aaf91645b52b664f29e6212175961c694a5dc5

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25-02-2024 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4191e84497fb53fb9e0e0444eafee7f.html
Size

3KB
MD5

a4191e84497fb53fb9e0e0444eafee7f
SHA1

d500ce645dd963da7f7a78523a97937d6976244b
SHA256

f03742e99af5a001e907791199aaf91645b52b664f29e6212175961c694a5dc5
SHA512

c5e1a6157da0dbf75e4db288ad1b15a70ecfcffb46c6101618f87caecdc2c1eca2c56424a7d01b1f5010a649a74cf0a501957ec7d6c3e517fa3a77f069fdd273

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe
4996	msedge.exe
4996	msedge.exe
4740	identity_helper.exe
4740	identity_helper.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 4424	4996	msedge.exe	86
PID 4996 wrote to memory of 4424	4996	msedge.exe	86
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 568	4996	msedge.exe	89
PID 4996 wrote to memory of 5048	4996	msedge.exe	88
PID 4996 wrote to memory of 5048	4996	msedge.exe	88
PID 4996 wrote to memory of 5032	4996	msedge.exe	90
PID 4996 wrote to memory of 5032	4996	msedge.exe	90
PID 4996 wrote to memory of 5032	4996	msedge.exe	90
PID 4996 wrote to memory of 5032	4996	msedge.exe	90
PID 4996 wrote to memory of 5032	4996	msedge.exe	90
PID 4996 wrote to memory of 5032	4996	msedge.exe	90
PID 4996 wrote to memory of 5032	4996	msedge.exe	90
PID 4996 wrote to memory of 5032	4996	msedge.exe	90
PID 4996 wrote to memory of 5032	4996	msedge.exe	90
PID 4996 wrote to memory of 5032	4996	msedge.exe	90
PID 4996 wrote to memory of 5032	4996	msedge.exe	90
PID 4996 wrote to memory of 5032	4996	msedge.exe	90
PID 4996 wrote to memory of 5032	4996	msedge.exe	90
PID 4996 wrote to memory of 5032	4996	msedge.exe	90
PID 4996 wrote to memory of 5032	4996	msedge.exe	90
PID 4996 wrote to memory of 5032	4996	msedge.exe	90
PID 4996 wrote to memory of 5032	4996	msedge.exe	90
PID 4996 wrote to memory of 5032	4996	msedge.exe	90
PID 4996 wrote to memory of 5032	4996	msedge.exe	90
PID 4996 wrote to memory of 5032	4996	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a4191e84497fb53fb9e0e0444eafee7f.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84cde46f8,0x7ff84cde4708,0x7ff84cde4718
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,11988638955632390614,15967548555384694328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,11988638955632390614,15967548555384694328,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,11988638955632390614,15967548555384694328,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11988638955632390614,15967548555384694328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11988638955632390614,15967548555384694328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,11988638955632390614,15967548555384694328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,11988638955632390614,15967548555384694328,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11988638955632390614,15967548555384694328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11988638955632390614,15967548555384694328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11988638955632390614,15967548555384694328,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,11988638955632390614,15967548555384694328,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,11988638955632390614,15967548555384694328,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4036 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
360dd5debf8bf7b89c4d88d29e38446c

SHA1
65afff8c78aeb12c577a523cb77cd58d401b0f82

SHA256
3d9debe659077c04b288107244a22f1b315bcf7495bee75151a9077e71b41eef

SHA512
0ee5b81f0acc82befa24a4438f2ca417ae6fac43fa8c7f264b83b4c792b1bb8d4cecb94c6cbd6facc120dc10d7e4d67e014cdb6b4db83b1a1b60144bb78f7542

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6fbbaffc5a50295d007ab405b0885ab5

SHA1
518e87df81db1dded184c3e4e3f129cca15baba1

SHA256
b9cde79357b550b171f70630fa94754ca2dcd6228b94f311aefe2a7f1ccfc7b6

SHA512
011c69bf56eb40e7ac5d201c1a0542878d9b32495e94d28c2f3b480772aa541bfd492a9959957d71e66f27b3e8b1a3c13b91f4a21756a9b8263281fd509c007b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e53771c4279ff448c778d8f6ec5aee5a

SHA1
0a641858428d9614eff644498b68db0a8ffbd954

SHA256
e94165981b80fa92fda245f95a3163b9f0a01b87aa42eb8a2fec50bd5c153692

SHA512
923dd8407f43b09e9f045e2cfdeb157d7b5cfd9630f92d29fd8ec23deeb8056d70458b9f9d1578a34e2e4b427c772349cce538afdefd2cc2b7a161d4ee01dc9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a82a1eb3ae4e09db6342074462b4ee98

SHA1
7609e1a0ae76f297b7918a92d451e4e2d903f48a

SHA256
3d295dd9b2f4e48b0607f02ab21dc55bbc16a2e2fa20f3f1ea8fe1c3b2564a69

SHA512
452b624ad2410d4725ea3b35ac6b14fff704cf07a8c209547b9a23836697d25525f4cb49e805c799648fe73ec0d73fbdee635999946024186f2bd869b2f9af98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d25fdfeb23e10716f17278e5f9a7ba40

SHA1
12279561fad40611ff5097e248f3661f6820af85

SHA256
e1d0bf91feac7b7fa8c5a03533aa31ab1b3310b73bf373a6705b5e5b65eed9ca

SHA512
a67c8a130741257a6542a2c96932d77215acc10bf7c9c01596e20cbf8e75652838810e4a03090deded69f46213aaebd916ad871df198cfa724efed974eba6ff6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d54961c8-9682-49a1-b69d-5f9a870b306c.tmp

Filesize
11KB

MD5
48bccad4a719fa9f76e7acddfbcba4ea

SHA1
1f14a90e362bfcf1e3edfa12bea9bfa4d223c1f2

SHA256
ef5df9024e2053f2ef68c7e8400d7cbdc4253930cb330a7ab072f93a3de29599

SHA512
decb626bd94f0d750a377ec104613b71f6666c6fa903b543cfa61569137bb8ae347a4a96529a24a240b6c7401bec165c7b77d027670a6e40fd0600fefe68b94d

Download Submit