0eebd018803b055f2e92dcdd44534c6f836cb751596fdd642406bd3b8ab0f691

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25-02-2024 17:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UjUg1DZa.html
Size

2KB
MD5

3ee20dbd2e342878d13972d5dc38e6ca
SHA1

12bee61f12b329c9af6cb7c92d16df366141acc5
SHA256

0eebd018803b055f2e92dcdd44534c6f836cb751596fdd642406bd3b8ab0f691
SHA512

d1e09d251c3ca98dd12f70850f31ac364b9ac0f898e8fe39469fc39b72f996cd398cbda49d29221e1e47c60dc3c6b855f138c5281b55c5b413770508d41ff8c6

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3368	msedge.exe
3368	msedge.exe
4504	msedge.exe
4504	msedge.exe
1092	identity_helper.exe
1092	identity_helper.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 3016	4504	msedge.exe	87
PID 4504 wrote to memory of 3016	4504	msedge.exe	87
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 636	4504	msedge.exe	88
PID 4504 wrote to memory of 3368	4504	msedge.exe	89
PID 4504 wrote to memory of 3368	4504	msedge.exe	89
PID 4504 wrote to memory of 2752	4504	msedge.exe	90
PID 4504 wrote to memory of 2752	4504	msedge.exe	90
PID 4504 wrote to memory of 2752	4504	msedge.exe	90
PID 4504 wrote to memory of 2752	4504	msedge.exe	90
PID 4504 wrote to memory of 2752	4504	msedge.exe	90
PID 4504 wrote to memory of 2752	4504	msedge.exe	90
PID 4504 wrote to memory of 2752	4504	msedge.exe	90
PID 4504 wrote to memory of 2752	4504	msedge.exe	90
PID 4504 wrote to memory of 2752	4504	msedge.exe	90
PID 4504 wrote to memory of 2752	4504	msedge.exe	90
PID 4504 wrote to memory of 2752	4504	msedge.exe	90
PID 4504 wrote to memory of 2752	4504	msedge.exe	90
PID 4504 wrote to memory of 2752	4504	msedge.exe	90
PID 4504 wrote to memory of 2752	4504	msedge.exe	90
PID 4504 wrote to memory of 2752	4504	msedge.exe	90
PID 4504 wrote to memory of 2752	4504	msedge.exe	90
PID 4504 wrote to memory of 2752	4504	msedge.exe	90
PID 4504 wrote to memory of 2752	4504	msedge.exe	90
PID 4504 wrote to memory of 2752	4504	msedge.exe	90
PID 4504 wrote to memory of 2752	4504	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\UjUg1DZa.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff82d8c46f8,0x7ff82d8c4708,0x7ff82d8c4718
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,1424203257415940980,3448740486412424171,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,1424203257415940980,3448740486412424171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,1424203257415940980,3448740486412424171,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2512 /prefetch:8
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1424203257415940980,3448740486412424171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1424203257415940980,3448740486412424171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,1424203257415940980,3448740486412424171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4700 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,1424203257415940980,3448740486412424171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1424203257415940980,3448740486412424171,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1424203257415940980,3448740486412424171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1424203257415940980,3448740486412424171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4512 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1424203257415940980,3448740486412424171,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,1424203257415940980,3448740486412424171,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
58670ac03d80eb4bd1cec7ac5672d2e8

SHA1
276295d2f9e58fb0b8ef03bd9567227fb94e03f7

SHA256
76e1645d9c4f363b34e554822cfe0d53ff1fce5e994acdf1edeff13ae8df30f8

SHA512
99fe23263de36ec0c8b6b3b0205df264250392cc9c0dd8fa28cf954ff39f9541f722f96a84fbc0b4e42cfd042f064525a6be4b220c0180109f8b1d51bbdef8ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3782686f747f4a85739b170a3898b645

SHA1
81ae1c4fd3d1fddb50b3773e66439367788c219c

SHA256
67ee813be3c6598a8ea02cd5bb5453fc0aa114606e3fc7ad216f205fe46dfc13

SHA512
54eb860107637a611150ff18ac57856257bf650f70dce822de234aee644423080b570632208d38e45e2f0d2bf60ca2684d3c3480f9637ea4ad81f2bcfb9f24d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dde6b510f2b3d34b7578617aac3c9618

SHA1
37bacfcff43c9c5ce93c6ccc031e6f5ca5449664

SHA256
502aa968b9e4ab8ebbefef61c88a737f284794a81d5f8da7f1307055dbc72a30

SHA512
1ebd608958204c4d288a690232e06dbe9d95bceb750fe019b2a641b16a7affca27008f50c384ab978beb32bf448baebfee82168aef947d3b85466f148b59a7c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5ccd423a1fe0747da8c3b511cf56de26

SHA1
709725d3ec3cdcb732e1fcc2b26c65f0dac73112

SHA256
97b77a37518982536a3fd47bfdd657a615bef6579ef990eee6f49dc3168d3701

SHA512
d9d1f063fdbf665c52aad1ffac3967953e0056efb2b7b4a4610c231eaf96b4496341267887e44947ca09689138488cb3c4f4785ed061c25c90a0de22f804a31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fcb25127c2c7166cccfa30dc51c8c117

SHA1
e118a3bbb8ea44b484e560b0b85ec657d094481c

SHA256
54e7325abb33366d739da1203ed7f1cb9644d5c32daf04f34e2e74b040374226

SHA512
a8bedaf79d56b8d5b82002dd50eba04f4352084607097330e62f7bdbdb0e33f23aa8150e48dd85fc06ebd74d6b22743bdb77d9e80b347036f92c08c02564ce7a

Download Submit