6af72a9c2f60b5747d03406e1ff7ba3d7b068d00dd0c4391d56e8039c1ed9429

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 04:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba90450ebc35ae4510139b04b6f92a45.html
Size

41KB
MD5

ba90450ebc35ae4510139b04b6f92a45
SHA1

ec5bdf000a3ead717b36c104209d1705be0d3c9b
SHA256

6af72a9c2f60b5747d03406e1ff7ba3d7b068d00dd0c4391d56e8039c1ed9429
SHA512

17111b86cbeb770f11d47f6e006ac8a85441f8a73c5fd606978bcd0ef91e7fe704f0d10847a36ab1e103bbfd2374dfe1d4efe33197a9ed80918f5683d7e755f9
SSDEEP

768:/beBNzeGNJx5ofH8DaLNp0twcUwZjl4yaqall2nGpyiQlvpFU2pKj:/SDexp0twRjg0yiQlvpFkj

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe
368	msedge.exe
368	msedge.exe
3052	identity_helper.exe
3052	identity_helper.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe
368	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 368 wrote to memory of 1208	368	msedge.exe	88
PID 368 wrote to memory of 1208	368	msedge.exe	88
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 3412	368	msedge.exe	89
PID 368 wrote to memory of 4304	368	msedge.exe	90
PID 368 wrote to memory of 4304	368	msedge.exe	90
PID 368 wrote to memory of 836	368	msedge.exe	91
PID 368 wrote to memory of 836	368	msedge.exe	91
PID 368 wrote to memory of 836	368	msedge.exe	91
PID 368 wrote to memory of 836	368	msedge.exe	91
PID 368 wrote to memory of 836	368	msedge.exe	91
PID 368 wrote to memory of 836	368	msedge.exe	91
PID 368 wrote to memory of 836	368	msedge.exe	91
PID 368 wrote to memory of 836	368	msedge.exe	91
PID 368 wrote to memory of 836	368	msedge.exe	91
PID 368 wrote to memory of 836	368	msedge.exe	91
PID 368 wrote to memory of 836	368	msedge.exe	91
PID 368 wrote to memory of 836	368	msedge.exe	91
PID 368 wrote to memory of 836	368	msedge.exe	91
PID 368 wrote to memory of 836	368	msedge.exe	91
PID 368 wrote to memory of 836	368	msedge.exe	91
PID 368 wrote to memory of 836	368	msedge.exe	91
PID 368 wrote to memory of 836	368	msedge.exe	91
PID 368 wrote to memory of 836	368	msedge.exe	91
PID 368 wrote to memory of 836	368	msedge.exe	91
PID 368 wrote to memory of 836	368	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ba90450ebc35ae4510139b04b6f92a45.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd396646f8,0x7ffd39664708,0x7ffd39664718
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,2873502342946965606,4917165202094240842,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,2873502342946965606,4917165202094240842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,2873502342946965606,4917165202094240842,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2873502342946965606,4917165202094240842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2873502342946965606,4917165202094240842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2873502342946965606,4917165202094240842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2873502342946965606,4917165202094240842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,2873502342946965606,4917165202094240842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,2873502342946965606,4917165202094240842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2873502342946965606,4917165202094240842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2873502342946965606,4917165202094240842,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2873502342946965606,4917165202094240842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2873502342946965606,4917165202094240842,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,2873502342946965606,4917165202094240842,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2936 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fd7944a4ff1be37517983ffaf5700b11

SHA1
c4287796d78e00969af85b7e16a2d04230961240

SHA256
b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

SHA512
28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
7640732163b2dfdf5f39e6b0f82c2c66

SHA1
0efff7bd18ec23cd5e25d419cb61a3f5a8396a2d

SHA256
2d9365c23ae336ea17fdbde14171897cb7e73fdb8416b1e1b1c5eb6266830f02

SHA512
425b9a831efe2dda4369ab1a781508fe7a71660f2e2b4c4a381032614f491a361d772090f4be0b31dff642682120098f8d4dbe05dccb5c4eb81b8a985c088881

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a1bb2087444cd209615bf686b2979eda

SHA1
353d33f1d38256ba045c0fa7911b5fbed2be2c8a

SHA256
98941a627ede9b2d2d7438284743c104dbd909f7d70f6887a7f2686f56a82940

SHA512
6700fa5f5776411ea5ab4be9b00b811d52af69a94babce21710b46b17e440445bed11df1f1b776633319ed658b60dcaae9150a0cc7881bc17363442e15efdda9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a7946d535517d4c997c5a0afba5ee4da

SHA1
b1e04a306c557fe0bfc1bc5c50f02970e4fa92d7

SHA256
4371c46510f8e59e0c5917ee16676b0b36401e302263ba3402b96b1bf801e6f2

SHA512
721ac4e0c4606fc32d489a871b7a7796a56d6a688862cedf8672a8b74d9fd1b85a055d1228eefc70c5c03d0f55cb0f8e96bd058b56bc71932de9fc61289be312

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1c6ee0789ccea5cff8ad56c7b66eac70

SHA1
9e734882e23d50278e4633ba187b552903ce514e

SHA256
7b21d0f167921e3cd6599d92fa1658ec14cab721c7099a6bd60d6a5fa537937b

SHA512
a970908d231f85e7c0207c65c393c07d430aecb21e2ed473e15ae03d9b7deb718299c1020f2f079f4d41c8a9daf2fb3e595ec5e137852f7a36cff4fec6b344ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d72a177e-e5af-4009-8ab4-3ee9f7f4ac44.tmp

Filesize
11KB

MD5
1b0bc8dadf29398b63a886de93a6d271

SHA1
953e91c74588fcb9d2edf1beb5043905c396604f

SHA256
86b057ff5b3c0d880e3874c4790d617c0ac818c3072b3a8d140ca888080776bb

SHA512
171926fdb7f4447594b7157ee8560cf6ff06acb5824206b87e5ebef0516644af03bcfb58338297edb846ff3d3077499194d07384c4e32eb547f382e6cd0595a7

Download Submit