Analysis
-
max time kernel
145s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11-03-2024 02:14
Static task
static1
Behavioral task
behavioral1
Sample
bf93044e2d248881fa3cec2a4118a85a.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
bf93044e2d248881fa3cec2a4118a85a.html
Resource
win10v2004-20240226-en
General
-
Target
bf93044e2d248881fa3cec2a4118a85a.html
-
Size
11KB
-
MD5
bf93044e2d248881fa3cec2a4118a85a
-
SHA1
2cc0e3a2336ada1b12c3e5e55c7f27043e3e1c90
-
SHA256
e70fcb2bb3721f39fd691090d52b546a615d028bbbde26cc00b2a1b3f3c75215
-
SHA512
ea4e1cb585fef8836112745781c8fbf522ecad37fbdc5da15515a6cb873fb23745d11f311ab548e4cf523d08e821d6ea81bc934484b5212b6b82f8fdbfdc0e8d
-
SSDEEP
96:uzVs+ux7j6LLY1k9o84d12ef7CSTUDGT/k2zplXXp8As7J8xR/lVHcEZ7ru7f:csz7j6AYS/uSlXXpm7J8/PHb76f
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4928 msedge.exe 4928 msedge.exe 4260 msedge.exe 4260 msedge.exe 4624 identity_helper.exe 4624 identity_helper.exe 1884 msedge.exe 1884 msedge.exe 1884 msedge.exe 1884 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe 4260 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4260 wrote to memory of 1548 4260 msedge.exe 89 PID 4260 wrote to memory of 1548 4260 msedge.exe 89 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 2432 4260 msedge.exe 90 PID 4260 wrote to memory of 4928 4260 msedge.exe 91 PID 4260 wrote to memory of 4928 4260 msedge.exe 91 PID 4260 wrote to memory of 3604 4260 msedge.exe 92 PID 4260 wrote to memory of 3604 4260 msedge.exe 92 PID 4260 wrote to memory of 3604 4260 msedge.exe 92 PID 4260 wrote to memory of 3604 4260 msedge.exe 92 PID 4260 wrote to memory of 3604 4260 msedge.exe 92 PID 4260 wrote to memory of 3604 4260 msedge.exe 92 PID 4260 wrote to memory of 3604 4260 msedge.exe 92 PID 4260 wrote to memory of 3604 4260 msedge.exe 92 PID 4260 wrote to memory of 3604 4260 msedge.exe 92 PID 4260 wrote to memory of 3604 4260 msedge.exe 92 PID 4260 wrote to memory of 3604 4260 msedge.exe 92 PID 4260 wrote to memory of 3604 4260 msedge.exe 92 PID 4260 wrote to memory of 3604 4260 msedge.exe 92 PID 4260 wrote to memory of 3604 4260 msedge.exe 92 PID 4260 wrote to memory of 3604 4260 msedge.exe 92 PID 4260 wrote to memory of 3604 4260 msedge.exe 92 PID 4260 wrote to memory of 3604 4260 msedge.exe 92 PID 4260 wrote to memory of 3604 4260 msedge.exe 92 PID 4260 wrote to memory of 3604 4260 msedge.exe 92 PID 4260 wrote to memory of 3604 4260 msedge.exe 92
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bf93044e2d248881fa3cec2a4118a85a.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd3ba746f8,0x7ffd3ba74708,0x7ffd3ba747182⤵PID:1548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13188926993719832052,17520525750815634585,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵PID:2432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,13188926993719832052,17520525750815634585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,13188926993719832052,17520525750815634585,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2592 /prefetch:82⤵PID:3604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13188926993719832052,17520525750815634585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:3468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13188926993719832052,17520525750815634585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:4204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,13188926993719832052,17520525750815634585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:82⤵PID:2548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,13188926993719832052,17520525750815634585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13188926993719832052,17520525750815634585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:12⤵PID:2348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13188926993719832052,17520525750815634585,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:12⤵PID:1464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13188926993719832052,17520525750815634585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:12⤵PID:3928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13188926993719832052,17520525750815634585,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:12⤵PID:5028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13188926993719832052,17520525750815634585,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4368 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1884
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1892
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2372
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f35bb0615bb9816f562b83304e456294
SHA11049e2bd3e1bbb4cea572467d7c4a96648659cb4
SHA25605e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71
SHA512db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1
-
Filesize
152B
MD51eb86108cb8f5a956fdf48efbd5d06fe
SHA17b2b299f753798e4891df2d9cbf30f94b39ef924
SHA2561b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40
SHA512e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d
-
Filesize
6KB
MD5d2681102a0182696306ccacbe4a5ea26
SHA18238e931c6b6983215e83f0afca61380c4fc95b7
SHA25673fa1dab343538e4550f7fd5321c25494ca2a762ae2345485f4a8cf9fda436a7
SHA5128218f4fb894d75859d4cab6e799403f2ba1c9ef4aed619767f6d47324673c75af12879c971979f14a901d56f0515cfe03352ce6db8b950dfa71f56b56e716f53
-
Filesize
6KB
MD5232369326af2fe304ae45660e84bf210
SHA1d74b871f35fafa7e9adf01afd2c1f2bf2ca12e2a
SHA25685c5248d487e1e12928a1c38f3fd558e5775f0f45fe3eb1d9093eed31623cf38
SHA512cbda2f0517da6b878b6fb385a1c33dbf89c1bae83ce7fff3b3260cb9aeb805fc60812f4ea5472ad042f2d2c24f6e41436726a09567ebc08629d850516054b4b1
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD57700d865b6c30bc7f0c2053652633580
SHA1f9981a304051a67679f61092bfafe36cb1362256
SHA2561c2ed13ec7aa2e417671a4506f5cabc381b1631c92e8e0dbb295d1aeec1e2044
SHA512c9f91a8b2c943d5a86f9cfbc3a6fe21ae3f6ce8f24e95864f2aba819de4f8b37d3c30b9da6fb7ccdc539dd4f4d203fda4704ffcea99b0b4d7946bd33a5db5123