Analysis
- max time kernel
146s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
12/03/2024, 07:54
Static task
static1
Behavioral task
behavioral1
Sample
c2d8fbe2ddf0a1ad05b8b4e431601e64.html
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
c2d8fbe2ddf0a1ad05b8b4e431601e64.html
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target c2d8fbe2ddf0a1ad05b8b4e431601e64.html
- Size 81KB
- Sample240312-jry5eaca9v
- SHA256 02437b906c9be317d5819aa8c25b6d44b36dabf5160616dc8c2c3c6b7ef275cc
- MD5 c2d8fbe2ddf0a1ad05b8b4e431601e64
- SHA1 9076345bb13946264bcea73b42fc3f5814576df9
- SHA512 9c05a811d98d4e386147830b854c529cf70996c3483e5f7bb94898745acc166d7381a6e9137931408e2dca762e2b1210b716ef6f59390892bda04b0eee99824e
- SSDEEP 1536:CJCx8mRktlodohWvy+odohxG25C6tMsIcWd:CsOlodohWvy+odohxG25C6tMsIcWd
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 5044 msedge.exe 5044 msedge.exe 3596 msedge.exe 3596 msedge.exe 3280 msedge.exe 3280 msedge.exe 3280 msedge.exe 3280 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3596 msedge.exe 3596 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3596 wrote to memory of 3536 3596 msedge.exe 89 PID 3596 wrote to memory of 3536 3596 msedge.exe 89 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 4380 3596 msedge.exe 90 PID 3596 wrote to memory of 5044 3596 msedge.exe 91 PID 3596 wrote to memory of 5044 3596 msedge.exe 91 PID 3596 wrote to memory of 4168 3596 msedge.exe 92 PID 3596 wrote to memory of 4168 3596 msedge.exe 92 PID 3596 wrote to memory of 4168 3596 msedge.exe 92 PID 3596 wrote to memory of 4168 3596 msedge.exe 92 PID 3596 wrote to memory of 4168 3596 msedge.exe 92 PID 3596 wrote to memory of 4168 3596 msedge.exe 92 PID 3596 wrote to memory of 4168 3596 msedge.exe 92 PID 3596 wrote to memory of 4168 3596 msedge.exe 92 PID 3596 wrote to memory of 4168 3596 msedge.exe 92 PID 3596 wrote to memory of 4168 3596 msedge.exe 92 PID 3596 wrote to memory of 4168 3596 msedge.exe 92 PID 3596 wrote to memory of 4168 3596 msedge.exe 92 PID 3596 wrote to memory of 4168 3596 msedge.exe 92 PID 3596 wrote to memory of 4168 3596 msedge.exe 92 PID 3596 wrote to memory of 4168 3596 msedge.exe 92 PID 3596 wrote to memory of 4168 3596 msedge.exe 92 PID 3596 wrote to memory of 4168 3596 msedge.exe 92 PID 3596 wrote to memory of 4168 3596 msedge.exe 92 PID 3596 wrote to memory of 4168 3596 msedge.exe 92 PID 3596 wrote to memory of 4168 3596 msedge.exe 92
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c2d8fbe2ddf0a1ad05b8b4e431601e64.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb087046f8,0x7ffb08704708,0x7ffb087047182⤵PID:3536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,385056619014879403,9231860191236434453,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 /prefetch:22⤵PID:4380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,385056619014879403,9231860191236434453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,385056619014879403,9231860191236434453,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:82⤵PID:4168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,385056619014879403,9231860191236434453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:2496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,385056619014879403,9231860191236434453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,385056619014879403,9231860191236434453,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4856 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3280
