7d240a704184e81da7679f5ce4a2c06129fa994d601af0cf594919c204c0a1c1

General

Target

7d240a704184e81da7679f5ce4a2c06129fa994d601af0cf594919c204c0a1c1.html
Size

819KB
MD5

a91e03ad9ab8013830296daa9ac203c7
SHA1

81b3f06fa6e08037d59e8abbed948b2e28cf2b76
SHA256

7d240a704184e81da7679f5ce4a2c06129fa994d601af0cf594919c204c0a1c1
SHA512

8800fd945cf18f8104603103c3d5e523558ff29ee5548cb8e91eb2a9686ef66d1de8af48fdfadd02f2730be143030ffd235fafdbe9753cfa91d5e1ec279c75c7
SSDEEP

6144:aSrPGb6pFz+J6dCcfOMcXLtEGYKM29+9oPyv1LIpc1JRqSYs:0EGd79UoPyOs

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3260	msedge.exe
3260	msedge.exe
5068	msedge.exe
5068	msedge.exe
4580	identity_helper.exe
4580	identity_helper.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe
4216	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

5068 msedge.exe
5068 msedge.exe
5068 msedge.exe
5068 msedge.exe
5068 msedge.exe
5068 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 5068 wrote to memory of 2120	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 2120	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 208	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 3260	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 3260	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 384	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 384	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 384	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 384	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 384	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 384	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 384	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 384	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 384	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 384	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 384	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 384	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 384	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 384	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 384	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 384	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 384	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 384	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 384	5068	msedge.exe	msedge.exe
PID 5068 wrote to memory of 384	5068	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7d240a704184e81da7679f5ce4a2c06129fa994d601af0cf594919c204c0a1c1.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7ebd46f8,0x7ffa7ebd4708,0x7ffa7ebd4718
2⤵
PID:2120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,3207578311929790619,18127459579209593835,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,3207578311929790619,18127459579209593835,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
2⤵
PID:208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,3207578311929790619,18127459579209593835,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2972 /prefetch:8
2⤵
PID:384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3207578311929790619,18127459579209593835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
2⤵
PID:1408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3207578311929790619,18127459579209593835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
2⤵
PID:3580

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,3207578311929790619,18127459579209593835,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
2⤵
PID:1340

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,3207578311929790619,18127459579209593835,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3207578311929790619,18127459579209593835,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
2⤵
PID:868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3207578311929790619,18127459579209593835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
2⤵
PID:1664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3207578311929790619,18127459579209593835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
2⤵
PID:2040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,3207578311929790619,18127459579209593835,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
2⤵
PID:3956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,3207578311929790619,18127459579209593835,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1984 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
674B

MD5
c226aa5da012529e201b87ecb894ae90

SHA1
6db707976c1658dd554713b783843aee4cef506e

SHA256
f87601323fbef27ae3485898859515dcbd2b48dafb7e7b612e9b6d338728c9a3

SHA512
72d3c354a61b885813de9062ca9841018911fa7b2ef38cb79d74caceceb539c7d2e503b929fa9e8d62953c4b96f1999062001dd823aacc492fa96f56807a3d00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
01d6e7a61537f45b7e160840eb6888a1

SHA1
b127e6ff99cd223e5fb4b7db07ae929df4a3cd1f

SHA256
acc6d28ffb724d2e889fcd513580051bf5974249fa00a7ba8184728003451b47

SHA512
1df18934abe605d802edb008df04aad394e8a1e3fe37cff182c9f28f5bc7df14aef00917911cfe3cda4713d2a0fabdeac7252b38f3cfaecffe575a6f7c184f9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
566643b7adc647df411e67aa418bfe32

SHA1
d867339a0be18a7b792d5b299fe2337e0b7cee3a

SHA256
e4842b44a890da417d93e57aed7bfb09c7b9de4c92a8c42680a9eef387f25984

SHA512
f29e4e57375581bee94c7b88784b826640c804eebb7ca0e61ac7c466942eb05246e2b251830627e76db8fcfe35b2ef476070ff88a6cddfbd851e2e5ee1195d72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bc39afad5bacb0b67e426a5bda10a952

SHA1
8a7092385f970efe5877346a62f2aab8ffad1a9e

SHA256
29d44c8ddc21bbe4a6efa7297724da25f89092a413cb1fd6a962a7e840637e66

SHA512
fa2addb4d5ec8dfdbdefb33474db911c36d83e4b7ff18d58bb447e44960c102bbf14352fd5920a6941f491a4ddf8352a8f613e3b401b3bf486fede125249b570

Download Submit
\??\pipe\LOCAL\crashpad_5068_BYJXSZUBMTPDUIKA

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads