bd7f957cf5d9d7bfa5dc269ee77b3d01e24e279203f4cd02fcacd1126660301b

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 17:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b54bb9a8d8739f22ca55469200361384.html
Size

17KB
MD5

b54bb9a8d8739f22ca55469200361384
SHA1

88004636ae748addeaa8e0497b7c28dde3efeaa9
SHA256

bd7f957cf5d9d7bfa5dc269ee77b3d01e24e279203f4cd02fcacd1126660301b
SHA512

c804b35dad4f280d7c3d8f013ea4dab308795d9fe6f5ed92a015f25bfcfd3d9a24677fafff2f8af5b2905206aeeabcfd28446d18f394d926f690146cb9e4a790
SSDEEP

192:3FOq0CV0aRYo9Q9T4F3vBY6ax7TR+Z2HQ7W6i2BhXeyngsRKYx9Y7JxFJC:3MiV3R/eTg3ZwhHuXevsN8c

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
4056	msedge.exe
4056	msedge.exe
1784	identity_helper.exe
1784	identity_helper.exe
5628	msedge.exe
5628	msedge.exe
5628	msedge.exe
5628	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 1888	4056	msedge.exe	88
PID 4056 wrote to memory of 1888	4056	msedge.exe	88
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 1316	4056	msedge.exe	89
PID 4056 wrote to memory of 2880	4056	msedge.exe	90
PID 4056 wrote to memory of 2880	4056	msedge.exe	90
PID 4056 wrote to memory of 4180	4056	msedge.exe	91
PID 4056 wrote to memory of 4180	4056	msedge.exe	91
PID 4056 wrote to memory of 4180	4056	msedge.exe	91
PID 4056 wrote to memory of 4180	4056	msedge.exe	91
PID 4056 wrote to memory of 4180	4056	msedge.exe	91
PID 4056 wrote to memory of 4180	4056	msedge.exe	91
PID 4056 wrote to memory of 4180	4056	msedge.exe	91
PID 4056 wrote to memory of 4180	4056	msedge.exe	91
PID 4056 wrote to memory of 4180	4056	msedge.exe	91
PID 4056 wrote to memory of 4180	4056	msedge.exe	91
PID 4056 wrote to memory of 4180	4056	msedge.exe	91
PID 4056 wrote to memory of 4180	4056	msedge.exe	91
PID 4056 wrote to memory of 4180	4056	msedge.exe	91
PID 4056 wrote to memory of 4180	4056	msedge.exe	91
PID 4056 wrote to memory of 4180	4056	msedge.exe	91
PID 4056 wrote to memory of 4180	4056	msedge.exe	91
PID 4056 wrote to memory of 4180	4056	msedge.exe	91
PID 4056 wrote to memory of 4180	4056	msedge.exe	91
PID 4056 wrote to memory of 4180	4056	msedge.exe	91
PID 4056 wrote to memory of 4180	4056	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b54bb9a8d8739f22ca55469200361384.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3c2d46f8,0x7ffe3c2d4708,0x7ffe3c2d4718
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,7386809693874644635,2350729277800631824,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,7386809693874644635,2350729277800631824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,7386809693874644635,2350729277800631824,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1484 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7386809693874644635,2350729277800631824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7386809693874644635,2350729277800631824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7386809693874644635,2350729277800631824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1336 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7386809693874644635,2350729277800631824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1692 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,7386809693874644635,2350729277800631824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,7386809693874644635,2350729277800631824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7386809693874644635,2350729277800631824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7386809693874644635,2350729277800631824,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7386809693874644635,2350729277800631824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7386809693874644635,2350729277800631824,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,7386809693874644635,2350729277800631824,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5516 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f35bb0615bb9816f562b83304e456294

SHA1
1049e2bd3e1bbb4cea572467d7c4a96648659cb4

SHA256
05e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71

SHA512
db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1eb86108cb8f5a956fdf48efbd5d06fe

SHA1
7b2b299f753798e4891df2d9cbf30f94b39ef924

SHA256
1b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40

SHA512
e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c8db1472bf76c768862a1aa99d62a062

SHA1
a40fc7820f176ec945483563f964d1a4639e85ad

SHA256
44593540f007a8f73a046dd86c59c082fd9c787602df9c2ea70816808b78f0b5

SHA512
42abff064e214d74768305d6b5cf07928f9fcef33feb55138f5e147b05d82269dc1d109e50d14eb0940c57783d5ce4a85c174b087a056750c5b0122ad36fe5b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
111a1a48b7e90b4ea48cf6e570cf3d66

SHA1
454358ddaa65b16d84164a1d2ef8050cf3887d8f

SHA256
e46b317cb54d71cb675dfa63292a49174a75afcac4338ed1f1e4768f91fb1408

SHA512
f0a63f62f1cc79f178b01a476865871fa091874902a9c85eab36e05e3d70afcf816b674b116237876e738998e459cb94453b92aabe8eceb8ee76707fc04cd25b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6195adaff1b2b4a760f590b1520ec218

SHA1
60fa339aab5d46091f3b83ce11083899663fe849

SHA256
430539fafc1860e6164a27f18c17d534bf25eb43865d529d7a9c60b56ce8b6dd

SHA512
0e1238d0c0f45812db3ac75d45be18b01bccdf94843456928bf8264ee89d50549fdd433df8dd11f2d70507ce060e950444eab1ca41a60f01a333c03b584cb653

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c09d2831b705b2fc97b8ca1bb275a040

SHA1
ea9fb3e9f0e578d16a6cfecd1fa7ef05f67842a3

SHA256
ef3c26bf450868862068c6396a0e2d6d0c4810bbbd817bfa65bb80ff3e6eeb8c

SHA512
55c1f9d902a1c69db036b29590f55590bb40278f4218874e1fef334daa548a99e72904069fb5c344851d444badae5a597e145098eb0aebe3664b4632ef2f1dc3

Download Submit