7b165703998cc0064c7a1d3c9cdb75b84089e64492c6559cb0211121ed253702

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 00:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf6b33f0766f9aa517fd4d11d097e3e7.html
Size

8KB
MD5

bf6b33f0766f9aa517fd4d11d097e3e7
SHA1

7a53be7f6234204f1bb60a0b352db30672fb1b43
SHA256

7b165703998cc0064c7a1d3c9cdb75b84089e64492c6559cb0211121ed253702
SHA512

c7923f9407872f59074c4075d67069fa48421ee0e2a34dd1b2db51c21c73a2b5d00b0418d3fc543ba4c92825870788f78e6e8914e193f2ed776a171ee40c272d
SSDEEP

192:PLtC9TkWoa9HuaQ3GJ+6fPeThjdl43WhisXWCQ9YDWmYAG/TU:ztCtkFUPWG5e1dyWhisXDlDWmRG/TU

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3300	msedge.exe
3300	msedge.exe
4444	msedge.exe
4444	msedge.exe
3736	identity_helper.exe
3736	identity_helper.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe
4444	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 972	4444	msedge.exe	91
PID 4444 wrote to memory of 972	4444	msedge.exe	91
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 980	4444	msedge.exe	92
PID 4444 wrote to memory of 3300	4444	msedge.exe	93
PID 4444 wrote to memory of 3300	4444	msedge.exe	93
PID 4444 wrote to memory of 2032	4444	msedge.exe	94
PID 4444 wrote to memory of 2032	4444	msedge.exe	94
PID 4444 wrote to memory of 2032	4444	msedge.exe	94
PID 4444 wrote to memory of 2032	4444	msedge.exe	94
PID 4444 wrote to memory of 2032	4444	msedge.exe	94
PID 4444 wrote to memory of 2032	4444	msedge.exe	94
PID 4444 wrote to memory of 2032	4444	msedge.exe	94
PID 4444 wrote to memory of 2032	4444	msedge.exe	94
PID 4444 wrote to memory of 2032	4444	msedge.exe	94
PID 4444 wrote to memory of 2032	4444	msedge.exe	94
PID 4444 wrote to memory of 2032	4444	msedge.exe	94
PID 4444 wrote to memory of 2032	4444	msedge.exe	94
PID 4444 wrote to memory of 2032	4444	msedge.exe	94
PID 4444 wrote to memory of 2032	4444	msedge.exe	94
PID 4444 wrote to memory of 2032	4444	msedge.exe	94
PID 4444 wrote to memory of 2032	4444	msedge.exe	94
PID 4444 wrote to memory of 2032	4444	msedge.exe	94
PID 4444 wrote to memory of 2032	4444	msedge.exe	94
PID 4444 wrote to memory of 2032	4444	msedge.exe	94
PID 4444 wrote to memory of 2032	4444	msedge.exe	94

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bf6b33f0766f9aa517fd4d11d097e3e7.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9d78346f8,0x7ff9d7834708,0x7ff9d7834718
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,4103414704138670121,14719280074475607229,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,4103414704138670121,14719280074475607229,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,4103414704138670121,14719280074475607229,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4103414704138670121,14719280074475607229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4103414704138670121,14719280074475607229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,4103414704138670121,14719280074475607229,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,4103414704138670121,14719280074475607229,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4103414704138670121,14719280074475607229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4103414704138670121,14719280074475607229,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4103414704138670121,14719280074475607229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4103414704138670121,14719280074475607229,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,4103414704138670121,14719280074475607229,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4852 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
314B

MD5
c8917e83e96021b77f83332a11aa88b3

SHA1
e9de488136ea9888468c5e290d954c5ef832c286

SHA256
eb21f8aec8ca80a3f330f05d2ce7e0b42a1ba9d0f1c4fa7f86b0c384f2e86e9c

SHA512
9e53b0793b1a80ca5249ce65f96e9d3db8eef60f6961c69536b10495d2efdee4376a8e3c74a8a926f6bab76b963022f333d391f21209841b4d60625253908539

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
07ab1f29c7daf353dab9f42330a8c946

SHA1
48a69aa5d0067796c97621a51291a0860532f570

SHA256
e7fd4c6f7b9c3d4e5df740578d4e23b896864f804a310b9782c054a87584a4ec

SHA512
778b51ad893f18e4034b0033be8cd1dbf82e41d42b6d8ffb473efa074537a5cb3022c19bcb2a383c40a1e1d07f4b49fd0bdeaea7e973aff620211c432952bf6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
77f5ae7f9b5316bfab874ee2d27560cf

SHA1
e0b0a363f4e3963c6e7686f819d6512bc6ae8f41

SHA256
a3822acf3a31a10ac1a2e05dedeb8c56b731b6c1bd3378af711e23f26f233010

SHA512
8103570000875fa816c8c2f27a616e33a43700bceb9124a0912b8af95b81cbb770ff3e070c573894e883c0bdc9595fb00acf9f7cde880083b5f5ab0826a50c4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8e14ba17a3fafc2863bc66f514cf4594

SHA1
4ea09ce00cd87b053449be70e48a95226eb968d4

SHA256
4045a650cc11cb456604cd726db402c76262920f6d2fe1d91c32b7476f023b97

SHA512
f2dcd6c552191e1d3adb855978ccbe1989dbf90cb14b73e286a15c7e3fc975feb8a689d6ba069ce8b6a7ec8290782ad37c9c13a067c2c996198bc2e0fb356c5d

Download Submit