dcdf3b3857687ee4e84aa758e42111a94284c5aa757dc972556c252ce8b2cfc9

Analysis

max time kernel
145s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2024, 16:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a9a4d0e1f9f425e60c4ffa7dbd926934.html
Size

951B
MD5

a9a4d0e1f9f425e60c4ffa7dbd926934
SHA1

e40028969a9b5983a9726a7994c6fb2bbb2d95a8
SHA256

dcdf3b3857687ee4e84aa758e42111a94284c5aa757dc972556c252ce8b2cfc9
SHA512

90098b1fe341fa7e5a681893af409648d67daa5f048f42cb730071190ab84bbb183915a9667660611403a45e14b93d7d14027ce1c9577db159a96466994f09f1

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1416	msedge.exe
1416	msedge.exe
1212	msedge.exe
1212	msedge.exe
4532	identity_helper.exe
4532	identity_helper.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe
1212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 3400	1212	msedge.exe	88
PID 1212 wrote to memory of 3400	1212	msedge.exe	88
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1992	1212	msedge.exe	90
PID 1212 wrote to memory of 1416	1212	msedge.exe	89
PID 1212 wrote to memory of 1416	1212	msedge.exe	89
PID 1212 wrote to memory of 4140	1212	msedge.exe	91
PID 1212 wrote to memory of 4140	1212	msedge.exe	91
PID 1212 wrote to memory of 4140	1212	msedge.exe	91
PID 1212 wrote to memory of 4140	1212	msedge.exe	91
PID 1212 wrote to memory of 4140	1212	msedge.exe	91
PID 1212 wrote to memory of 4140	1212	msedge.exe	91
PID 1212 wrote to memory of 4140	1212	msedge.exe	91
PID 1212 wrote to memory of 4140	1212	msedge.exe	91
PID 1212 wrote to memory of 4140	1212	msedge.exe	91
PID 1212 wrote to memory of 4140	1212	msedge.exe	91
PID 1212 wrote to memory of 4140	1212	msedge.exe	91
PID 1212 wrote to memory of 4140	1212	msedge.exe	91
PID 1212 wrote to memory of 4140	1212	msedge.exe	91
PID 1212 wrote to memory of 4140	1212	msedge.exe	91
PID 1212 wrote to memory of 4140	1212	msedge.exe	91
PID 1212 wrote to memory of 4140	1212	msedge.exe	91
PID 1212 wrote to memory of 4140	1212	msedge.exe	91
PID 1212 wrote to memory of 4140	1212	msedge.exe	91
PID 1212 wrote to memory of 4140	1212	msedge.exe	91
PID 1212 wrote to memory of 4140	1212	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a9a4d0e1f9f425e60c4ffa7dbd926934.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb19a846f8,0x7ffb19a84708,0x7ffb19a84718
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,6500461934255181223,12069713215468814358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,6500461934255181223,12069713215468814358,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,6500461934255181223,12069713215468814358,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,6500461934255181223,12069713215468814358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,6500461934255181223,12069713215468814358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,6500461934255181223,12069713215468814358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,6500461934255181223,12069713215468814358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3936 /prefetch:8
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,6500461934255181223,12069713215468814358,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3936 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,6500461934255181223,12069713215468814358,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,6500461934255181223,12069713215468814358,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2292 /prefetch:1
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,6500461934255181223,12069713215468814358,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,6500461934255181223,12069713215468814358,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4996 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f35bb0615bb9816f562b83304e456294

SHA1
1049e2bd3e1bbb4cea572467d7c4a96648659cb4

SHA256
05e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71

SHA512
db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1eb86108cb8f5a956fdf48efbd5d06fe

SHA1
7b2b299f753798e4891df2d9cbf30f94b39ef924

SHA256
1b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40

SHA512
e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2a8a4c4d1ff3a5fb07dd171ae5c8430a

SHA1
658058d88783a6883beefd51667df9c5d2a85c8e

SHA256
fb57c7b5ae4a7718d971a922aedb51cd4410565294cd64be13b4d833bf87d000

SHA512
34c4fc12c5238257c7ea4a309e834f33c967e3bcead3effc86be60b3a419b5f78c429069b5b49bf3b01a6f91a4a80bc5d257a1567d5a0ce32728ccca78ed3136

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fde5a7f0f656a54b4ac46656ce3dcb52

SHA1
c4e258845ac057b43f05818c5a8fb94fdb386379

SHA256
c2534ef037f038fc4b7a9c3a5b8c31bb10475ac0924bcab5a2a1c98e0b663f2c

SHA512
0240cdc041685ab69e83bb95151dc4d899f7382c6a72669431476fa7ab2ea3a9a984041ce3808e36a38f2e9e9b9cbc191785425a1e25927c3be46b77f3463674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cfa9f4de-b33d-4929-9729-7dcc20b4cbf9.tmp

Filesize
11KB

MD5
88dc2785ce1b5a2fbc3879278527962f

SHA1
cd0875c4b4b20a7e2e743fc7ccf03623a5f142b5

SHA256
8d20c83571d6cdc5cfb8b109099bf78df35348f354612a89cb4696d4877ac5d7

SHA512
b4213b2e68ff92977706d7c22dd930477fd0f410b4813c765b863cb47b8154fd873d94ec71a6a9bed8564e7ab278890f2869138d1c58e3a7757a1a27e2de427b

Download Submit