Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-02-2024 01:57
Static task
static1
Behavioral task
behavioral1
Sample
aab5961e8f53f8d87bbfc9b412dc989b.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
aab5961e8f53f8d87bbfc9b412dc989b.html
Resource
win10v2004-20240226-en
General
-
Target
aab5961e8f53f8d87bbfc9b412dc989b.html
-
Size
53KB
-
MD5
aab5961e8f53f8d87bbfc9b412dc989b
-
SHA1
bf1eeccec1c3e96c3a06cd2e86792e4a1acc202b
-
SHA256
e8a90ee2aa3e019ae0be7148d4a42d4f00b1b5c687449e1898d843b6f61b42ae
-
SHA512
b5b0e96740904f50a5630ca97bfb0151752fda8d6e3f5b1167382715ebdefed315aa97d4779b997c7e60ec575a2842d4e15d24ff26e88b278d1c4888e4a5350f
-
SSDEEP
1536:CkgUiIakTqGivi+PyU+runlY463Nj+q5VyvR0w2AzTICbbhol/t9M/dNwIUEDmDx:CkgUiIakTqGivi+PyU+runlY463Nj+qP
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1528 msedge.exe 1528 msedge.exe 1344 msedge.exe 1344 msedge.exe 4848 identity_helper.exe 4848 identity_helper.exe 2568 msedge.exe 2568 msedge.exe 2568 msedge.exe 2568 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe 1344 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1344 wrote to memory of 3940 1344 msedge.exe 64 PID 1344 wrote to memory of 3940 1344 msedge.exe 64 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1732 1344 msedge.exe 87 PID 1344 wrote to memory of 1528 1344 msedge.exe 88 PID 1344 wrote to memory of 1528 1344 msedge.exe 88 PID 1344 wrote to memory of 460 1344 msedge.exe 89 PID 1344 wrote to memory of 460 1344 msedge.exe 89 PID 1344 wrote to memory of 460 1344 msedge.exe 89 PID 1344 wrote to memory of 460 1344 msedge.exe 89 PID 1344 wrote to memory of 460 1344 msedge.exe 89 PID 1344 wrote to memory of 460 1344 msedge.exe 89 PID 1344 wrote to memory of 460 1344 msedge.exe 89 PID 1344 wrote to memory of 460 1344 msedge.exe 89 PID 1344 wrote to memory of 460 1344 msedge.exe 89 PID 1344 wrote to memory of 460 1344 msedge.exe 89 PID 1344 wrote to memory of 460 1344 msedge.exe 89 PID 1344 wrote to memory of 460 1344 msedge.exe 89 PID 1344 wrote to memory of 460 1344 msedge.exe 89 PID 1344 wrote to memory of 460 1344 msedge.exe 89 PID 1344 wrote to memory of 460 1344 msedge.exe 89 PID 1344 wrote to memory of 460 1344 msedge.exe 89 PID 1344 wrote to memory of 460 1344 msedge.exe 89 PID 1344 wrote to memory of 460 1344 msedge.exe 89 PID 1344 wrote to memory of 460 1344 msedge.exe 89 PID 1344 wrote to memory of 460 1344 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\aab5961e8f53f8d87bbfc9b412dc989b.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc99746f8,0x7ffcc9974708,0x7ffcc99747182⤵PID:3940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,12360860311923293926,7418667399851597995,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵PID:1732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,12360860311923293926,7418667399851597995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,12360860311923293926,7418667399851597995,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:82⤵PID:460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12360860311923293926,7418667399851597995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:3324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12360860311923293926,7418667399851597995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:2236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12360860311923293926,7418667399851597995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:12⤵PID:4624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,12360860311923293926,7418667399851597995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:82⤵PID:3180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,12360860311923293926,7418667399851597995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12360860311923293926,7418667399851597995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:12⤵PID:4536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12360860311923293926,7418667399851597995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:12⤵PID:2696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12360860311923293926,7418667399851597995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:12⤵PID:4496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12360860311923293926,7418667399851597995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:12⤵PID:1488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,12360860311923293926,7418667399851597995,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2840 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2568
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:680
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5068
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD57c6136bc98a5aedca2ea3004e9fbe67d
SHA174318d997f4c9c351eef86d040bc9b085ce1ad4f
SHA25650c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2
SHA5122d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada
-
Filesize
152B
MD55c6aef82e50d05ffc0cf52a6c6d69c91
SHA1c203efe5b45b0630fee7bd364fe7d63b769e2351
SHA256d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32
SHA51277ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
402B
MD529b1b0a620598295a254737d24515241
SHA17b56bb14dadef84a2f8a2ecd9b79c58ed4f4e878
SHA256fb411f32fda102325dcaea0ca83c2b223c5ff1261bc0476dce3fb022f2a7805d
SHA5126053cf55c8ed07daa50d65a258a05cac2c13647bf2daecd7304e86646199c4ccb737143c0d48f293320e74ebc54832c32321aa12b6d7c63e762d9eed28d5dbbe
-
Filesize
6KB
MD581bdc003daa3caa410dfbae405c736c5
SHA1951142a4781fb146c21fe9180741d70623c4ce50
SHA2568af2bf61041f4dc818124c497a48d7e03adc3b3459bf8bb9925c13f32622885f
SHA5121a7edfec91814e567c56241b34d567845c904ba3d8f86b6da0f7543bed0ffb323b39ac3081bbfea9f13eb1191a25b51d87237b4e6dac43cb4e70643f255f64ce
-
Filesize
6KB
MD5962957e1259afc75ad86cbddb92b7d96
SHA12898a24509650773f88d85a3b4c522c7b0a63f82
SHA2563134a912491adebc641ae015e13d5b14a9dc0229f3a2be4397cee3ec90a476d3
SHA5121659ea76f505dd0a4a73593fa1269eb926bdd3ae31a4c9913fb90cea0f0144f6a4bd0bee1dd37c790d59d9c38d248467a3ef466a9b9f08c01a361dc7e91c9019
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5e6fa69ae7756287e6f470cdb9faa74f6
SHA19e86d39ac59e5a80e8dabfc8fb740d5556895760
SHA25650e6136adb64be10df5905bf9dcee27a6e5e72cbcaa550386578e245b68f91b5
SHA51280a8f9524374e7a5bfadcf9e896cefab7f77b27396f2c2392cb5b4f7107d6ff58314eaf9ec4b1693ab343617eda49837bce07e0b67968b33ef93161338d69655