Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09-03-2024 19:41
Static task
static1
Behavioral task
behavioral1
Sample
bca4132932ccfabbc2069eecdeba05a7.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
bca4132932ccfabbc2069eecdeba05a7.html
Resource
win10v2004-20240226-en
General
-
Target
bca4132932ccfabbc2069eecdeba05a7.html
-
Size
2KB
-
MD5
bca4132932ccfabbc2069eecdeba05a7
-
SHA1
7814359e822a1778337a6faf67e5593112fedfd0
-
SHA256
fc6b56a3b5df524fb56c9b23e6bc54c267d2c7d128ecdc6f95c981a8f1fbf002
-
SHA512
450117431ac1c4d84847c7dc022b6863e2452ab36cf922a57b35567b526daf12fc8cc1977819553ea63249bf2e6fbc78d9102ba6e46d613e6620488d9f153e63
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 3948 msedge.exe 3948 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 2608 identity_helper.exe 2608 identity_helper.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe 1988 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
pid Process 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1564 wrote to memory of 4300 1564 msedge.exe 88 PID 1564 wrote to memory of 4300 1564 msedge.exe 88 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3568 1564 msedge.exe 89 PID 1564 wrote to memory of 3948 1564 msedge.exe 90 PID 1564 wrote to memory of 3948 1564 msedge.exe 90 PID 1564 wrote to memory of 4948 1564 msedge.exe 91 PID 1564 wrote to memory of 4948 1564 msedge.exe 91 PID 1564 wrote to memory of 4948 1564 msedge.exe 91 PID 1564 wrote to memory of 4948 1564 msedge.exe 91 PID 1564 wrote to memory of 4948 1564 msedge.exe 91 PID 1564 wrote to memory of 4948 1564 msedge.exe 91 PID 1564 wrote to memory of 4948 1564 msedge.exe 91 PID 1564 wrote to memory of 4948 1564 msedge.exe 91 PID 1564 wrote to memory of 4948 1564 msedge.exe 91 PID 1564 wrote to memory of 4948 1564 msedge.exe 91 PID 1564 wrote to memory of 4948 1564 msedge.exe 91 PID 1564 wrote to memory of 4948 1564 msedge.exe 91 PID 1564 wrote to memory of 4948 1564 msedge.exe 91 PID 1564 wrote to memory of 4948 1564 msedge.exe 91 PID 1564 wrote to memory of 4948 1564 msedge.exe 91 PID 1564 wrote to memory of 4948 1564 msedge.exe 91 PID 1564 wrote to memory of 4948 1564 msedge.exe 91 PID 1564 wrote to memory of 4948 1564 msedge.exe 91 PID 1564 wrote to memory of 4948 1564 msedge.exe 91 PID 1564 wrote to memory of 4948 1564 msedge.exe 91
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bca4132932ccfabbc2069eecdeba05a7.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff86b846f8,0x7fff86b84708,0x7fff86b847182⤵PID:4300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,16704020685282483115,9064203472000259413,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:22⤵PID:3568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,16704020685282483115,9064203472000259413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,16704020685282483115,9064203472000259413,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:82⤵PID:4948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16704020685282483115,9064203472000259413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:12⤵PID:1404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16704020685282483115,9064203472000259413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵PID:3536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16704020685282483115,9064203472000259413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:12⤵PID:4344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16704020685282483115,9064203472000259413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4404 /prefetch:12⤵PID:4972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16704020685282483115,9064203472000259413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:12⤵PID:4132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,16704020685282483115,9064203472000259413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:82⤵PID:4952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,16704020685282483115,9064203472000259413,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16704020685282483115,9064203472000259413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4428 /prefetch:12⤵PID:4848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16704020685282483115,9064203472000259413,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4520 /prefetch:12⤵PID:3144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16704020685282483115,9064203472000259413,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2248 /prefetch:12⤵PID:1688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16704020685282483115,9064203472000259413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:12⤵PID:3440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16704020685282483115,9064203472000259413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:12⤵PID:1928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16704020685282483115,9064203472000259413,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2680 /prefetch:12⤵PID:4852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,16704020685282483115,9064203472000259413,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5160 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1988
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4832
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3736
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59ffb5f81e8eccd0963c46cbfea1abc20
SHA1a02a610afd3543de215565bc488a4343bb5c1a59
SHA2563a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc
SHA5122d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597
-
Filesize
152B
MD5e1b45169ebca0dceadb0f45697799d62
SHA1803604277318898e6f5c6fb92270ca83b5609cd5
SHA2564c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60
SHA512357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
6KB
MD505f5c573a0a0b914802ef6dba5761d75
SHA1674e5de6261525e7fb59ab458f8c996051cc3ce4
SHA25605a195d901b3450cea91914b39f14549d1c059e3ff9749c5f451a77e610f0f04
SHA512e387191b9a3a7a58e10507730151a1af97c4d4aeef237d4d08ee73cb1bbe4e826774e264fdfac2eb307d8e6292a9fc26ed88ee5a1acdf8eb333a93d680e0e2ce
-
Filesize
6KB
MD5a709d5e13c120b2512ba45380f53c2e1
SHA14578c1e3640df8e354e3892130aabc0f916ccbc4
SHA256681c704ded208b41de84088527e300c3e7d01e6c869d8dbc45fb706b10069997
SHA512e3aa572b77e489d4d115efbf8baace70bf183e91b86f95991128f1bc33942b65d189838cc5599895e0f16eaa98ac16ef6accc0593a45760e81ed95d45970e864
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD57ae5aed482a0d2c8bf38199389a58f81
SHA1618b7e74b47997851ccdd970c8f66c23de67a0e3
SHA256759b30370eecb20b276c183f4bf603592f4a5585f6ac2927171548f56b0f21fd
SHA5126280e25808c2e9c1b4c0473203fe0a6efd6dd5a4f0260b6995c310155268b79aeaceb309bdc1c49898ec919239922ea6284ba3f0aa991cba527cfeac354f84ee