eee424baa5997ca150a1b08dad1cba56ca59c84e6a85f4bb73fafca4eeb6d650

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 12:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b75a087dde69534f6661e4b176e6a1d2.html
Size

35KB
MD5

b75a087dde69534f6661e4b176e6a1d2
SHA1

a524efa4ebe0cc67a39ad22ad6162fd7e02aeb1d
SHA256

eee424baa5997ca150a1b08dad1cba56ca59c84e6a85f4bb73fafca4eeb6d650
SHA512

4dd809df20d18076d4b8521e277f3a9be092429ee9365c3b98ad30939c8a63f2123f4c541a42cab01edd152a3560dda7dcb8372d29113fbbb45f987cf2e175d9
SSDEEP

384:ppUGiDnhPoTXzkKJi3GJnNYYzr/O4pm8J4Z7bMNHgdivw6wAyu:ppUjlgTLJi3GdWYzrO4piZ7QWdivw6wu

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2388	msedge.exe
2388	msedge.exe
1940	msedge.exe
1940	msedge.exe
3032	identity_helper.exe
3032	identity_helper.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 4608	1940	msedge.exe	87
PID 1940 wrote to memory of 4608	1940	msedge.exe	87
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 3388	1940	msedge.exe	88
PID 1940 wrote to memory of 2388	1940	msedge.exe	89
PID 1940 wrote to memory of 2388	1940	msedge.exe	89
PID 1940 wrote to memory of 556	1940	msedge.exe	90
PID 1940 wrote to memory of 556	1940	msedge.exe	90
PID 1940 wrote to memory of 556	1940	msedge.exe	90
PID 1940 wrote to memory of 556	1940	msedge.exe	90
PID 1940 wrote to memory of 556	1940	msedge.exe	90
PID 1940 wrote to memory of 556	1940	msedge.exe	90
PID 1940 wrote to memory of 556	1940	msedge.exe	90
PID 1940 wrote to memory of 556	1940	msedge.exe	90
PID 1940 wrote to memory of 556	1940	msedge.exe	90
PID 1940 wrote to memory of 556	1940	msedge.exe	90
PID 1940 wrote to memory of 556	1940	msedge.exe	90
PID 1940 wrote to memory of 556	1940	msedge.exe	90
PID 1940 wrote to memory of 556	1940	msedge.exe	90
PID 1940 wrote to memory of 556	1940	msedge.exe	90
PID 1940 wrote to memory of 556	1940	msedge.exe	90
PID 1940 wrote to memory of 556	1940	msedge.exe	90
PID 1940 wrote to memory of 556	1940	msedge.exe	90
PID 1940 wrote to memory of 556	1940	msedge.exe	90
PID 1940 wrote to memory of 556	1940	msedge.exe	90
PID 1940 wrote to memory of 556	1940	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b75a087dde69534f6661e4b176e6a1d2.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff967fa46f8,0x7ff967fa4708,0x7ff967fa4718
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,11724002914091874534,8727743066329491292,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,11724002914091874534,8727743066329491292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,11724002914091874534,8727743066329491292,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11724002914091874534,8727743066329491292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11724002914091874534,8727743066329491292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11724002914091874534,8727743066329491292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11724002914091874534,8727743066329491292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11724002914091874534,8727743066329491292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,11724002914091874534,8727743066329491292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4188 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,11724002914091874534,8727743066329491292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11724002914091874534,8727743066329491292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11724002914091874534,8727743066329491292,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11724002914091874534,8727743066329491292,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11724002914091874534,8727743066329491292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11724002914091874534,8727743066329491292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1824 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11724002914091874534,8727743066329491292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2136 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,11724002914091874534,8727743066329491292,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2592 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fd7944a4ff1be37517983ffaf5700b11

SHA1
c4287796d78e00969af85b7e16a2d04230961240

SHA256
b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

SHA512
28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b1065472aeb2957489a6924cd00da1f8

SHA1
d787cfe63e7c0e95498007d9a04077c96ede5b99

SHA256
7c7ac3b8430343101b9e2ca76ec1c6a28258e0b762f469e5f8ccca12685c9bd0

SHA512
25bb2cbb800eeefa248a476767b5edfc37a0040e8f0af74c58e20b75d26b837d16c523a994427780a612756a61ea8a33c1e3e102d0b9ae5b247f3b31f503a90c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
92269751352fa4ff4e5ef2c02e138f14

SHA1
667d9a49cda13260460b90680cccfc4cba200481

SHA256
5ea49953241e94aef23e7495af44570cdb707206b68ea21f17d145c24d1b04dd

SHA512
1dc2e864e0a04c818a54ec9bf1d47532064abd5613fd7bb795b15a252244355075ffb5975dc90d54158ab9042a5c1c23073d7c86c05c5a18cfa0e1850217f1f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a1e53064dea46f6617fb6d82a69ab5f0

SHA1
40bf786f2aad51dcd4cd82fe2cc6669d7442da80

SHA256
aac134f8c697c2ad2b7f8448851d9ae74cadc874f6b78a3c83dafac598347d1d

SHA512
5f5a86706ef02c7bc466b98b6da01a34cf4521ae2141d253a0cb536f3d9cecad2a1716532cb06136ed19ea3326bef655ecf0899c7d7d9bc5b89770f4cd1d592a

Download Submit