9b116b3ba15f0a45c6dd1fa7350df5b8d3ba58c49518b32216676be5debae8c3

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 13:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb655ca219c26b31ac108855e223c562.html
Size

72KB
MD5

bb655ca219c26b31ac108855e223c562
SHA1

09d30c90b5bd67872c287e5315e1d22bf7e3c53f
SHA256

9b116b3ba15f0a45c6dd1fa7350df5b8d3ba58c49518b32216676be5debae8c3
SHA512

4ad79d640591a6321410c2f7cb7e3e9b39f7e5ef93437b685a4970c630c14cd730b8c4dd494554bd8410918176e32a5c9208320d8c7c2d759919365a4e37f1a6
SSDEEP

1536:KYzabquklcMklc2klc7uG/bI+3zkcKklcPEijZeqhUEijZeqLyWf/hwAbivLIWm6:KYsklcMklc2klc7uG/bI+3zkcKklcPE6

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
3384	msedge.exe
3384	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe
3200	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3384	msedge.exe
3384	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 1688	3384	msedge.exe	89
PID 3384 wrote to memory of 1688	3384	msedge.exe	89
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4788	3384	msedge.exe	90
PID 3384 wrote to memory of 4848	3384	msedge.exe	91
PID 3384 wrote to memory of 4848	3384	msedge.exe	91
PID 3384 wrote to memory of 2032	3384	msedge.exe	92
PID 3384 wrote to memory of 2032	3384	msedge.exe	92
PID 3384 wrote to memory of 2032	3384	msedge.exe	92
PID 3384 wrote to memory of 2032	3384	msedge.exe	92
PID 3384 wrote to memory of 2032	3384	msedge.exe	92
PID 3384 wrote to memory of 2032	3384	msedge.exe	92
PID 3384 wrote to memory of 2032	3384	msedge.exe	92
PID 3384 wrote to memory of 2032	3384	msedge.exe	92
PID 3384 wrote to memory of 2032	3384	msedge.exe	92
PID 3384 wrote to memory of 2032	3384	msedge.exe	92
PID 3384 wrote to memory of 2032	3384	msedge.exe	92
PID 3384 wrote to memory of 2032	3384	msedge.exe	92
PID 3384 wrote to memory of 2032	3384	msedge.exe	92
PID 3384 wrote to memory of 2032	3384	msedge.exe	92
PID 3384 wrote to memory of 2032	3384	msedge.exe	92
PID 3384 wrote to memory of 2032	3384	msedge.exe	92
PID 3384 wrote to memory of 2032	3384	msedge.exe	92
PID 3384 wrote to memory of 2032	3384	msedge.exe	92
PID 3384 wrote to memory of 2032	3384	msedge.exe	92
PID 3384 wrote to memory of 2032	3384	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bb655ca219c26b31ac108855e223c562.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd704a46f8,0x7ffd704a4708,0x7ffd704a4718
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,6624236369284726064,13007195239039326604,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,6624236369284726064,13007195239039326604,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,6624236369284726064,13007195239039326604,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6624236369284726064,13007195239039326604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,6624236369284726064,13007195239039326604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,6624236369284726064,13007195239039326604,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1368 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cbec32729772aa6c576e97df4fef48f5

SHA1
6ec173d5313f27ba1e46ad66c7bbe7c0a9767dba

SHA256
d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e

SHA512
425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
279e783b0129b64a8529800a88fbf1ee

SHA1
204c62ec8cef8467e5729cad52adae293178744f

SHA256
3619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932

SHA512
32730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ec34d9b12b212760c89ff22a9d15c16b

SHA1
b52fd7a58480deca00799a5b988fd5f02d631e94

SHA256
621db7c51b073aa8f8badeb3d8b1e17735ec7521cef8a70c895e33542480180c

SHA512
144e3a18b1c1eba4740d3210cdfab3947502451157fcfc2cd2adbdc4254c70840e55b559895164993532c8d1676246f8e43e227fea3836efe245069d5c5cab59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
906fce5303773c302222b78346dcafb2

SHA1
45b2200c7c45d27459b34d819f9492c3a2986cfb

SHA256
0ecd30a06d997855283a9f5dd697807c32d9f51fb6a0642cf5964ec1aec84094

SHA512
bc0fc759d53b40f9e34f2320b05940d956edf8b7c412eb5b4bf3eaeeeb8a959b5fe7ef88a82ebe2cbb68bf1fdaebb754f162face136926ff645b343fd499e018

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
58a284f0a73a7db268306eebba4cc772

SHA1
fb56aba11f3511e1350494c31afda75a77c0b14c

SHA256
132b4a86ffb2f8bb2dfea53bfe195b57d4a3d6c85ce4acfa8f43c8b7bcf50479

SHA512
ce8ccae15aed47ef494aba54e350b3fe3f5d670ccc8658b2d003ff0860252edb6c9dc18943c519da91b3f0d32796dcbaa2cabefcfaf3dfce356f42c8cd3b21a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3fae14eaf6cdff7ee9a455c7c81d3484

SHA1
91ee8bf2aea6c9f86b61d394c25f3ffd7a18c8c2

SHA256
4bc55729516ed492ba0eb91901ded0560282d63bc766ac3deb8ba185bb33dad5

SHA512
244c27b47bb682669ece44fd6d2c0162074b2bc5de5192cba549a0e80190276510c936f7c1d53514b6904f0ac53c4019c15e965537fbb89cf94cb8d7f3f7bb88

Download Submit