ddbfd16db1eb21483e78fea4c09dd0569770a96e1f9ebe871de8ad4a5919cd22

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2024, 20:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa1b6fd442690cdc22140dbb37ab4541.html
Size

53KB
MD5

aa1b6fd442690cdc22140dbb37ab4541
SHA1

84e71e38321065256edbf0d8e213046c1ac7309f
SHA256

ddbfd16db1eb21483e78fea4c09dd0569770a96e1f9ebe871de8ad4a5919cd22
SHA512

e34614f093b3b0a138f0935a749156c1ad11aea93df54fcd1d5ad47f571671434f6a8b034ee0b4857961a6cc2e210941d91d97d3011cf82e0243018e7aa27c03
SSDEEP

1536:CkgUiIakTqGivi+PyUB5runlYP63Nj+q5VyvR0w2AzTICbbxoI/t9M/dNwIUTDml:CkgUiIakTqGivi+PyUbrunlYP63Nj+q5

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1660	msedge.exe
1660	msedge.exe
808	msedge.exe
808	msedge.exe
1852	identity_helper.exe
1852	identity_helper.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe
808	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 688	808	msedge.exe	85
PID 808 wrote to memory of 688	808	msedge.exe	85
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 2776	808	msedge.exe	87
PID 808 wrote to memory of 1660	808	msedge.exe	86
PID 808 wrote to memory of 1660	808	msedge.exe	86
PID 808 wrote to memory of 388	808	msedge.exe	88
PID 808 wrote to memory of 388	808	msedge.exe	88
PID 808 wrote to memory of 388	808	msedge.exe	88
PID 808 wrote to memory of 388	808	msedge.exe	88
PID 808 wrote to memory of 388	808	msedge.exe	88
PID 808 wrote to memory of 388	808	msedge.exe	88
PID 808 wrote to memory of 388	808	msedge.exe	88
PID 808 wrote to memory of 388	808	msedge.exe	88
PID 808 wrote to memory of 388	808	msedge.exe	88
PID 808 wrote to memory of 388	808	msedge.exe	88
PID 808 wrote to memory of 388	808	msedge.exe	88
PID 808 wrote to memory of 388	808	msedge.exe	88
PID 808 wrote to memory of 388	808	msedge.exe	88
PID 808 wrote to memory of 388	808	msedge.exe	88
PID 808 wrote to memory of 388	808	msedge.exe	88
PID 808 wrote to memory of 388	808	msedge.exe	88
PID 808 wrote to memory of 388	808	msedge.exe	88
PID 808 wrote to memory of 388	808	msedge.exe	88
PID 808 wrote to memory of 388	808	msedge.exe	88
PID 808 wrote to memory of 388	808	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\aa1b6fd442690cdc22140dbb37ab4541.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff62f846f8,0x7fff62f84708,0x7fff62f84718
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,2901659375528413274,15784178586960480616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,2901659375528413274,15784178586960480616,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,2901659375528413274,15784178586960480616,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2901659375528413274,15784178586960480616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2901659375528413274,15784178586960480616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2901659375528413274,15784178586960480616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2901659375528413274,15784178586960480616,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2901659375528413274,15784178586960480616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,2901659375528413274,15784178586960480616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,2901659375528413274,15784178586960480616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2901659375528413274,15784178586960480616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2901659375528413274,15784178586960480616,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,2901659375528413274,15784178586960480616,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
403B

MD5
fc51fe2b7d1d4b82e22fcd541ae8752c

SHA1
be2d843144f07234c5e420bac984368a3939a53f

SHA256
9b7899c095bf9d96e337509ec88c0787f4a3f3f2fd2a0bfb43b655e53f6f100a

SHA512
06be0e9fc30c6a77fa94beec8d464aa82918624c46066fd9bde9f340b3a6c402c22e893836a451d1a6c57a7d9bfaee162772214be2d78bd0cb86f77226a21e40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7cd43ba25cc74ca2e1f7b0472d76e6a7

SHA1
daa5106d3c45710be32bdaef61a9da82d4795e61

SHA256
f45ca22aabdb80906a70e2db02810e0b78ac50aba53ec80e9fd9fa1f8e1bbae1

SHA512
ac485dc89b62ea861914ec7ac1ae286cc815990712cdcc43f88bcd1cdde01bbda1216296e99af2b4437ab08c571b3fe6dc012fa6e2a2ae806722bc59fac8e1f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c9b077062bd6fad505f92a278568cbb7

SHA1
f8def2ea069dd924bedb6c2accf219924cd4dffd

SHA256
ce3779d997772591c6b8397abd1e0a5e7990bf6d6782198796b541ce848d22c8

SHA512
60cb8f853e3ce03296840257b7eb927495a02769872680bdbfd9b18da95c083efcf602400c81e7765020ee9b25d2108e38c8f832b8630527e31faa80ecad12a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ef789dbe7e754330f2fe621f4b8251d0

SHA1
1051e96036ecce4359577ebe5f7dd172e574cb2d

SHA256
f793b6e8fcd69c1f98c2be1a39a16af24c06d5712636903d6278a5a3d5a13ca9

SHA512
57de4f91fdef6ab2be84b855cccac0ce3a9d6cfb6fee1d1d14423fe60eaa814701e95632bcc2fbdbf34bdc39f2f06edc50d74da6929a2dba67b626c179d3e630

Download Submit