e349bff5107b385e8be6cf8237f326a98fddc2876be0e0fda6b0d73f721bc8a0

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 00:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf665842e629caa95584b35652663bbc.html
Size

52KB
MD5

bf665842e629caa95584b35652663bbc
SHA1

ec18cbc6a0c447a7bd585fb80043d306ff11fa95
SHA256

e349bff5107b385e8be6cf8237f326a98fddc2876be0e0fda6b0d73f721bc8a0
SHA512

9443aa2b91224c38e46de499785ac9fb41aa59090b08791761c3631c7345fd532fa902a44a971c3f1d2ea6f434960bfc6b9d7a7e3d243c455494c2a6ba535a99
SSDEEP

1536:SAKniiVBAamAIWpowtUEHdriWKXNPduooB:SfwvMPB

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
4156	msedge.exe
4156	msedge.exe
4912	identity_helper.exe
4912	identity_helper.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 2936	3532	msedge.exe	90
PID 3532 wrote to memory of 2936	3532	msedge.exe	90
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 2600	3532	msedge.exe	91
PID 3532 wrote to memory of 4156	3532	msedge.exe	92
PID 3532 wrote to memory of 4156	3532	msedge.exe	92
PID 3532 wrote to memory of 2388	3532	msedge.exe	93
PID 3532 wrote to memory of 2388	3532	msedge.exe	93
PID 3532 wrote to memory of 2388	3532	msedge.exe	93
PID 3532 wrote to memory of 2388	3532	msedge.exe	93
PID 3532 wrote to memory of 2388	3532	msedge.exe	93
PID 3532 wrote to memory of 2388	3532	msedge.exe	93
PID 3532 wrote to memory of 2388	3532	msedge.exe	93
PID 3532 wrote to memory of 2388	3532	msedge.exe	93
PID 3532 wrote to memory of 2388	3532	msedge.exe	93
PID 3532 wrote to memory of 2388	3532	msedge.exe	93
PID 3532 wrote to memory of 2388	3532	msedge.exe	93
PID 3532 wrote to memory of 2388	3532	msedge.exe	93
PID 3532 wrote to memory of 2388	3532	msedge.exe	93
PID 3532 wrote to memory of 2388	3532	msedge.exe	93
PID 3532 wrote to memory of 2388	3532	msedge.exe	93
PID 3532 wrote to memory of 2388	3532	msedge.exe	93
PID 3532 wrote to memory of 2388	3532	msedge.exe	93
PID 3532 wrote to memory of 2388	3532	msedge.exe	93
PID 3532 wrote to memory of 2388	3532	msedge.exe	93
PID 3532 wrote to memory of 2388	3532	msedge.exe	93

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bf665842e629caa95584b35652663bbc.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff98d8746f8,0x7ff98d874708,0x7ff98d874718
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,2863481599560608027,11743761230206834457,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,2863481599560608027,11743761230206834457,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,2863481599560608027,11743761230206834457,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2863481599560608027,11743761230206834457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2863481599560608027,11743761230206834457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2863481599560608027,11743761230206834457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2863481599560608027,11743761230206834457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2863481599560608027,11743761230206834457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,2863481599560608027,11743761230206834457,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,2863481599560608027,11743761230206834457,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2863481599560608027,11743761230206834457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2863481599560608027,11743761230206834457,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2863481599560608027,11743761230206834457,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,2863481599560608027,11743761230206834457,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,2863481599560608027,11743761230206834457,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4828 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e494d16e4b331d7fc483b3ae3b2e0973

SHA1
d13ca61b6404902b716f7b02f0070dec7f36edbf

SHA256
a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165

SHA512
016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0764f5481d3c05f5d391a36463484b49

SHA1
2c96194f04e768ac9d7134bc242808e4d8aeb149

SHA256
cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3

SHA512
a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
fdd6790afea2072b86981482a882436f

SHA1
23badaa4f6bd2976d45cce0e8e037f6d4d2016a1

SHA256
239592315f2331f2cbf845271900b1e8f740da7478362606c2df9920c4c8ead3

SHA512
c6e69632f2123fdfca35384a75e2cc688866dbd5bba811ba6a545cd523968c54c2197a03ba7d0556d2768d4a391359aeca61dec88d39a7adb8c21c7df6076d5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ba3e4463913934f2e2f812adc1f695ae

SHA1
eef74dca59274e1b868373835aee2a11dfd2885b

SHA256
cbb318afc0103f74694eda16b747c00df703aae2d28c0a2399e1952ca61e9f98

SHA512
89f427c7dcf7a406a6580e8c16917d46d7942d212ebd537ef02c7caa4bf065be4ff25eb7540b9a358e3134325c2321222c845d890c80b4e94e3f5998812ba5b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a58629c1383eb0cb6a69f73f011c2d9a

SHA1
aeba8823343cd9f34d6de67576c11ec195ca09d8

SHA256
a9785ae89ca6a6a535408a9ea8395f8a54461a88d92ebf9c8755d447757b638a

SHA512
1e05e88f895b25b91a4bf6226a59ba5a80fc6566ed4b56003e36991f7399ca92c7d7924004b0637560b4ebddc8d0bf25dac5dab58eadc9e2ec6b26ce93601a6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
050340ce240ae5c5cadd64855faa51fc

SHA1
c9177644cf03f5adc9850665c1d1231cac0e106d

SHA256
3eb2474be3eb3b20500cc9852805779c60afc34565f5693975536d14285e423b

SHA512
63b941d3540c0c9792e014b5803fb769f5491dcd0030ea17e3b68fe74c3a56fc5d3f84005bde5fe382252e7e59b01a09c80fbe45af76d9d380ac73badddde76d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c51925e56a22f8e6d5f70bd239a2993f

SHA1
ac557240be20dfd2aab7f5d57072cf0b85a071d2

SHA256
bf2c7b0ba11222d874036450e67b146132ee163a91f73f826475381037fd79c3

SHA512
783eca1417128e2dad938205e7952ec4fbf8e9c2d8c01ad5e506087af9fe296316891da81cd8b1f656452c509180a44e186f7548ec46fc4005cadee20223836a

Download Submit