a022c218eb70583167dafac7f863bdc74a9c7cd4230b6666178cd908f4ff16ed

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 10:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7368214e21c53b5c23055416057df52.html
Size

13KB
MD5

b7368214e21c53b5c23055416057df52
SHA1

44ed51bbb1e95bf08b9757772e0e337d17ed160b
SHA256

a022c218eb70583167dafac7f863bdc74a9c7cd4230b6666178cd908f4ff16ed
SHA512

cd37e159f72244b9aa5d8ffac4cc265ec84a7ede25d5f9c5317921195a431ef2e813830b5b98b6c63df7868e5cfd69ce103c7d0dccf30a399b47acc4f246b5b7
SSDEEP

192:H9KbqTcUkARSh0/foqzCY1zRHciXxgrguERUGOCaNOjHhO9Y+wLl0bcLpaqECId:HQbqTcUpvBwU8t2HE9Y+wLntM

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
3144	msedge.exe
3144	msedge.exe
916	identity_helper.exe
916	identity_helper.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 3100	3144	msedge.exe	89
PID 3144 wrote to memory of 3100	3144	msedge.exe	89
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 2596	3144	msedge.exe	90
PID 3144 wrote to memory of 4436	3144	msedge.exe	91
PID 3144 wrote to memory of 4436	3144	msedge.exe	91
PID 3144 wrote to memory of 732	3144	msedge.exe	92
PID 3144 wrote to memory of 732	3144	msedge.exe	92
PID 3144 wrote to memory of 732	3144	msedge.exe	92
PID 3144 wrote to memory of 732	3144	msedge.exe	92
PID 3144 wrote to memory of 732	3144	msedge.exe	92
PID 3144 wrote to memory of 732	3144	msedge.exe	92
PID 3144 wrote to memory of 732	3144	msedge.exe	92
PID 3144 wrote to memory of 732	3144	msedge.exe	92
PID 3144 wrote to memory of 732	3144	msedge.exe	92
PID 3144 wrote to memory of 732	3144	msedge.exe	92
PID 3144 wrote to memory of 732	3144	msedge.exe	92
PID 3144 wrote to memory of 732	3144	msedge.exe	92
PID 3144 wrote to memory of 732	3144	msedge.exe	92
PID 3144 wrote to memory of 732	3144	msedge.exe	92
PID 3144 wrote to memory of 732	3144	msedge.exe	92
PID 3144 wrote to memory of 732	3144	msedge.exe	92
PID 3144 wrote to memory of 732	3144	msedge.exe	92
PID 3144 wrote to memory of 732	3144	msedge.exe	92
PID 3144 wrote to memory of 732	3144	msedge.exe	92
PID 3144 wrote to memory of 732	3144	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b7368214e21c53b5c23055416057df52.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe849146f8,0x7ffe84914708,0x7ffe84914718
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,12354977949033561065,5159344329732261175,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,12354977949033561065,5159344329732261175,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,12354977949033561065,5159344329732261175,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12354977949033561065,5159344329732261175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12354977949033561065,5159344329732261175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,12354977949033561065,5159344329732261175,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,12354977949033561065,5159344329732261175,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12354977949033561065,5159344329732261175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12354977949033561065,5159344329732261175,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12354977949033561065,5159344329732261175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12354977949033561065,5159344329732261175,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2812 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,12354977949033561065,5159344329732261175,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4852 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cbec32729772aa6c576e97df4fef48f5

SHA1
6ec173d5313f27ba1e46ad66c7bbe7c0a9767dba

SHA256
d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e

SHA512
425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
279e783b0129b64a8529800a88fbf1ee

SHA1
204c62ec8cef8467e5729cad52adae293178744f

SHA256
3619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932

SHA512
32730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
467B

MD5
1cd1065ec0e8f63c7e619abb407d4545

SHA1
e5dfcb0a5f529687fe386cc209b3f2f2dabe274f

SHA256
36fe71172b101a345ab92620a5af0d54cda4feaf436f8f257a7d401feaa02029

SHA512
583cafaad5e7cf2d2919fcb69818dc755e1f06c080a041636a5b18f04e1db2da59310e94ab8d83dc1fcc7fd309b1d23b01cca34163fea9883378a5cb07f918c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
72e33af335132eaf23a71bd227f483e5

SHA1
becf65b9da892a0e5f43790db3bc48c53654cf39

SHA256
969fdeacbca36994bafe744346ada9299a87be145247e4957e5ef2a7d44b47bc

SHA512
e0089a8edd56be6984224bb57ecd5912ec4f0e0fc432b396bc2704f919b4db2f4beae0d1b83c7775469067c1896ad8f72e20f1669eb35b29f5437ec84ca81511

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d758ed12667783db2778b48b366247f7

SHA1
6a089e90a8b45cd7bf63b32d9ab1bfe51b161492

SHA256
ad3e36c3afa0fb91a6759df71d6b4c0da4649f0025c4dff3bea0fdebf9739bcd

SHA512
e849512039f7b2c28058b68128d45e71c06e783e71a2f42e5380fc0e3ba713b5d40bc1687004efda8c9700e930e41e8453dda800b7b448206dc59b655dcfd029

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5175c5295c72896e04d165782fb34166

SHA1
f5d24f9eaa4463085a02bc59d3f2a9a64c85c033

SHA256
f3a680352b32bf3223d32cc01f3fcc07c437c98d3dc9827072992b1ab6fac562

SHA512
9b9583baa139a39b2f2f81539c05253a637aed7d6a98e10af579e88a053d992c5d1f82691024123484cbb5ae2fff30844bed81a1129ba6279ee60b98953d742a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
7e666aad1a3bf4865c680bf8cfef3287

SHA1
70bae8a022ecff372f27dd38c4dc1bff5c15e87a

SHA256
14c23e92ae9fefb0a5d8c2e146b84cd65b9164f52e67a0978f1bc1ba2ab90d4b

SHA512
ee6036377878284c387d3400f7299f26c74ffe833153b65cfd1372fd69637e62fd9c9a5418883458041663833c220f4c9e7f46b8d0598e21af339cc26877745b

Download Submit