566533e46bf0e235793f13bc1935d102e1f39534b2e632c9ccf71ff51b670970

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-03-2024 22:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c43bcf7707e62f0f51740f77303025f1.html
Size

161KB
MD5

c43bcf7707e62f0f51740f77303025f1
SHA1

cb6d1fff824647e786dc2afcd487db3b2281808d
SHA256

566533e46bf0e235793f13bc1935d102e1f39534b2e632c9ccf71ff51b670970
SHA512

e8cd8c516cb04dce48648ca16fec15e9e4ed7305f0ffab01153fe0d6a3ecfe24f222d8cb6d41c7b0cd612163e154957c90e5b90aac1539bb8703730d93fb6585
SSDEEP

1536:LCb7wDUnvBw/a1fIuiHlq5mN8lDbNmPbcNyHcph7nFf:LCHwDUz1iT5HqnFf

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3716	msedge.exe
3716	msedge.exe
4428	msedge.exe
4428	msedge.exe
652	identity_helper.exe
652	identity_helper.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe
5976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 3112	4428	msedge.exe	89
PID 4428 wrote to memory of 3112	4428	msedge.exe	89
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 5064	4428	msedge.exe	90
PID 4428 wrote to memory of 3716	4428	msedge.exe	91
PID 4428 wrote to memory of 3716	4428	msedge.exe	91
PID 4428 wrote to memory of 4360	4428	msedge.exe	92
PID 4428 wrote to memory of 4360	4428	msedge.exe	92
PID 4428 wrote to memory of 4360	4428	msedge.exe	92
PID 4428 wrote to memory of 4360	4428	msedge.exe	92
PID 4428 wrote to memory of 4360	4428	msedge.exe	92
PID 4428 wrote to memory of 4360	4428	msedge.exe	92
PID 4428 wrote to memory of 4360	4428	msedge.exe	92
PID 4428 wrote to memory of 4360	4428	msedge.exe	92
PID 4428 wrote to memory of 4360	4428	msedge.exe	92
PID 4428 wrote to memory of 4360	4428	msedge.exe	92
PID 4428 wrote to memory of 4360	4428	msedge.exe	92
PID 4428 wrote to memory of 4360	4428	msedge.exe	92
PID 4428 wrote to memory of 4360	4428	msedge.exe	92
PID 4428 wrote to memory of 4360	4428	msedge.exe	92
PID 4428 wrote to memory of 4360	4428	msedge.exe	92
PID 4428 wrote to memory of 4360	4428	msedge.exe	92
PID 4428 wrote to memory of 4360	4428	msedge.exe	92
PID 4428 wrote to memory of 4360	4428	msedge.exe	92
PID 4428 wrote to memory of 4360	4428	msedge.exe	92
PID 4428 wrote to memory of 4360	4428	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c43bcf7707e62f0f51740f77303025f1.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff97af46f8,0x7fff97af4708,0x7fff97af4718
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,9341138701075974091,1716343634550247143,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,9341138701075974091,1716343634550247143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,9341138701075974091,1716343634550247143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3004 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9341138701075974091,1716343634550247143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9341138701075974091,1716343634550247143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,9341138701075974091,1716343634550247143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,9341138701075974091,1716343634550247143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9341138701075974091,1716343634550247143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9341138701075974091,1716343634550247143,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9341138701075974091,1716343634550247143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9341138701075974091,1716343634550247143,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,9341138701075974091,1716343634550247143,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3948 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
978B

MD5
cfb3e3da56b84ace3d6a615b57b2cb30

SHA1
12a898f20a099eeb2d193296147b93cb680108fe

SHA256
c8b678f841d764e2bd3d626ae25e62d5bb3f1b046096a3cc36b2ccb3f4759d02

SHA512
5d35b55a3d67e9b6fdfb2e86750bec470aaa702e72e2e146479085647fe07f22097a7bf98ed9513f93ee2ecbde3f01edc0063252897079966011245ca09f1129

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1045187b33ab690615e6f434eea492e4

SHA1
b7b850b6ec58c29d6c1319cd2b1c550dca0f086d

SHA256
51f72c22f574bbb84df0e82da8c62603e0deeadf1137fc644b03900e0d48663a

SHA512
ad56c16450dffca79907ea1ca3fa650319050c0893134fd8bd180e6fadb3e6075a59b3cec27bfa279ba01aceb9dd603d7df9527be494f20d4959a01985595e99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
de8feef81f5d186fd20519176b0c67d2

SHA1
abfa27619acda4532c9727670df36fcee30d9ea0

SHA256
e39b9c341b919e1659a15aa0a3c35b3d19920b4c739b16da4741d049e33807fb

SHA512
6a4456d2790e6634d2a671dd45e378277dcf2b69321ba0ac48dfdd5f2da82a84804216d1d25c7cfe19d473f3b021ab30047c0fc2a5d1e6002ae66fab652af796

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fc22171abef1d8b75b7cd53fe00f0a15

SHA1
a556a14d8afbca374bf23341d6a32187c462175d

SHA256
efc45787dcb2869e0a8f09a5663529bb398e54edfbaf94b76fa7c678b6f2e20b

SHA512
5ef4ea31f00bb6cad160ed1e1a8c9ba997009971ca02ddf104925746094774a69aacebf749722a9a72d7da58847ab2d39c605bd493ecdf1a6cea112c123d67d5

Download Submit