e6c98490a243e9b83c68d0cd84a4997da04c3b9f84863d5252659a571ea4e793

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 23:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1d46de01fd792d51775174da5ade317.html
Size

9KB
MD5

c1d46de01fd792d51775174da5ade317
SHA1

35ef3ccaa3bff482ec83e958ebeac8fb07c3a062
SHA256

e6c98490a243e9b83c68d0cd84a4997da04c3b9f84863d5252659a571ea4e793
SHA512

edf9d4af00e721efa669185fa8c6b1569d3f985a9ce1f807c2ea6df90709399cd0407cb7ee8389dd2bd84806937c8e9ef8d381f842a88d0fab9802da8d1e7696
SSDEEP

96:uzVs+ux7o3LLY1k9o84d12ef7CSTUbGT/k/+pbr3DlVHcEZ7ru7f:csz7o3AYS/CsbPHb76f

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
2760	msedge.exe
2760	msedge.exe
4516	identity_helper.exe
4516	identity_helper.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe
2760	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 316	2760	msedge.exe	88
PID 2760 wrote to memory of 316	2760	msedge.exe	88
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 5092	2760	msedge.exe	89
PID 2760 wrote to memory of 1748	2760	msedge.exe	90
PID 2760 wrote to memory of 1748	2760	msedge.exe	90
PID 2760 wrote to memory of 2452	2760	msedge.exe	91
PID 2760 wrote to memory of 2452	2760	msedge.exe	91
PID 2760 wrote to memory of 2452	2760	msedge.exe	91
PID 2760 wrote to memory of 2452	2760	msedge.exe	91
PID 2760 wrote to memory of 2452	2760	msedge.exe	91
PID 2760 wrote to memory of 2452	2760	msedge.exe	91
PID 2760 wrote to memory of 2452	2760	msedge.exe	91
PID 2760 wrote to memory of 2452	2760	msedge.exe	91
PID 2760 wrote to memory of 2452	2760	msedge.exe	91
PID 2760 wrote to memory of 2452	2760	msedge.exe	91
PID 2760 wrote to memory of 2452	2760	msedge.exe	91
PID 2760 wrote to memory of 2452	2760	msedge.exe	91
PID 2760 wrote to memory of 2452	2760	msedge.exe	91
PID 2760 wrote to memory of 2452	2760	msedge.exe	91
PID 2760 wrote to memory of 2452	2760	msedge.exe	91
PID 2760 wrote to memory of 2452	2760	msedge.exe	91
PID 2760 wrote to memory of 2452	2760	msedge.exe	91
PID 2760 wrote to memory of 2452	2760	msedge.exe	91
PID 2760 wrote to memory of 2452	2760	msedge.exe	91
PID 2760 wrote to memory of 2452	2760	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c1d46de01fd792d51775174da5ade317.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d7b546f8,0x7ff8d7b54708,0x7ff8d7b54718
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,242462607333967303,3606783075954748206,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,242462607333967303,3606783075954748206,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,242462607333967303,3606783075954748206,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,242462607333967303,3606783075954748206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,242462607333967303,3606783075954748206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,242462607333967303,3606783075954748206,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4740 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,242462607333967303,3606783075954748206,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4740 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,242462607333967303,3606783075954748206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,242462607333967303,3606783075954748206,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,242462607333967303,3606783075954748206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,242462607333967303,3606783075954748206,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,242462607333967303,3606783075954748206,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4596 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36bb45cb1262fcfcab1e3e7960784eaa

SHA1
ab0e15841b027632c9e1b0a47d3dec42162fc637

SHA256
7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae

SHA512
02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1e3dc6a82a2cb341f7c9feeaf53f466f

SHA1
915decb72e1f86e14114f14ac9bfd9ba198fdfce

SHA256
a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c

SHA512
0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0b3d0eb3b0fc5eb27f742da53013b21a

SHA1
caa8df80c16c7db04004dfcb1405d5a90260665b

SHA256
54ead4c71b7e83c2d0a542fb21e1e8a8ec9ea00cb7f860b56547840f4cad55c1

SHA512
79eccd31789b4f5f9dc71691f7dd7f81b5402dd9dbfd1f9efbab1150ebd9419fff173b045b7d4fffd214953e38043a48ab0746404a3f6cf3d3e57fa5dfd38e77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
322af5489ce9e8e35c47f24651b98e5d

SHA1
2f871250aa1381eb7ccee2578f5140e639623052

SHA256
dc49358e603ae637866a6a958fd24f90326b94cb81f89dd8412efbbda1538f62

SHA512
733427df757690fe8378cda60a3cc76caaf47296f982ff2107ad3c36e9836376ce009386cb93c5ea494161c30bf6b9630ca93714373c72901cb24ad243d0eeb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f8ea9f9da60c8cec4e434f78811d43e2

SHA1
0b6493f6c3fc2866e94a464866d3cf0a7b5a3fe1

SHA256
05b42412da353bb92117ab13e10208215e1b05f6f694cf97729b38782e49584d

SHA512
dc52bf60701ade8f9670b1f5dca08c9dff7a0313589cf601a8db3c7c09599cd07e4191ffe5595fa6979ca9cc9d0efa1b6e2bb73b1d0a1268d9dc9abd879c833c

Download Submit