346785074f6f703721c69fb83f0e47f7793d6d4ada18360cb05360c2c49e6b59

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2024, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
edit.html
Size 17KB
Sample240227-2bnmvada32
SHA256 346785074f6f703721c69fb83f0e47f7793d6d4ada18360cb05360c2c49e6b59
MD5 0804dc6f418d31fb2715c6d39e97a956
SHA1 38506fe006d41a14c618126aa7d90725a9494244
SHA512 032b551e434411c8708a4ecb06c49c248998371984ff9fe16fcd6a36199b7b02f86c8e87a740ce9f113b113c2e4a1b548a16005bc9daa52b2c3bc2e3b2b0dbcb
SSDEEP 384:5Ssl9qYoJkN099Lnh0poAJKap8uJGYReQSfgAgW:BoJkKnhJO/JzR5igW
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3604	msedge.exe
3604	msedge.exe
4004	msedge.exe
4004	msedge.exe
1984	identity_helper.exe
1984	identity_helper.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 2152	4004	msedge.exe	53
PID 4004 wrote to memory of 2152	4004	msedge.exe	53
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 1992	4004	msedge.exe	91
PID 4004 wrote to memory of 3604	4004	msedge.exe	89
PID 4004 wrote to memory of 3604	4004	msedge.exe	89
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90
PID 4004 wrote to memory of 4884	4004	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\edit.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd753846f8,0x7ffd75384708,0x7ffd75384718
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,4373800707560836935,7221242143616473663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,4373800707560836935,7221242143616473663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,4373800707560836935,7221242143616473663,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4373800707560836935,7221242143616473663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4373800707560836935,7221242143616473663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,4373800707560836935,7221242143616473663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,4373800707560836935,7221242143616473663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4373800707560836935,7221242143616473663,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4373800707560836935,7221242143616473663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4373800707560836935,7221242143616473663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4373800707560836935,7221242143616473663,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,4373800707560836935,7221242143616473663,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5700 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 05e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71
MD5 f35bb0615bb9816f562b83304e456294
SHA1 1049e2bd3e1bbb4cea572467d7c4a96648659cb4
SHA512 db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40
MD5 1eb86108cb8f5a956fdf48efbd5d06fe
SHA1 7b2b299f753798e4891df2d9cbf30f94b39ef924
SHA512 e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 197B
SHA256 c06b1977b2a2e8d2e3ed992c2c862a73e0a4f632c13cac6bbde78fd21d7bba74
MD5 35004b3819feeba12906aa973431aff4
SHA1 404821c1b4287b2dcfda395032924fb1e7790017
SHA512 f8ae8fb779f11fee137e88ae8c9dabe830d7267c859551daf3810c247ecee45628d7fabb9b4d8bb4c49da11842df107119a71865c0faf6ccb64237f3ce2092b1
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 7d74f35b55389111f5640775c0f28fdc4d2a571bb0e79b91d9fe63995d2e7f0b
MD5 22c4e0d088eb4a0888b14b0c34192552
SHA1 6e2b1902c867068d1c4309f109d1918b508e64bb
SHA512 89432a0d5ec20d64e215a357fd8dcc403931e8031148545280e3498e1b4b84abedcbc10587362dcdfd97cbcebe243efb138992fb1bead0326a861970d81fa52f
SSDEEP 96:nWkmR1lbSPwpvWMoiVmdeHKaOsUWQyV+VD7ziEwb:nWk6jSPGWMXZfrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 4355c0b5967d3f020470c01283763dfbedf4c9432aa782a411de90c03a522cc3
MD5 d7ba3f2f0c45cb62a0968f79240c7e9e
SHA1 1f5b9ddecb446189a2023f8d91c0f083bf129cc0
SHA512 ebc70e1035d1d33070d6ce209bc0aac017fbc1f0cfbc49f9d756cdff9e25b18e247f59e92e32e36ffbe5308e3198bb9bb2e66ce6a04efd0d50ea57d39bfd009b
SSDEEP 96:nWkiR1lbSPwpvWMoiVmdeHKaOsUWQyV+VD7AiEwb:nWkejSPGWMXZfrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 dfcc6baaeb2280f99435f569bb1817f38df786f89e3902929751ee051667beb2
MD5 45cf480df4af88b85d3c5549e791d666
SHA1 9be2fe4170b4f4baf3c7b9a215cad73815b7b6a3
SHA512 be4a6686c6988b5a2776437e67af485c8bf316b56ced76b8f49e3f2f28be0ef9abfa0dd0231ce881d8afe1b73405c06772706d3023f8f41837e2a6fbce139c69
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup0/hce2RUqhKbEZ9xUX1MPK:A9iIxuERzA83h09RZxY0URNZ9E1MeuB2
MD5 SHA1 SHA512 SSDEEP

Submit Download