346785074f6f703721c69fb83f0e47f7793d6d4ada18360cb05360c2c49e6b59

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2024, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

edit.html
Size

17KB
MD5

0804dc6f418d31fb2715c6d39e97a956
SHA1

38506fe006d41a14c618126aa7d90725a9494244
SHA256

346785074f6f703721c69fb83f0e47f7793d6d4ada18360cb05360c2c49e6b59
SHA512

032b551e434411c8708a4ecb06c49c248998371984ff9fe16fcd6a36199b7b02f86c8e87a740ce9f113b113c2e4a1b548a16005bc9daa52b2c3bc2e3b2b0dbcb
SSDEEP

384:5Ssl9qYoJkN099Lnh0poAJKap8uJGYReQSfgAgW:BoJkKnhJO/JzR5igW

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3604	msedge.exe
3604	msedge.exe
4004	msedge.exe
4004	msedge.exe
1984	identity_helper.exe
1984	identity_helper.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 2152	4004	msedge.exe	53
PID 4004 wrote to memory of 2152	4004	msedge.exe	53
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 3604	4004	msedge.exe	89
PID 4004 wrote to memory of 3604	4004	msedge.exe	89
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\edit.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd753846f8,0x7ffd75384708,0x7ffd75384718
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,4373800707560836935,7221242143616473663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,4373800707560836935,7221242143616473663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,4373800707560836935,7221242143616473663,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4373800707560836935,7221242143616473663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4373800707560836935,7221242143616473663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,4373800707560836935,7221242143616473663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,4373800707560836935,7221242143616473663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4373800707560836935,7221242143616473663,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4373800707560836935,7221242143616473663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4373800707560836935,7221242143616473663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4373800707560836935,7221242143616473663,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,4373800707560836935,7221242143616473663,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5700 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f35bb0615bb9816f562b83304e456294

SHA1
1049e2bd3e1bbb4cea572467d7c4a96648659cb4

SHA256
05e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71

SHA512
db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1eb86108cb8f5a956fdf48efbd5d06fe

SHA1
7b2b299f753798e4891df2d9cbf30f94b39ef924

SHA256
1b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40

SHA512
e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
197B

MD5
35004b3819feeba12906aa973431aff4

SHA1
404821c1b4287b2dcfda395032924fb1e7790017

SHA256
c06b1977b2a2e8d2e3ed992c2c862a73e0a4f632c13cac6bbde78fd21d7bba74

SHA512
f8ae8fb779f11fee137e88ae8c9dabe830d7267c859551daf3810c247ecee45628d7fabb9b4d8bb4c49da11842df107119a71865c0faf6ccb64237f3ce2092b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
22c4e0d088eb4a0888b14b0c34192552

SHA1
6e2b1902c867068d1c4309f109d1918b508e64bb

SHA256
7d74f35b55389111f5640775c0f28fdc4d2a571bb0e79b91d9fe63995d2e7f0b

SHA512
89432a0d5ec20d64e215a357fd8dcc403931e8031148545280e3498e1b4b84abedcbc10587362dcdfd97cbcebe243efb138992fb1bead0326a861970d81fa52f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d7ba3f2f0c45cb62a0968f79240c7e9e

SHA1
1f5b9ddecb446189a2023f8d91c0f083bf129cc0

SHA256
4355c0b5967d3f020470c01283763dfbedf4c9432aa782a411de90c03a522cc3

SHA512
ebc70e1035d1d33070d6ce209bc0aac017fbc1f0cfbc49f9d756cdff9e25b18e247f59e92e32e36ffbe5308e3198bb9bb2e66ce6a04efd0d50ea57d39bfd009b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
45cf480df4af88b85d3c5549e791d666

SHA1
9be2fe4170b4f4baf3c7b9a215cad73815b7b6a3

SHA256
dfcc6baaeb2280f99435f569bb1817f38df786f89e3902929751ee051667beb2

SHA512
be4a6686c6988b5a2776437e67af485c8bf316b56ced76b8f49e3f2f28be0ef9abfa0dd0231ce881d8afe1b73405c06772706d3023f8f41837e2a6fbce139c69

Download Submit