ce640bec66c5d651e315303628c5b606dfe8bf2b2c7bf552e26a6097457319de

Analysis

max time kernel
145s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2024, 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa38087c62dd04c4b0c1811bb583d0a1.html
Size

1KB
MD5

aa38087c62dd04c4b0c1811bb583d0a1
SHA1

4c03169173e0242efb6bc39f1639d83ef240b1e4
SHA256

ce640bec66c5d651e315303628c5b606dfe8bf2b2c7bf552e26a6097457319de
SHA512

50affc2a202905c99a784135b7cdb08342486b8e86e086958b0d539602f1bf7e4eae723bcb809018e38b16d1b282d678e139d32c6afb2d93b843e60415c8cbf3

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2092	msedge.exe
2092	msedge.exe
2400	msedge.exe
2400	msedge.exe
2716	identity_helper.exe
2716	identity_helper.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe
2300	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 960	2400	msedge.exe	77
PID 2400 wrote to memory of 960	2400	msedge.exe	77
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 1120	2400	msedge.exe	89
PID 2400 wrote to memory of 2092	2400	msedge.exe	88
PID 2400 wrote to memory of 2092	2400	msedge.exe	88
PID 2400 wrote to memory of 3376	2400	msedge.exe	90
PID 2400 wrote to memory of 3376	2400	msedge.exe	90
PID 2400 wrote to memory of 3376	2400	msedge.exe	90
PID 2400 wrote to memory of 3376	2400	msedge.exe	90
PID 2400 wrote to memory of 3376	2400	msedge.exe	90
PID 2400 wrote to memory of 3376	2400	msedge.exe	90
PID 2400 wrote to memory of 3376	2400	msedge.exe	90
PID 2400 wrote to memory of 3376	2400	msedge.exe	90
PID 2400 wrote to memory of 3376	2400	msedge.exe	90
PID 2400 wrote to memory of 3376	2400	msedge.exe	90
PID 2400 wrote to memory of 3376	2400	msedge.exe	90
PID 2400 wrote to memory of 3376	2400	msedge.exe	90
PID 2400 wrote to memory of 3376	2400	msedge.exe	90
PID 2400 wrote to memory of 3376	2400	msedge.exe	90
PID 2400 wrote to memory of 3376	2400	msedge.exe	90
PID 2400 wrote to memory of 3376	2400	msedge.exe	90
PID 2400 wrote to memory of 3376	2400	msedge.exe	90
PID 2400 wrote to memory of 3376	2400	msedge.exe	90
PID 2400 wrote to memory of 3376	2400	msedge.exe	90
PID 2400 wrote to memory of 3376	2400	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\aa38087c62dd04c4b0c1811bb583d0a1.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe0bba46f8,0x7ffe0bba4708,0x7ffe0bba4718
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1948,1274204015537975644,14116904571148610330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1948,1274204015537975644,14116904571148610330,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1948,1274204015537975644,14116904571148610330,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,1274204015537975644,14116904571148610330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,1274204015537975644,14116904571148610330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,1274204015537975644,14116904571148610330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4348 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,1274204015537975644,14116904571148610330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1948,1274204015537975644,14116904571148610330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1948,1274204015537975644,14116904571148610330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,1274204015537975644,14116904571148610330,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,1274204015537975644,14116904571148610330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,1274204015537975644,14116904571148610330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1948,1274204015537975644,14116904571148610330,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1948,1274204015537975644,14116904571148610330,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cbec32729772aa6c576e97df4fef48f5

SHA1
6ec173d5313f27ba1e46ad66c7bbe7c0a9767dba

SHA256
d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e

SHA512
425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
279e783b0129b64a8529800a88fbf1ee

SHA1
204c62ec8cef8467e5729cad52adae293178744f

SHA256
3619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932

SHA512
32730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
189B

MD5
397f53f29a17baee00697ca31a738b65

SHA1
bc300bb2b7797ab6c948a77db2cefad1361d0f7a

SHA256
0dba79eb79d62dbf47c0a71d0802e2f473818740fd5869140da4dbfa54582948

SHA512
b2857d010ac2c15a16838ff92c50042ebf687e293f05bef559769768fc214032dafa75d0ecb41554122b647294999cbc41cfa3c8e3bf9f5bf8d02a32fc057817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d98a8bc7d3670e02d68a24ed98d0d05e

SHA1
bfebba7d3963086f99292db43f88f1cb64172ff9

SHA256
7a2d47c2d58f5d63fccd0f8d6dd94b92ce950c684475c1f749e27502dd95e03d

SHA512
8980a2d5b5c4ced2371218b4d173a2ec4c72aa168252e62c894ca06fb864fd80ca0f40c8a756e99374a3dc0049d97406f2a69ed2238b102f07af9cabc1b7ede6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ea47c738f146812a98ce56da4f03bd18

SHA1
04390392fe43a132a8268847c49c92808e85808d

SHA256
3af5a6262bf89acb585656e740f59fc66b0afa10f7ae12291858186270c2b93b

SHA512
2574500c15b0c79dc16b2f14a5badbc761703f0a6e1e202caef79ac28abf096321f21f1e1bf8ed3b71d12bc96f510828f60958fe990414fdf4d7be665d48c7c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b175b09042d3277987d4ced248cf72b9

SHA1
91eb5f4d5000d2c2aff428f51ee6706e607ddcbd

SHA256
b5c8bd082610780e2cf810a754d32fb4a95facfcd0166d7a6e4b77b87f8d8a3a

SHA512
2431ec460a3f2911b285713a475a47d5c0c012688c20d9eccdffcdcff0f28660f8ce30afd4c3dab14d9561cd3ba7758de518fde6eac260a7faa165b9e9111e97

Download Submit