Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/03/2024, 00:55
Static task
static1
Behavioral task
behavioral1
Sample
bf6b33f0766f9aa517fd4d11d097e3e7.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
bf6b33f0766f9aa517fd4d11d097e3e7.html
Resource
win10v2004-20240226-en
General
-
Target
bf6b33f0766f9aa517fd4d11d097e3e7.html
-
Size
8KB
-
MD5
bf6b33f0766f9aa517fd4d11d097e3e7
-
SHA1
7a53be7f6234204f1bb60a0b352db30672fb1b43
-
SHA256
7b165703998cc0064c7a1d3c9cdb75b84089e64492c6559cb0211121ed253702
-
SHA512
c7923f9407872f59074c4075d67069fa48421ee0e2a34dd1b2db51c21c73a2b5d00b0418d3fc543ba4c92825870788f78e6e8914e193f2ed776a171ee40c272d
-
SSDEEP
192:PLtC9TkWoa9HuaQ3GJ+6fPeThjdl43WhisXWCQ9YDWmYAG/TU:ztCtkFUPWG5e1dyWhisXDlDWmRG/TU
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3300 msedge.exe 3300 msedge.exe 4444 msedge.exe 4444 msedge.exe 3736 identity_helper.exe 3736 identity_helper.exe 2740 msedge.exe 2740 msedge.exe 2740 msedge.exe 2740 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4444 wrote to memory of 972 4444 msedge.exe 91 PID 4444 wrote to memory of 972 4444 msedge.exe 91 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 980 4444 msedge.exe 92 PID 4444 wrote to memory of 3300 4444 msedge.exe 93 PID 4444 wrote to memory of 3300 4444 msedge.exe 93 PID 4444 wrote to memory of 2032 4444 msedge.exe 94 PID 4444 wrote to memory of 2032 4444 msedge.exe 94 PID 4444 wrote to memory of 2032 4444 msedge.exe 94 PID 4444 wrote to memory of 2032 4444 msedge.exe 94 PID 4444 wrote to memory of 2032 4444 msedge.exe 94 PID 4444 wrote to memory of 2032 4444 msedge.exe 94 PID 4444 wrote to memory of 2032 4444 msedge.exe 94 PID 4444 wrote to memory of 2032 4444 msedge.exe 94 PID 4444 wrote to memory of 2032 4444 msedge.exe 94 PID 4444 wrote to memory of 2032 4444 msedge.exe 94 PID 4444 wrote to memory of 2032 4444 msedge.exe 94 PID 4444 wrote to memory of 2032 4444 msedge.exe 94 PID 4444 wrote to memory of 2032 4444 msedge.exe 94 PID 4444 wrote to memory of 2032 4444 msedge.exe 94 PID 4444 wrote to memory of 2032 4444 msedge.exe 94 PID 4444 wrote to memory of 2032 4444 msedge.exe 94 PID 4444 wrote to memory of 2032 4444 msedge.exe 94 PID 4444 wrote to memory of 2032 4444 msedge.exe 94 PID 4444 wrote to memory of 2032 4444 msedge.exe 94 PID 4444 wrote to memory of 2032 4444 msedge.exe 94
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bf6b33f0766f9aa517fd4d11d097e3e7.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9d78346f8,0x7ff9d7834708,0x7ff9d78347182⤵PID:972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,4103414704138670121,14719280074475607229,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:22⤵PID:980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,4103414704138670121,14719280074475607229,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,4103414704138670121,14719280074475607229,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:82⤵PID:2032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4103414704138670121,14719280074475607229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:1464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4103414704138670121,14719280074475607229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:1564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,4103414704138670121,14719280074475607229,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:82⤵PID:1180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,4103414704138670121,14719280074475607229,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4103414704138670121,14719280074475607229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:12⤵PID:3056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4103414704138670121,14719280074475607229,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:12⤵PID:2416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4103414704138670121,14719280074475607229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵PID:3688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4103414704138670121,14719280074475607229,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:12⤵PID:1180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,4103414704138670121,14719280074475607229,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4852 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2740
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5116
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1892
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59ffb5f81e8eccd0963c46cbfea1abc20
SHA1a02a610afd3543de215565bc488a4343bb5c1a59
SHA2563a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc
SHA5122d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597
-
Filesize
152B
MD5e1b45169ebca0dceadb0f45697799d62
SHA1803604277318898e6f5c6fb92270ca83b5609cd5
SHA2564c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60
SHA512357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e
-
Filesize
314B
MD5c8917e83e96021b77f83332a11aa88b3
SHA1e9de488136ea9888468c5e290d954c5ef832c286
SHA256eb21f8aec8ca80a3f330f05d2ce7e0b42a1ba9d0f1c4fa7f86b0c384f2e86e9c
SHA5129e53b0793b1a80ca5249ce65f96e9d3db8eef60f6961c69536b10495d2efdee4376a8e3c74a8a926f6bab76b963022f333d391f21209841b4d60625253908539
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
6KB
MD507ab1f29c7daf353dab9f42330a8c946
SHA148a69aa5d0067796c97621a51291a0860532f570
SHA256e7fd4c6f7b9c3d4e5df740578d4e23b896864f804a310b9782c054a87584a4ec
SHA512778b51ad893f18e4034b0033be8cd1dbf82e41d42b6d8ffb473efa074537a5cb3022c19bcb2a383c40a1e1d07f4b49fd0bdeaea7e973aff620211c432952bf6c
-
Filesize
6KB
MD577f5ae7f9b5316bfab874ee2d27560cf
SHA1e0b0a363f4e3963c6e7686f819d6512bc6ae8f41
SHA256a3822acf3a31a10ac1a2e05dedeb8c56b731b6c1bd3378af711e23f26f233010
SHA5128103570000875fa816c8c2f27a616e33a43700bceb9124a0912b8af95b81cbb770ff3e070c573894e883c0bdc9595fb00acf9f7cde880083b5f5ab0826a50c4c
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD58e14ba17a3fafc2863bc66f514cf4594
SHA14ea09ce00cd87b053449be70e48a95226eb968d4
SHA2564045a650cc11cb456604cd726db402c76262920f6d2fe1d91c32b7476f023b97
SHA512f2dcd6c552191e1d3adb855978ccbe1989dbf90cb14b73e286a15c7e3fc975feb8a689d6ba069ce8b6a7ec8290782ad37c9c13a067c2c996198bc2e0fb356c5d