0625c527305d279ef2fbe88dc151fa9279b2731a7513c4c5dcff038bb645c527

Analysis

max time kernel
146s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-02-2024 07:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae03b98e50c6b0d4dd7549e5891d01e7.html
Size

83KB
MD5

ae03b98e50c6b0d4dd7549e5891d01e7
SHA1

787f6826b0e7706e540a5649709571befd31844f
SHA256

0625c527305d279ef2fbe88dc151fa9279b2731a7513c4c5dcff038bb645c527
SHA512

096500bc51f9fd7d0d391f2dddc52530c31fc962a6fb79894b59b619caafaca614668f949e1c30a495ac48efea67c6e2bf3dd369c329ef45acae110dceeae740
SSDEEP

768:+ZJoagG13yjqwW8WM5I7Qr68F8PlXgw2xtl2Sic:K/f3yBhWMisrZF8PMxtL

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
436	msedge.exe
436	msedge.exe
4516	identity_helper.exe
4516	identity_helper.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe
3748	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 4872	436	msedge.exe	44
PID 436 wrote to memory of 4872	436	msedge.exe	44
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4076	436	msedge.exe	89
PID 436 wrote to memory of 4888	436	msedge.exe	88
PID 436 wrote to memory of 4888	436	msedge.exe	88
PID 436 wrote to memory of 3184	436	msedge.exe	90
PID 436 wrote to memory of 3184	436	msedge.exe	90
PID 436 wrote to memory of 3184	436	msedge.exe	90
PID 436 wrote to memory of 3184	436	msedge.exe	90
PID 436 wrote to memory of 3184	436	msedge.exe	90
PID 436 wrote to memory of 3184	436	msedge.exe	90
PID 436 wrote to memory of 3184	436	msedge.exe	90
PID 436 wrote to memory of 3184	436	msedge.exe	90
PID 436 wrote to memory of 3184	436	msedge.exe	90
PID 436 wrote to memory of 3184	436	msedge.exe	90
PID 436 wrote to memory of 3184	436	msedge.exe	90
PID 436 wrote to memory of 3184	436	msedge.exe	90
PID 436 wrote to memory of 3184	436	msedge.exe	90
PID 436 wrote to memory of 3184	436	msedge.exe	90
PID 436 wrote to memory of 3184	436	msedge.exe	90
PID 436 wrote to memory of 3184	436	msedge.exe	90
PID 436 wrote to memory of 3184	436	msedge.exe	90
PID 436 wrote to memory of 3184	436	msedge.exe	90
PID 436 wrote to memory of 3184	436	msedge.exe	90
PID 436 wrote to memory of 3184	436	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ae03b98e50c6b0d4dd7549e5891d01e7.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9b3b46f8,0x7ffa9b3b4708,0x7ffa9b3b4718
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1956,12824070164834032446,6597633896549266620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,12824070164834032446,6597633896549266620,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1956,12824070164834032446,6597633896549266620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,12824070164834032446,6597633896549266620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,12824070164834032446,6597633896549266620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,12824070164834032446,6597633896549266620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,12824070164834032446,6597633896549266620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1956,12824070164834032446,6597633896549266620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1956,12824070164834032446,6597633896549266620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,12824070164834032446,6597633896549266620,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,12824070164834032446,6597633896549266620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,12824070164834032446,6597633896549266620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,12824070164834032446,6597633896549266620,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,12824070164834032446,6597633896549266620,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
47b2c6613360b818825d076d14c051f7

SHA1
7df7304568313a06540f490bf3305cb89bc03e5c

SHA256
47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac

SHA512
08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e0811105475d528ab174dfdb69f935f3

SHA1
dd9689f0f70a07b4e6fb29607e42d2d5faf1f516

SHA256
c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c

SHA512
8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
475cf2391380095c94f994e4201ffb16

SHA1
2ddf7c61c01c686430fea4e325574f7c4b224afd

SHA256
b60869245fcee6fb730e2a8493b7f7e94a08806ef3a6d4640b94d6139049fa2d

SHA512
0bc4e451e8f0c823d2978abf262d31ff8aa0d1fe8b61325c9541e39307891ad9ea242b1b372e84d46effa5e8c16bcf8d36f2818806f38066dcbd5347d59263e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
851B

MD5
1a8dad240aa9b477a2bdeab99f345a6f

SHA1
bc21ef1d9139041daa5a732875ddffb3dff157fb

SHA256
9ab0f6a7951efb2d2deadfdb4bf7475e4ca7981543d248f8c7512938453e8e71

SHA512
44016ba795b2267016de828bebdd4104b4f0f3a43c6f766a511810d4b871578aebdfb1c9abab542d87d7c1e560a8604a38b489080b1c3eafacc6bca331273ccf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
caa6fee1e5a8fc9ce380ffe3685c1bed

SHA1
f99e93034d91b296fd7645b66cf89831deb98712

SHA256
2f8080a7bb5ae2b92ac2e187eb9ffd40a099492b9cd4013ba470829ac4b52b59

SHA512
f019b07c6d7e185ce1abb55ac11610022d1e64aa6d3627e88f29def07de27ce8495f7e1d7f1193290f66d2ae12143627d59b50b8bed8fee149851fcf17b3c8ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c57af29386529f15d51f15cffea5d7d4

SHA1
5f45b4b48e0430c4f01c32a1363cba5650b3cb84

SHA256
8bd5d52312052238b1a0048a98e300b90e92eb73a72389afccba6a6164d916b0

SHA512
b241ae779c11544c3d1429aeabffe0e21e992128a1f067f4f5fc41620f923ca6bad45a9b171a498ffac6d5258076c427a48a756aa9a479c27d22e646f711f80a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c5df6e95b2068ed74a8bc65d04a41ebe

SHA1
3d1e61893fd58e8c3c8ccdd61a34fb322199e971

SHA256
c0060e904fe14d3866793e477edc07e07874f1cd89d0eb21ac8e0ada61530e79

SHA512
9a1913894e581924a32b91db2b47c4ee14723c77de142c20de860cce757889011bade66ba987c1e3010be6e625ab901ae80c061d117b01a7296535863dd4da43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b23bd2ec9591e74c80757e5f6f28d919

SHA1
7442ca7fe3da8907514f615ba374c20052f9d83c

SHA256
be0551e36556ea18624b28ebf5b3380db7c85d02db76b1f155b55263cdf859f7

SHA512
b423cfd593774e912e3db2e25ecfb15c1e826e7e5661259e690e51e537dcf4f526a2ad54a58afec4755c6d5b68c2cf54da8df74118ad3f9694086bd722962f34

Download Submit