a9b740c880de0f44699965b3374e2d400542ec6a1fcda15545ba75a7a0e8be04

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 01:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bd49a6b73a2fe154c2e7c0da4b0ec184.html
Size

18KB
MD5

bd49a6b73a2fe154c2e7c0da4b0ec184
SHA1

9b187daaaded90c4f61ffe9d8155492ae165811a
SHA256

a9b740c880de0f44699965b3374e2d400542ec6a1fcda15545ba75a7a0e8be04
SHA512

a3f8f13e70529a099c0b8a6dbdcd894f06d4486ed3ca9bab9958ba06fbb3214aac9b13cff6ee25a222a12e20ca4243df5977ec93eaa6a34dda1a48b4c41ddd90
SSDEEP

192:3QOx0CV0aRYo9Q9T4F3vBY6ax7TR+Z2HQ7WLtt6ledRKYx9Y7JxFJC:3LvV3R/eTg3ZwhqlIN8c

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1988	msedge.exe
1988	msedge.exe
1860	msedge.exe
1860	msedge.exe
1364	identity_helper.exe
1364	identity_helper.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 224	1860	msedge.exe	87
PID 1860 wrote to memory of 224	1860	msedge.exe	87
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1640	1860	msedge.exe	88
PID 1860 wrote to memory of 1988	1860	msedge.exe	89
PID 1860 wrote to memory of 1988	1860	msedge.exe	89
PID 1860 wrote to memory of 4760	1860	msedge.exe	91
PID 1860 wrote to memory of 4760	1860	msedge.exe	91
PID 1860 wrote to memory of 4760	1860	msedge.exe	91
PID 1860 wrote to memory of 4760	1860	msedge.exe	91
PID 1860 wrote to memory of 4760	1860	msedge.exe	91
PID 1860 wrote to memory of 4760	1860	msedge.exe	91
PID 1860 wrote to memory of 4760	1860	msedge.exe	91
PID 1860 wrote to memory of 4760	1860	msedge.exe	91
PID 1860 wrote to memory of 4760	1860	msedge.exe	91
PID 1860 wrote to memory of 4760	1860	msedge.exe	91
PID 1860 wrote to memory of 4760	1860	msedge.exe	91
PID 1860 wrote to memory of 4760	1860	msedge.exe	91
PID 1860 wrote to memory of 4760	1860	msedge.exe	91
PID 1860 wrote to memory of 4760	1860	msedge.exe	91
PID 1860 wrote to memory of 4760	1860	msedge.exe	91
PID 1860 wrote to memory of 4760	1860	msedge.exe	91
PID 1860 wrote to memory of 4760	1860	msedge.exe	91
PID 1860 wrote to memory of 4760	1860	msedge.exe	91
PID 1860 wrote to memory of 4760	1860	msedge.exe	91
PID 1860 wrote to memory of 4760	1860	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bd49a6b73a2fe154c2e7c0da4b0ec184.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9153446f8,0x7ff915344708,0x7ff915344718
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,784302659556643394,16926311144917123049,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,784302659556643394,16926311144917123049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,784302659556643394,16926311144917123049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,784302659556643394,16926311144917123049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,784302659556643394,16926311144917123049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,784302659556643394,16926311144917123049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,784302659556643394,16926311144917123049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,784302659556643394,16926311144917123049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,784302659556643394,16926311144917123049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,784302659556643394,16926311144917123049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,784302659556643394,16926311144917123049,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,784302659556643394,16926311144917123049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,784302659556643394,16926311144917123049,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,784302659556643394,16926311144917123049,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3140 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fd7944a4ff1be37517983ffaf5700b11

SHA1
c4287796d78e00969af85b7e16a2d04230961240

SHA256
b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

SHA512
28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b341f55d8fe715240c70814f6447de96

SHA1
e812271d828ce331ef87b5bd90f44ac0fbf8e13c

SHA256
6a56db41cbf7c97108062dee507b78e07237fcc8f809ff3e23af82ec47debf0d

SHA512
5dd592c78392d475f6c8e71afdf71a51a7873df53a3421af79537fae23c599a08d9de362c9d90be1d9950264990b6332a8427e237690bb5e38cc1ad929ba7376

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fc7ac3e7b09e0734bc7c3b40d69353f2

SHA1
076025ce51f7061b2f64d3164a7f02ab18891f07

SHA256
b1d7697694f0166d93f32f50928c32098cbadfa188f9c74acd3b4ed898334795

SHA512
6f474d1077deeea00a30d74a130d9ca88a3f639553439a10cd2de31f34a4936ef886a534f5822002f1f498d329281aa7b5060fd5acfc16fb99a931946144b94e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1ec064cda34b8d82a8bf0c71b25c4232

SHA1
cfdae4eb1752402c53ad8c7bd55f070ecfcb5f2c

SHA256
f94ac1368395812d6e369c09e886bb0be5a8e3f543a1e7aa2f189dbd7861150c

SHA512
1a0d9c34cf67ec638a9729349feea288974db59164ccf44d362517d61a596f974ac3684f23936916fb0c7acccaf87a92f286b6565ae6490d2fb7cbfd6ab063da

Download Submit