15654d371a6f0de04648d7c08420cbe750dbd26c6434f274668b44281f04e38b

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2024, 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9cac5718f65cc8aba8bb6e1771ef3bd.html
Size

3.5MB
MD5

a9cac5718f65cc8aba8bb6e1771ef3bd
SHA1

2463642db7d2b909a4da11bd46c0ff8f06b8909f
SHA256

15654d371a6f0de04648d7c08420cbe750dbd26c6434f274668b44281f04e38b
SHA512

1b60fd929937334ff389e810d3ef9ab9467fdeb458ad5daea1b9026b431b5049cecc9a1c91a6164bb9dc0db61e38e535c575bbbe03647ec468113c420fb91a8a
SSDEEP

12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6Ny4:jvpjte4tT6s4

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4964	msedge.exe
4964	msedge.exe
3180	msedge.exe
3180	msedge.exe
4868	identity_helper.exe
4868	identity_helper.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 4592	3180	msedge.exe	72
PID 3180 wrote to memory of 4592	3180	msedge.exe	72
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 3972	3180	msedge.exe	89
PID 3180 wrote to memory of 4964	3180	msedge.exe	90
PID 3180 wrote to memory of 4964	3180	msedge.exe	90
PID 3180 wrote to memory of 3912	3180	msedge.exe	91
PID 3180 wrote to memory of 3912	3180	msedge.exe	91
PID 3180 wrote to memory of 3912	3180	msedge.exe	91
PID 3180 wrote to memory of 3912	3180	msedge.exe	91
PID 3180 wrote to memory of 3912	3180	msedge.exe	91
PID 3180 wrote to memory of 3912	3180	msedge.exe	91
PID 3180 wrote to memory of 3912	3180	msedge.exe	91
PID 3180 wrote to memory of 3912	3180	msedge.exe	91
PID 3180 wrote to memory of 3912	3180	msedge.exe	91
PID 3180 wrote to memory of 3912	3180	msedge.exe	91
PID 3180 wrote to memory of 3912	3180	msedge.exe	91
PID 3180 wrote to memory of 3912	3180	msedge.exe	91
PID 3180 wrote to memory of 3912	3180	msedge.exe	91
PID 3180 wrote to memory of 3912	3180	msedge.exe	91
PID 3180 wrote to memory of 3912	3180	msedge.exe	91
PID 3180 wrote to memory of 3912	3180	msedge.exe	91
PID 3180 wrote to memory of 3912	3180	msedge.exe	91
PID 3180 wrote to memory of 3912	3180	msedge.exe	91
PID 3180 wrote to memory of 3912	3180	msedge.exe	91
PID 3180 wrote to memory of 3912	3180	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a9cac5718f65cc8aba8bb6e1771ef3bd.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3f2146f8,0x7ffa3f214708,0x7ffa3f214718
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,1400162898391349450,2344841207253706542,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,1400162898391349450,2344841207253706542,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,1400162898391349450,2344841207253706542,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1400162898391349450,2344841207253706542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1400162898391349450,2344841207253706542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,1400162898391349450,2344841207253706542,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,1400162898391349450,2344841207253706542,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1400162898391349450,2344841207253706542,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1400162898391349450,2344841207253706542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1400162898391349450,2344841207253706542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3132 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1400162898391349450,2344841207253706542,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,1400162898391349450,2344841207253706542,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3940 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c6136bc98a5aedca2ea3004e9fbe67d

SHA1
74318d997f4c9c351eef86d040bc9b085ce1ad4f

SHA256
50c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2

SHA512
2d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c6aef82e50d05ffc0cf52a6c6d69c91

SHA1
c203efe5b45b0630fee7bd364fe7d63b769e2351

SHA256
d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32

SHA512
77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
981B

MD5
80b6e053ba0b616b5d7e1cf9c971e831

SHA1
efec935db0fa76e1899dfe878628d766b1902f65

SHA256
0ab5a728f29271228db0bcf4c9bc2ec77e0ed76c59ab92c75369f9ba64bed28c

SHA512
d069f0b9fe5637c990b480d594bd1a9ad4b52cc5e6efb2c16bfe198a88ee179805f88963700f82aa241f4f479a1d5783a44ff1d1c42b757b93e6e1ebdcb411bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
01bb0b45e50d739c716e2337aa7b5ce0

SHA1
9804501e158f07a6d919ce6ade02f4c55a0067c8

SHA256
2b26130cf07605f37cfe044b413e353cb129282ef810f18130e3050f9a499308

SHA512
ea20062b2133852ab59cd582f4f26b5e9f366efd6231483a5678c0df706dcda04747fd4414841aa2247d576d270e521c48db909e5782c8da40a3b5b1cb41bb64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
66fa46ec0adf87fd4aed34a1202e58ad

SHA1
458d3226ab79649bfb9aa3245c7b8b483d3ac55c

SHA256
ee28782b4835c5939fed5eb0e705d8be2b86592b55d036c1be5c511a50e40809

SHA512
5d12526061e268055d566ef4cb161f3f7820414c645d197909721d44e2e1b027e4c92d5c6d79a6f46c50e964bc3b393787969d36dd2b04703b569848a4a84222

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
048f96026707768ee70642321015170c

SHA1
8b1f191487ae3ebb40f9f4d36bd60c11a746a896

SHA256
527c1c81da6273b4f07047e8ffd726686c7adb49474d9d7b0254a044e710a723

SHA512
c4da33c0bab9154834a168723cd0ebac32eb12bcb90bb5a2d73a1a1b8be86e2e7cddc2a33fb91672c76d3ba17cf7b9e306b0486e00b3477e1404d16e4c3f5ba6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f4d439980e7c61244cb822578fbf8f1b

SHA1
c50b3f761db2a2ee9303257ffbed33bf0f431bba

SHA256
83a66d338a3a995fb3fcc39fc0e5c550b6f76cf08e21cf260b27c6f949262815

SHA512
2c1542f8b588adb81aa3a616231a651b43710e6e39dc32aded861fead278fa38456d4f99f963c15614e980583b6e055e81aad33a69aa8d799c7dddaa01cf9405

Download Submit