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4292
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:652
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 1ce86be0476a2a9e409fcb817126285bc4ad83efd03ee06a2f86910fe18d4d94
- MD5 73c8d54f775a1b870efd00cb75baf547
- SHA1 33024c5b7573c9079a3b2beba9d85e3ba35e6b0e
- SHA512 191344f5830cfea68499bd49073ffa7215a42265a9629d203d07849b2417c0ffdbdbf288bf2c669e91009a0d7e8bd6a6b378c92fc283049141231ca7bf4da3b8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 87bf9a4c3564eb3d8bef70450da843ae6003271222734c4d28d9961c52782e0b
- MD5 4b206e54d55dcb61072236144d1f90f8
- SHA1 c2600831112447369e5b557e249f86611b05287d
- SHA512 c9e8d2452368873e0622b002a0c2f8a2714b5897a09475738a9f9740122d716a9f0d3841725230d58e039564c820d32a6f3a675a7bb04bd163bab53dcb4e22f2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9cc93f41-483c-4829-9168-5046227b2146.tmp
- Size 942B
- SHA256 20eaa0569c2e5edb9fe2d5e9e6ce67a54c4802800309c82f724e823a923143e4
- MD5 37daa4ba514cd0b6d6bbb82b90614079
- SHA1 b2d720805779b702515451b07d7844333b4affb6
- SHA512 1a894062c41ce420bf985f6651d70a95704cba61a99cdf7c29e8d4b7e6a75f48a48db116cd8445e95c35e53e8b342c9511bdc8be17832a37ead4b692ebb240b1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 973B
- SHA256 49004b786f356471eca2d7b2c24289edcd16eafe7b3d7fcd5fbf2cb3cf15d138
- MD5 2a9c4d6da3d510c282b44f3b7b00eb5a
- SHA1 743c3810d037968ad7f06c3a4fc6434f35597cc0
- SHA512 109d240ba6d3eaf34b89e065e0ad2317564a1328e534e40d31152a9ccd735ff4f35b04bbdebdcf475fb5c47aa3da38fa1651f4c513879fc00df09a3d1386a921
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 aaa391d6a257523574d4f2c924067ff85aca03ca3c00c93873ab9cf0829a196e
- MD5 3e4454ab5965d99c15c8e78b18325b9e
- SHA1 cce141e4c977f01dc1d6edab0cad49e516ebc00e
- SHA512 4dbbd0d998958eca0578ab689ad09a2bb682e831ac3d9738f4964cfd19a8db14a12b2f77cdffc8d3d87d1d716c0e28fc989bac201d67436e4fcb200e62acf9f7
- SSDEEP 96:nckkQY1NSowpvWMoiVmdeNJZEcffGfX2DMXUWQyV+VD7AiEwb:nckCbzGWMdJZEcffGfX2arg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 204b2a620982877d02963b366d1c3acdc7d4fe411c55e7e302138f1d700ed1aa
- MD5 4d5c9457e09ea68b840ec6386a44a060
- SHA1 15e493cb399a59b03008aa64f0e82eebebc8571c
- SHA512 d6dac515426555deba95eb4c8e5d942ff053c1499e45a9d3424941f030ac28c7ea411cdc3e3b58d7b2ff261f687214994cd578ccb1cc5e915923a20bb72508dc
- SSDEEP 96:nckZQY1NSowpvWMoiVmdeHDMXUWQyV+VD7ziEwb:nckZbzGWMXart
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 7KB
- SHA256 e86824e15334bbc35186203560f35d4cbe64af2b4b8071a158b84937027556fb
- MD5 d2b4f12f117c69183b43d054bc61d4f4
- SHA1 9b3770e37540973dadced9c378ade92a09b663f2
- SHA512 d019cdeda62c3c39a09458516d7cad44ea4ef583686f8e4144bf04564852b5f7b89c918e4b5f7bd942e2cfb9cc8175bc83f02482a0546f41a290ed1f14e3e4a8
- SSDEEP 96:nckkQY1NW7owpvWMoiVmdeNJZEcffGfpxfLhLCvFq2DMXUWQyV+VD7AiEwb:nckCbbGWMdJZEcffGfjfLov82arg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 6a26afcaeefd7fafee9dfd04a382b4e971eecc86c2aa84ed8c1f2195fa122e3b
- MD5 b96c09737515a3320bdeb6fca8646d58
- SHA1 536688e891887a339cdb66c8af4508a291c76071
- SHA512 0a6778376d81d3f8170f32f23d67a0024f2ee4ccdcbcea4ccfcb188ea62ca530a38082a479babcfe83d1008b21a3cd47be659591d897b9440e7c8010a438ab7c
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupjrYe2RUv/+bpe9xUX1MPes:A9iIxuERzA83h09RZxY/WW6e9E1MeuB3
- MD5 SHA1 SHA512 SSDEEP