00c49c9cf9ad57d8a75c230f956d31ded540c480f549100426afbf8dff47efbb

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 13:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8da6afcb45f23461c33b01c5f1a8170.html
Size

984B
MD5

b8da6afcb45f23461c33b01c5f1a8170
SHA1

417c79f875a4f4ef0cdb9b0d99732d822bbc631f
SHA256

00c49c9cf9ad57d8a75c230f956d31ded540c480f549100426afbf8dff47efbb
SHA512

e5f1e8e6a4fc052ddedf42bf801ce4846e3b575d5aa202f916ba9b46e927e9b7bc10cd11765afd4306c69daa2787b090d2ae1ae04716c8342f753f7a7ec5995f

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe
1612	msedge.exe
1612	msedge.exe
2824	identity_helper.exe
2824	identity_helper.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2568	1612	msedge.exe	89
PID 1612 wrote to memory of 2568	1612	msedge.exe	89
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 4428	1612	msedge.exe	90
PID 1612 wrote to memory of 2352	1612	msedge.exe	91
PID 1612 wrote to memory of 2352	1612	msedge.exe	91
PID 1612 wrote to memory of 456	1612	msedge.exe	92
PID 1612 wrote to memory of 456	1612	msedge.exe	92
PID 1612 wrote to memory of 456	1612	msedge.exe	92
PID 1612 wrote to memory of 456	1612	msedge.exe	92
PID 1612 wrote to memory of 456	1612	msedge.exe	92
PID 1612 wrote to memory of 456	1612	msedge.exe	92
PID 1612 wrote to memory of 456	1612	msedge.exe	92
PID 1612 wrote to memory of 456	1612	msedge.exe	92
PID 1612 wrote to memory of 456	1612	msedge.exe	92
PID 1612 wrote to memory of 456	1612	msedge.exe	92
PID 1612 wrote to memory of 456	1612	msedge.exe	92
PID 1612 wrote to memory of 456	1612	msedge.exe	92
PID 1612 wrote to memory of 456	1612	msedge.exe	92
PID 1612 wrote to memory of 456	1612	msedge.exe	92
PID 1612 wrote to memory of 456	1612	msedge.exe	92
PID 1612 wrote to memory of 456	1612	msedge.exe	92
PID 1612 wrote to memory of 456	1612	msedge.exe	92
PID 1612 wrote to memory of 456	1612	msedge.exe	92
PID 1612 wrote to memory of 456	1612	msedge.exe	92
PID 1612 wrote to memory of 456	1612	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b8da6afcb45f23461c33b01c5f1a8170.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb5eeb46f8,0x7ffb5eeb4708,0x7ffb5eeb4718
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,13990653767254178114,7626353211698016645,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,13990653767254178114,7626353211698016645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,13990653767254178114,7626353211698016645,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13990653767254178114,7626353211698016645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3104 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13990653767254178114,7626353211698016645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13990653767254178114,7626353211698016645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,13990653767254178114,7626353211698016645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,13990653767254178114,7626353211698016645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13990653767254178114,7626353211698016645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13990653767254178114,7626353211698016645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,13990653767254178114,7626353211698016645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,13990653767254178114,7626353211698016645,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5544 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c6136bc98a5aedca2ea3004e9fbe67d

SHA1
74318d997f4c9c351eef86d040bc9b085ce1ad4f

SHA256
50c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2

SHA512
2d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c6aef82e50d05ffc0cf52a6c6d69c91

SHA1
c203efe5b45b0630fee7bd364fe7d63b769e2351

SHA256
d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32

SHA512
77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
41c9c226d078628539dc527f0bbcba36

SHA1
43dd6ff576c48d88e7f0d3521d1239302cfb6cef

SHA256
d636e03fc4a3aaaa98160553cf3bd825842e23ffb9855caf1b2cc93120e8e516

SHA512
2fc6983372fe0287401a7cd989ff86026116a41644b60f20ecb1d6a07cd0f9791a2c28d89fa6d1e8dbbf8515d82778cda7ca98c3e8db0d83bff7398c49eab0ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ae16d6bda90150c636d2d95b0ed5e189

SHA1
6850bbc7673928ca0e857d09e93d48f6e9d6bb3f

SHA256
dc5f5323bf2f187def7c993f4fdf75a42d39f6750049adeddf9f84a0954e8dbc

SHA512
8eeaf5238a48f2fd5a870996a2441376b6c205512b4854a797dc2ac256a8ed64f8eb2fca49974fda0f323f86b22da9d7b987ab93dc8377d7340b224b945a1ea8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d0de52d3682907f3a94cb5069feb1182

SHA1
be07a32250f8240674a1c4995c000685c4547f8b

SHA256
26eac2c21f778d17503145edfe303378ac388d4f0d542c4543c3add55ee0256f

SHA512
c885b6083817b8f979c4d44e418dcc69e042338726043f81be24ea7378e423d67172d571efee413ae3e3191bd04773ab36c7c24176a012c54f51ec5553eda7e1

Download Submit