dba22c6f3f11d46b9b8884043be6907e5b428d5595baad0a50d75789e5f4f0cb

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-03-2024 01:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

background.html
Size

1KB
MD5

b283e8f75dcc4349e1d88e72358ea3b8
SHA1

b017c920e90daeae106ad152ecfb42a1d8d203a7
SHA256

67cb79577f26d6632168145a2b7b4d3ad6b46247f0244a9f6f25b45fceaeddc3
SHA512

c714233bc1d7ae252695d7b56213523525beb4b8e198b11377213647418a76824e89c49dd75b82beb0fa205646ca458ba7f14d42fc350d6836a6921aa9524402

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5008	msedge.exe
5008	msedge.exe
5088	msedge.exe
5088	msedge.exe
3092	identity_helper.exe
3092	identity_helper.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe
5088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 1688	5088	msedge.exe	88
PID 5088 wrote to memory of 1688	5088	msedge.exe	88
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 3948	5088	msedge.exe	89
PID 5088 wrote to memory of 5008	5088	msedge.exe	90
PID 5088 wrote to memory of 5008	5088	msedge.exe	90
PID 5088 wrote to memory of 3360	5088	msedge.exe	91
PID 5088 wrote to memory of 3360	5088	msedge.exe	91
PID 5088 wrote to memory of 3360	5088	msedge.exe	91
PID 5088 wrote to memory of 3360	5088	msedge.exe	91
PID 5088 wrote to memory of 3360	5088	msedge.exe	91
PID 5088 wrote to memory of 3360	5088	msedge.exe	91
PID 5088 wrote to memory of 3360	5088	msedge.exe	91
PID 5088 wrote to memory of 3360	5088	msedge.exe	91
PID 5088 wrote to memory of 3360	5088	msedge.exe	91
PID 5088 wrote to memory of 3360	5088	msedge.exe	91
PID 5088 wrote to memory of 3360	5088	msedge.exe	91
PID 5088 wrote to memory of 3360	5088	msedge.exe	91
PID 5088 wrote to memory of 3360	5088	msedge.exe	91
PID 5088 wrote to memory of 3360	5088	msedge.exe	91
PID 5088 wrote to memory of 3360	5088	msedge.exe	91
PID 5088 wrote to memory of 3360	5088	msedge.exe	91
PID 5088 wrote to memory of 3360	5088	msedge.exe	91
PID 5088 wrote to memory of 3360	5088	msedge.exe	91
PID 5088 wrote to memory of 3360	5088	msedge.exe	91
PID 5088 wrote to memory of 3360	5088	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\background.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff86b846f8,0x7fff86b84708,0x7fff86b84718
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,16918983736437761631,13947589486511072576,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,16918983736437761631,13947589486511072576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,16918983736437761631,13947589486511072576,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,16918983736437761631,13947589486511072576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,16918983736437761631,13947589486511072576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,16918983736437761631,13947589486511072576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,16918983736437761631,13947589486511072576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,16918983736437761631,13947589486511072576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,16918983736437761631,13947589486511072576,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,16918983736437761631,13947589486511072576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,16918983736437761631,13947589486511072576,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,16918983736437761631,13947589486511072576,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4916 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7e0958e08e1f32a939698760b485b699

SHA1
a78178860ec2648c914702552867b9db2bc77935

SHA256
0a3bb94f5e8295aae5a5f5e36f9058484c6e726a2a8cb37fbedf7d2186e44eaf

SHA512
27f74f2cc2f9cddcb3a5ebbcb6eb716fe2f6d2ae76a198c5488f37f5079d2ccd4ad4ddbe5c380557c305e27bb6f15cfc83c8ed508d70a0ad8b4d5acd231ade0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
15bcbf96e8b211c7d3abdb43116522ae

SHA1
58b569d63633b750bea74b769adb2cf18f384f13

SHA256
9ce161677834484e47e8b38e4728adcfdb703ae1162085a75b71aa2d3a86bf85

SHA512
ace29a533080f174826ec5dd85436fe7d6a51c7d0352ded6ae1e404dc62f77d833555812d7cb0ebf9d2564fecf279b06e0e6e6a2e0f0a26f42ef5b28a4bb5d31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f3163fc560f1a93dc4f7563183dd6ced

SHA1
2812365608abccef8d4d7b7033f959893ff32bfb

SHA256
7d9452d2979a778bcc3cf1581ae236f9e9ccad0899876b946dbe485294d24b06

SHA512
840ffe9d4ceed9d795d951614819c031f51f3ed1c9ac2637e9fe694fbd603613077c848fedd531b3fbfd01f3d1df826a4db6d5e16e733dedc9c00bfd42991f5f

Download Submit