Analysis
-
max time kernel
145s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29-02-2024 05:32
Static task
static1
Behavioral task
behavioral1
Sample
7d240a704184e81da7679f5ce4a2c06129fa994d601af0cf594919c204c0a1c1.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
7d240a704184e81da7679f5ce4a2c06129fa994d601af0cf594919c204c0a1c1.html
Resource
win10v2004-20240226-en
General
-
Target
7d240a704184e81da7679f5ce4a2c06129fa994d601af0cf594919c204c0a1c1.html
-
Size
819KB
-
MD5
a91e03ad9ab8013830296daa9ac203c7
-
SHA1
81b3f06fa6e08037d59e8abbed948b2e28cf2b76
-
SHA256
7d240a704184e81da7679f5ce4a2c06129fa994d601af0cf594919c204c0a1c1
-
SHA512
8800fd945cf18f8104603103c3d5e523558ff29ee5548cb8e91eb2a9686ef66d1de8af48fdfadd02f2730be143030ffd235fafdbe9753cfa91d5e1ec279c75c7
-
SSDEEP
6144:aSrPGb6pFz+J6dCcfOMcXLtEGYKM29+9oPyv1LIpc1JRqSYs:0EGd79UoPyOs
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 4624 msedge.exe 4624 msedge.exe 2208 msedge.exe 2208 msedge.exe 5080 identity_helper.exe 5080 identity_helper.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe 4552 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe 2208 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 2208 wrote to memory of 3744 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 3744 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 2520 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 4624 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 4624 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 1228 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 1228 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 1228 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 1228 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 1228 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 1228 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 1228 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 1228 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 1228 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 1228 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 1228 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 1228 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 1228 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 1228 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 1228 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 1228 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 1228 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 1228 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 1228 2208 msedge.exe msedge.exe PID 2208 wrote to memory of 1228 2208 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7d240a704184e81da7679f5ce4a2c06129fa994d601af0cf594919c204c0a1c1.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd7c246f8,0x7ffcd7c24708,0x7ffcd7c247182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,7542789426195053493,13107970232839525826,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,7542789426195053493,13107970232839525826,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,7542789426195053493,13107970232839525826,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7542789426195053493,13107970232839525826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7542789426195053493,13107970232839525826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,7542789426195053493,13107970232839525826,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5976 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,7542789426195053493,13107970232839525826,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5976 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7542789426195053493,13107970232839525826,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7542789426195053493,13107970232839525826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7542789426195053493,13107970232839525826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,7542789426195053493,13107970232839525826,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,7542789426195053493,13107970232839525826,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4876 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD547b2c6613360b818825d076d14c051f7
SHA17df7304568313a06540f490bf3305cb89bc03e5c
SHA25647a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac
SHA51208d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5e0811105475d528ab174dfdb69f935f3
SHA1dd9689f0f70a07b4e6fb29607e42d2d5faf1f516
SHA256c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c
SHA5128374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\52b0e35f-9992-4609-8115-1fe8e5451630.tmpFilesize
6KB
MD5a264fcca41ddfde6852c4a116e4b9405
SHA12e3b72edb760b9f78e748b97b87e71ca365930fd
SHA256695071e15e349c97352eab1555ccd9bddad47b0160597a907b39df94d1eeeb0c
SHA512da08d7949501ed1c863f76f53fc05db5f0500aaccd5df5ea665f523bd0e295efd458b5bf5b9e693898cb05737f9f9d917730e18bcb65a4accff789215dd85da6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
674B
MD5696a01cf25534dae40351a280006fa15
SHA1c26ef37460c6428be6d45b2b73de230344041364
SHA256196dc8a6b39bf3ecf4569b6a112cd92e65d1548713dc2df74822bcb8b59be358
SHA5126ad2de0c5b735d7bb17716500c3ee3f7a66034d2ed319eaa6da2cd76580dececc62119c465188e8ebd198e4686a3e3e93c24e816b4dbcb4d2af40f377fea6de6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5ce9acc04fb2c8601275eda2dbb45cde4
SHA1d58948232b04b1c87f0d130817857f4ec1b1e045
SHA256edaa444bec886634bbf8f9cd70efbc35a9be33440b546cabe0fd7a0294daf8f9
SHA512a5f336bc3b07fd00148fce9c8fbcebd25d274707fc9337558e94952ed06439de8579db0833f1f0af6239a62a5b76c7a039c604ebb98001c151d5b98bed09c217
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5d44fb593a8e06d850fc867d1300031ae
SHA1dd7d8709c28e51129c6d9e0c90fc7221a1587c1b
SHA256c53f3dd46b75d78d7ecc24b56bd07eb3ff025af583e7b0857eded7dd577ed159
SHA512a8584ac6c9f9607cc6773828fdfd902ea2a11bcb66e9fdc243e7bb13c8058ae7c17f645bd43135cb53db225455956cdc989e3697612ccd29e252bf9a5c69915f
-
\??\pipe\LOCAL\crashpad_2208_ASGLGSPJRDSZBLQMMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e