99ff6aa8e84ecae29f3e82557380a6f253ae3b85a68f77277b3206b1947a46fc

Analysis

max time kernel
165s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac174b6159210e76e61e51851bb74936.html
Size

3.5MB
MD5

ac174b6159210e76e61e51851bb74936
SHA1

0aea05cf6a32041ff0be124c32c8ca0c2e56f772
SHA256

99ff6aa8e84ecae29f3e82557380a6f253ae3b85a68f77277b3206b1947a46fc
SHA512

1f36f4de2b054ffdefda838ad6ee20105dd24875228a8738b574f4484b7249c2da592221c876d647d2509280293e3ef0d9956286f765469a94042524a9680d2f
SSDEEP

12288:oLZhBVKHfVfitmg11tmg1P16bf7axluxOT6Nfv:ovpjte4tT6Nv

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1436	msedge.exe
1436	msedge.exe
4040	msedge.exe
4040	msedge.exe
3972	identity_helper.exe
3972	identity_helper.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 2400	4040	msedge.exe	38
PID 4040 wrote to memory of 2400	4040	msedge.exe	38
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 4668	4040	msedge.exe	90
PID 4040 wrote to memory of 1436	4040	msedge.exe	89
PID 4040 wrote to memory of 1436	4040	msedge.exe	89
PID 4040 wrote to memory of 2416	4040	msedge.exe	91
PID 4040 wrote to memory of 2416	4040	msedge.exe	91
PID 4040 wrote to memory of 2416	4040	msedge.exe	91
PID 4040 wrote to memory of 2416	4040	msedge.exe	91
PID 4040 wrote to memory of 2416	4040	msedge.exe	91
PID 4040 wrote to memory of 2416	4040	msedge.exe	91
PID 4040 wrote to memory of 2416	4040	msedge.exe	91
PID 4040 wrote to memory of 2416	4040	msedge.exe	91
PID 4040 wrote to memory of 2416	4040	msedge.exe	91
PID 4040 wrote to memory of 2416	4040	msedge.exe	91
PID 4040 wrote to memory of 2416	4040	msedge.exe	91
PID 4040 wrote to memory of 2416	4040	msedge.exe	91
PID 4040 wrote to memory of 2416	4040	msedge.exe	91
PID 4040 wrote to memory of 2416	4040	msedge.exe	91
PID 4040 wrote to memory of 2416	4040	msedge.exe	91
PID 4040 wrote to memory of 2416	4040	msedge.exe	91
PID 4040 wrote to memory of 2416	4040	msedge.exe	91
PID 4040 wrote to memory of 2416	4040	msedge.exe	91
PID 4040 wrote to memory of 2416	4040	msedge.exe	91
PID 4040 wrote to memory of 2416	4040	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ac174b6159210e76e61e51851bb74936.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbd37d46f8,0x7ffbd37d4708,0x7ffbd37d4718
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,3652511875064896414,12066958806368382493,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,3652511875064896414,12066958806368382493,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,3652511875064896414,12066958806368382493,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3652511875064896414,12066958806368382493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3652511875064896414,12066958806368382493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3652511875064896414,12066958806368382493,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3652511875064896414,12066958806368382493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,3652511875064896414,12066958806368382493,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,3652511875064896414,12066958806368382493,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3652511875064896414,12066958806368382493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3652511875064896414,12066958806368382493,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,3652511875064896414,12066958806368382493,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5212 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36bb45cb1262fcfcab1e3e7960784eaa

SHA1
ab0e15841b027632c9e1b0a47d3dec42162fc637

SHA256
7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae

SHA512
02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1e3dc6a82a2cb341f7c9feeaf53f466f

SHA1
915decb72e1f86e14114f14ac9bfd9ba198fdfce

SHA256
a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c

SHA512
0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
981B

MD5
c32482ccf10724713aefacceb6669e79

SHA1
c5d0164b8afebd542231af7e807a0c5ac2fa95f3

SHA256
e01bc07ae853d136ceed6082a79a819588d93b6e3011b80f8d2ea10401eca7bb

SHA512
483b5fcff64e125b8710f531274c0f84516f32f39409141e259c6a942d2e74f0b423ac97cf2a9f3b97bf49d32a1efeb36900834aea99a7c8e30df0a5130b1dd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b887c13462d6cfe707304d05d49e5028

SHA1
6f3f011503309ea46bf530fcfd463664041010a8

SHA256
7e6c408965a4fd43242c3fe7c17e055806819fb7c92cfd3347138ffb23944e2d

SHA512
4c20798368276a872e7fa500fc83009c5656020d5cc882bca13bc529472f99ab6dd48315981cc051afe53fb35a9f08b507e37a1c15ab0989eb2b8b9f4998cd35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5a592db7065d01956e73dc4265cd2ecd

SHA1
d982eb5aac65f408c58a059d97f2953b763ac9c3

SHA256
81dd155e060f043453caed9d4afa87fb5f87dd3d3f5365562d4f475300202af1

SHA512
747842d9025e4b82a11d0b88472a00857291edee297fddb7bc32a958fdcb40f118ae022d7b0eb37f01c470d4c768c7fb3e50dd3a2798e54547b2d15780c9511d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
956732010400b997d8befbb531233ea4

SHA1
9e25803b6d3e1900de2ba8f7f5b1619515da79f1

SHA256
876e5f56aadf5d1ebf2876583b1ad9f7053dd4b8f69ca993e892d2ccc71ecb3d

SHA512
a1eedf35c16bc9fe984d56da530a0a4fb91728134611fb46039634178d11a47632ce2c19f45a86c91b3e81516d32089e13db2c6b61b8ff530e1dff38bbb1a53a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1eb89562d49175c93c5bf6ef1b77a79e

SHA1
60cb2953a988917d17df0e1973f188e569e4cfde

SHA256
51807e92fc033706459464350b6b066b49629349bb259db7f31cade4d31c090a

SHA512
cbd8b836e24dacbcb6b26f6e28e2e686ae51f0c2ccccfd79eeb84efc5f2d71674d2edb2b47e868395b7f71a1a8c4c50a2266238f0eff90df7a3499213c7551e7

Download Submit