1566624d3f8601e1a0340ac43c638ed06cdd7278ed722aedccd3803791e3d2e5

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b7622ed3fa0403d1a23d2f099b96857f.html
Size

219KB
MD5

b7622ed3fa0403d1a23d2f099b96857f
SHA1

dbf0d62b6f48f7c6327baa716d85f69133c67472
SHA256

1566624d3f8601e1a0340ac43c638ed06cdd7278ed722aedccd3803791e3d2e5
SHA512

b42afaa0a34cd3921ad3fc6b130cb83d1160533317a7d79cef9f461bbe90117221bb64824ee1a8b2c553315d5297a6f2f49b12a3b14ca5b280af8f6a3addc54c
SSDEEP

1536:ZAsI9BPTz81APsqFkgsFkgrxjQ720QUSqga4iS0CES4yEEOK8OUZkB4dqqYl+70h:AzGWFkgsFkgg+GQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1608	msedge.exe
1608	msedge.exe
3388	msedge.exe
3388	msedge.exe
920	identity_helper.exe
920	identity_helper.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe
4164	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 1964	3388	msedge.exe	89
PID 3388 wrote to memory of 1964	3388	msedge.exe	89
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1988	3388	msedge.exe	90
PID 3388 wrote to memory of 1608	3388	msedge.exe	91
PID 3388 wrote to memory of 1608	3388	msedge.exe	91
PID 3388 wrote to memory of 2076	3388	msedge.exe	92
PID 3388 wrote to memory of 2076	3388	msedge.exe	92
PID 3388 wrote to memory of 2076	3388	msedge.exe	92
PID 3388 wrote to memory of 2076	3388	msedge.exe	92
PID 3388 wrote to memory of 2076	3388	msedge.exe	92
PID 3388 wrote to memory of 2076	3388	msedge.exe	92
PID 3388 wrote to memory of 2076	3388	msedge.exe	92
PID 3388 wrote to memory of 2076	3388	msedge.exe	92
PID 3388 wrote to memory of 2076	3388	msedge.exe	92
PID 3388 wrote to memory of 2076	3388	msedge.exe	92
PID 3388 wrote to memory of 2076	3388	msedge.exe	92
PID 3388 wrote to memory of 2076	3388	msedge.exe	92
PID 3388 wrote to memory of 2076	3388	msedge.exe	92
PID 3388 wrote to memory of 2076	3388	msedge.exe	92
PID 3388 wrote to memory of 2076	3388	msedge.exe	92
PID 3388 wrote to memory of 2076	3388	msedge.exe	92
PID 3388 wrote to memory of 2076	3388	msedge.exe	92
PID 3388 wrote to memory of 2076	3388	msedge.exe	92
PID 3388 wrote to memory of 2076	3388	msedge.exe	92
PID 3388 wrote to memory of 2076	3388	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b7622ed3fa0403d1a23d2f099b96857f.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb588046f8,0x7ffb58804708,0x7ffb58804718
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,17936421496564582202,535149222959598860,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,17936421496564582202,535149222959598860,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,17936421496564582202,535149222959598860,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3028 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17936421496564582202,535149222959598860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3064 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17936421496564582202,535149222959598860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3084 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,17936421496564582202,535149222959598860,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,17936421496564582202,535149222959598860,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17936421496564582202,535149222959598860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17936421496564582202,535149222959598860,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17936421496564582202,535149222959598860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17936421496564582202,535149222959598860,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,17936421496564582202,535149222959598860,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
47b2c6613360b818825d076d14c051f7

SHA1
7df7304568313a06540f490bf3305cb89bc03e5c

SHA256
47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac

SHA512
08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e0811105475d528ab174dfdb69f935f3

SHA1
dd9689f0f70a07b4e6fb29607e42d2d5faf1f516

SHA256
c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c

SHA512
8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
04da0d3d7aaec9e152242bd28f740a30

SHA1
087265422a16cacf99944b16b92ce8a75d67eb1b

SHA256
3e7b1184d1d4373fd2b2d2b1a0873e8dc52a4d8dfb530bbedb71e3bbff9196c0

SHA512
53143e6411d5662bfebc20930dcd2eeafb3568a845f2e958104880ae12dbcd3ea34838bc705c092caa6d0e6de9708f534fa126601182fe4a745f11f0b7416197

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
83cdd4d05652d60eca9ad9a207e13f55

SHA1
ae7cd6525c1673cab885fb53f8f4b9a7d3d10cab

SHA256
1bd43d437c9a5b1f1ab2c915e7ca4052a1f0caee24d615a33e20c02903d74dd6

SHA512
c58b8c0212e45fd094d706ece6e0ec25e0c4eea715f5fc0c493558a8a6f34652d6ffcbd0bbb6320d366ff145be79b19151b8db2a1f22e2a2cb9d42c4af9b70af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
13048aabf321b4741355a80b663b3f8e

SHA1
d4cccddd496ad12f13aaadf7ffa547800bffe1f3

SHA256
6bc4ec76da3f66f23ac5c86b0ed5c80cde749a70966393b7842c87e6455ff02f

SHA512
0396ce10f06db397961cb885292fe657722144040647289ceaff38852260549e79ea7527e968e4d3993d695525935204804ca0087f3af70a274ca8ecc2c3256f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d383b613d164b1e6f6b4049047117492

SHA1
d05617f6036605b57d79b711b7006512e0f406e7

SHA256
57d536495a660ac0cf3c4e38e6bce1c7339dddb7ce6598d4f2d80dea54ea6f40

SHA512
0a207aeaeb87daeacb289e422d2301cc273aa8a4f45e487ca6e856857a1ca1e82eb2bd39562e015ab9ffc20167755d79fff2f8748d3a78a1a87fa53a2698d9eb

Download Submit