7d240a704184e81da7679f5ce4a2c06129fa994d601af0cf594919c204c0a1c1

General

Target

7d240a704184e81da7679f5ce4a2c06129fa994d601af0cf594919c204c0a1c1.html
Size

819KB
MD5

a91e03ad9ab8013830296daa9ac203c7
SHA1

81b3f06fa6e08037d59e8abbed948b2e28cf2b76
SHA256

7d240a704184e81da7679f5ce4a2c06129fa994d601af0cf594919c204c0a1c1
SHA512

8800fd945cf18f8104603103c3d5e523558ff29ee5548cb8e91eb2a9686ef66d1de8af48fdfadd02f2730be143030ffd235fafdbe9753cfa91d5e1ec279c75c7
SSDEEP

6144:aSrPGb6pFz+J6dCcfOMcXLtEGYKM29+9oPyv1LIpc1JRqSYs:0EGd79UoPyOs

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4816	msedge.exe
4816	msedge.exe
3708	msedge.exe
3708	msedge.exe
1612	identity_helper.exe
1612	identity_helper.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

3708 msedge.exe
3708 msedge.exe
3708 msedge.exe
3708 msedge.exe
3708 msedge.exe
3708 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3708 wrote to memory of 2124	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 2124	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1236	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 4816	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 4816	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 4824	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 4824	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 4824	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 4824	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 4824	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 4824	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 4824	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 4824	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 4824	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 4824	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 4824	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 4824	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 4824	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 4824	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 4824	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 4824	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 4824	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 4824	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 4824	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 4824	3708	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7d240a704184e81da7679f5ce4a2c06129fa994d601af0cf594919c204c0a1c1.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffdc52f46f8,0x7ffdc52f4708,0x7ffdc52f4718
2⤵
PID:2124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,15227145438157867374,78679334162166182,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,15227145438157867374,78679334162166182,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
2⤵
PID:1236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,15227145438157867374,78679334162166182,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:8
2⤵
PID:4824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,15227145438157867374,78679334162166182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
2⤵
PID:2756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,15227145438157867374,78679334162166182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
2⤵
PID:1780

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,15227145438157867374,78679334162166182,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
2⤵
PID:3228

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,15227145438157867374,78679334162166182,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,15227145438157867374,78679334162166182,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
2⤵
PID:2304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,15227145438157867374,78679334162166182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
2⤵
PID:4312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,15227145438157867374,78679334162166182,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
2⤵
PID:2972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,15227145438157867374,78679334162166182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
2⤵
PID:3820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,15227145438157867374,78679334162166182,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
47b2c6613360b818825d076d14c051f7

SHA1
7df7304568313a06540f490bf3305cb89bc03e5c

SHA256
47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac

SHA512
08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e0811105475d528ab174dfdb69f935f3

SHA1
dd9689f0f70a07b4e6fb29607e42d2d5faf1f516

SHA256
c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c

SHA512
8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
674B

MD5
5a98824215f7556ec877e993e27546b8

SHA1
26119b73fbd465c680a72867b417725d3c623f4f

SHA256
62649083329eda4bf6ee62864eb28f081d0fec098c33461ce8d389ec9011d7a4

SHA512
a9191f533aebe41168f8f40c5ebbfe17dbd774b20f9d9429d88aaeb2452c1017ea6e64d7358b3b62b135f11b99fb204cba0a541a4accdf75a8fbc3005b275cf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f3e43e009409b5c43513a49af408054e

SHA1
399e9359966a7d952a3ea864ec02e78b7918b7ee

SHA256
f90d8feda3c0e1b715f32264fc71aa901f9a0ce222c9b7b0b0008b2fbe63a00e

SHA512
bf30ab9a9f76335c8f2dd22a2bfdcb59c50986b4c5910c61604dca6edabff5f189ee5f566715a16e0fda4a974f9d822fd63b9a298919be2bc2b8b176c3a2a2ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0ceb045cf5147f16aed19be3f5ecedc6

SHA1
609a01d9c2498d343ef40bd8b8cb12aa3b73be9e

SHA256
8896257d4c0d8ae3ca03205e8cfd9c3e564d448269b0bad5ffca6faffc445f61

SHA512
b948b9dbe00fce5606f184f137632dfe0a6e8f980d10227bee4a473eb406b53186a1746f0af593ec8217995bdb030db09b3eb4d764aa1b551a9be08f26650a56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7a3e85ef5610883131c19678b4e7fedc

SHA1
3f7980ced83f83c33c6c3069848010a52993cbda

SHA256
9e341b25ed99129ea6fbf2023f6b11c108f3acd59e2c93645c4feee41ea14d12

SHA512
2aa8dfb6c7b907eebdbdb17a5d69579892bf2d4cd18a084c045249cbbfa050679c1ddceb8f514107ad5c775d557456aab9b7c22f7ec6a70595b794378532a9f2

Download Submit
\??\pipe\LOCAL\crashpad_3708_GKVMSUGBGOWDVQOF

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads