44448c02ba0255bc6c02c101069a55bdfd65d2626add12ddfc0569f5c84337a7

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 00:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf4deae7fc35fecd5473458a2a8cc7ce.html
Size

3.5MB
MD5

bf4deae7fc35fecd5473458a2a8cc7ce
SHA1

bcf8a8c64b620b0f38aa22d5c43bf7fe9bdc9957
SHA256

44448c02ba0255bc6c02c101069a55bdfd65d2626add12ddfc0569f5c84337a7
SHA512

feb3cce50d52df151aaf8c71553367db35381a8bf8b72bfa6f4b89699a9f763118c1a3a6ae9a1d04941a2324d272e4f83f4d8e54a5e5baa9887d0ebb1ea35851
SSDEEP

12288:jLZhBE6ffVfitmg11tmg1P16bf7axluxOT6NNd:jvQjte4tT6Td

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe
3028	msedge.exe
3028	msedge.exe
2564	identity_helper.exe
2564	identity_helper.exe
5528	msedge.exe
5528	msedge.exe
5528	msedge.exe
5528	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 4480	3028	msedge.exe	87
PID 3028 wrote to memory of 4480	3028	msedge.exe	87
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 4796	3028	msedge.exe	88
PID 3028 wrote to memory of 1852	3028	msedge.exe	89
PID 3028 wrote to memory of 1852	3028	msedge.exe	89
PID 3028 wrote to memory of 4456	3028	msedge.exe	90
PID 3028 wrote to memory of 4456	3028	msedge.exe	90
PID 3028 wrote to memory of 4456	3028	msedge.exe	90
PID 3028 wrote to memory of 4456	3028	msedge.exe	90
PID 3028 wrote to memory of 4456	3028	msedge.exe	90
PID 3028 wrote to memory of 4456	3028	msedge.exe	90
PID 3028 wrote to memory of 4456	3028	msedge.exe	90
PID 3028 wrote to memory of 4456	3028	msedge.exe	90
PID 3028 wrote to memory of 4456	3028	msedge.exe	90
PID 3028 wrote to memory of 4456	3028	msedge.exe	90
PID 3028 wrote to memory of 4456	3028	msedge.exe	90
PID 3028 wrote to memory of 4456	3028	msedge.exe	90
PID 3028 wrote to memory of 4456	3028	msedge.exe	90
PID 3028 wrote to memory of 4456	3028	msedge.exe	90
PID 3028 wrote to memory of 4456	3028	msedge.exe	90
PID 3028 wrote to memory of 4456	3028	msedge.exe	90
PID 3028 wrote to memory of 4456	3028	msedge.exe	90
PID 3028 wrote to memory of 4456	3028	msedge.exe	90
PID 3028 wrote to memory of 4456	3028	msedge.exe	90
PID 3028 wrote to memory of 4456	3028	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bf4deae7fc35fecd5473458a2a8cc7ce.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff8c8fb46f8,0x7ff8c8fb4708,0x7ff8c8fb4718
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,2074194694738100325,2876307297422696028,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,2074194694738100325,2876307297422696028,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,2074194694738100325,2876307297422696028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,2074194694738100325,2876307297422696028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2520 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,2074194694738100325,2876307297422696028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,2074194694738100325,2876307297422696028,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,2074194694738100325,2876307297422696028,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,2074194694738100325,2876307297422696028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,2074194694738100325,2876307297422696028,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,2074194694738100325,2876307297422696028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,2074194694738100325,2876307297422696028,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,2074194694738100325,2876307297422696028,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1312 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c6136bc98a5aedca2ea3004e9fbe67d

SHA1
74318d997f4c9c351eef86d040bc9b085ce1ad4f

SHA256
50c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2

SHA512
2d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c6aef82e50d05ffc0cf52a6c6d69c91

SHA1
c203efe5b45b0630fee7bd364fe7d63b769e2351

SHA256
d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32

SHA512
77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
894B

MD5
b074c8a02588f7fd652f987b00911535

SHA1
6a09fdeb44138a438b7fea19ce6dd70c03e3e5b1

SHA256
db548cea61e510233f9eb3a74cbac9c49a13dfbe3ee97f7bc14dbd12d7521cbe

SHA512
2c8259e5436f812169207892ac294e28bd164128786fd8269244bc45fd671afada2eb637d1a05d76f08d676592ad4390060626af01c5b8efdbbe4d7344fe0a48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
36b21b6b110cc9d9c6615ba7f9a2bc33

SHA1
65db006988ac247863c2d3efa805fb41d067f8f2

SHA256
2d8c6588ab48ae0695cade2f6e6a3a6f099a8cc8c5a7db6d9cc1d67ab7e32dfb

SHA512
7cf652a7fe2c764c9ea83e8b46186232f0ce65c47229022a29d9e0846d010c8b606a594f95113ac25ac9ffe4fe9ea827886012ed9842306ef58d8d6bb5cbd3ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8bb3f6573524bff92e00529ceda77a95

SHA1
d6f6c2df8c689e5828c46fa4568f6d2f2861d619

SHA256
7f6dbf2111e0373a7de25898c444996e854b2dab331173920f794283299152bc

SHA512
2ed7942921c6bd70cbb81e4d582ddc29437c62d95b83de3220bbbf2f9b510b79d372db1a7e02fa09c7a036c3f89e1a21ab9d81a40902d9e967bd41b952d623c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
da6743058e32aedc3063f8088f5adcef

SHA1
c9a122cce6379e821b5abdcda1925bfa0d73af0c

SHA256
2aa2cb73fa0c8774397388460e2938b42ef34e8b1a2e1d6fac4bdcba6078111f

SHA512
c97baeae2c00093effbcafa08b199c9bc02471128a9a03f1f66e7d14546595f639951878313ef17966c18d640e59c26a252911978f59fd501f7294bff17368d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a2a7bb9a-95b0-4981-83c2-1a95655b1a2c.tmp

Filesize
11KB

MD5
587b06cb1771ab2a5050bc6b5b25ea79

SHA1
0b6df07c0db7f97d70ff87e4b1f5ad0d02801ccc

SHA256
a6b1f65fde116fcc7f69017d275c244e30570f8aba501d662805f2aea19690de

SHA512
b5dbbba86c160a01852f40fdb4d5e294fc9c1932116678d231b494430c69f1700d64a99cc11891bc051ca02cd8d555e00f7342e4e2cca1cf72b87caf508c3dca

Download Submit