f0200ac9d86b13e6a0b4e1c1cdebca163f3b1c44b05f57a08be37f38141f6d4e

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 08:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c2eca5b7361e3d742673dfbc7b15acb1.html
Size

17KB
MD5

c2eca5b7361e3d742673dfbc7b15acb1
SHA1

64cb7189c03ecffaa8f3c1321a6da2fd39d43f98
SHA256

f0200ac9d86b13e6a0b4e1c1cdebca163f3b1c44b05f57a08be37f38141f6d4e
SHA512

452c8fd6f6f32faecfe6343239f3d8bace8e781e0372600d1be44bb2c04715708b1254270639a23820ec9da544e43755d065932b8bc76bafddd4481a2c50b015
SSDEEP

384:3IkiAiLo04kgmwpaU9jmeHpa4hV6uKbx4AZkzRzyY:3hiJLo04kgmwpaU9j/J/Au2xJoJyY

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
4004	msedge.exe
4004	msedge.exe
2152	identity_helper.exe
2152	identity_helper.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe
4004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 3092	4004	msedge.exe	88
PID 4004 wrote to memory of 3092	4004	msedge.exe	88
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 1856	4004	msedge.exe	89
PID 4004 wrote to memory of 220	4004	msedge.exe	90
PID 4004 wrote to memory of 220	4004	msedge.exe	90
PID 4004 wrote to memory of 4760	4004	msedge.exe	91
PID 4004 wrote to memory of 4760	4004	msedge.exe	91
PID 4004 wrote to memory of 4760	4004	msedge.exe	91
PID 4004 wrote to memory of 4760	4004	msedge.exe	91
PID 4004 wrote to memory of 4760	4004	msedge.exe	91
PID 4004 wrote to memory of 4760	4004	msedge.exe	91
PID 4004 wrote to memory of 4760	4004	msedge.exe	91
PID 4004 wrote to memory of 4760	4004	msedge.exe	91
PID 4004 wrote to memory of 4760	4004	msedge.exe	91
PID 4004 wrote to memory of 4760	4004	msedge.exe	91
PID 4004 wrote to memory of 4760	4004	msedge.exe	91
PID 4004 wrote to memory of 4760	4004	msedge.exe	91
PID 4004 wrote to memory of 4760	4004	msedge.exe	91
PID 4004 wrote to memory of 4760	4004	msedge.exe	91
PID 4004 wrote to memory of 4760	4004	msedge.exe	91
PID 4004 wrote to memory of 4760	4004	msedge.exe	91
PID 4004 wrote to memory of 4760	4004	msedge.exe	91
PID 4004 wrote to memory of 4760	4004	msedge.exe	91
PID 4004 wrote to memory of 4760	4004	msedge.exe	91
PID 4004 wrote to memory of 4760	4004	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c2eca5b7361e3d742673dfbc7b15acb1.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb55f46f8,0x7ffcb55f4708,0x7ffcb55f4718
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,15923728531671335038,14483509908877663659,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,15923728531671335038,14483509908877663659,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,15923728531671335038,14483509908877663659,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15923728531671335038,14483509908877663659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15923728531671335038,14483509908877663659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,15923728531671335038,14483509908877663659,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,15923728531671335038,14483509908877663659,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15923728531671335038,14483509908877663659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15923728531671335038,14483509908877663659,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15923728531671335038,14483509908877663659,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15923728531671335038,14483509908877663659,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,15923728531671335038,14483509908877663659,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4820 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f35bb0615bb9816f562b83304e456294

SHA1
1049e2bd3e1bbb4cea572467d7c4a96648659cb4

SHA256
05e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71

SHA512
db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1eb86108cb8f5a956fdf48efbd5d06fe

SHA1
7b2b299f753798e4891df2d9cbf30f94b39ef924

SHA256
1b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40

SHA512
e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d7c403147b23944bc761c08ddbe322a4

SHA1
8eb4b48f5586316956160b73da158a363eaec664

SHA256
f2a0c352bd47fcccf3239820c0a7abc5848460a5a0f84dca4205944bf510162c

SHA512
e7207983218ba36f708cfbd94d8d00e66f5836f6aefeb3d73f3946b29c808876d1e23d17a99fbf372e6d731956fc4d62978b27b6266be6749e77fb792a56258c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f494da9124ed49e827d062dc881dd117

SHA1
21a3c85f87320e597c272e95decf9fd2b86400f4

SHA256
71d9acd724300121c5110e3947fb525be886f828a958b2707917b3e79c564700

SHA512
d33964422e59595d1a1f0460ddc618d1fa406e723ecb93c70cc29cd3b36e6bcfa1a1b37b8d20a765c69d484195a8d4753b8415a9f7f7607adca583d405824afb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eccada594361226fcee5f470d898924e

SHA1
97808416b954d727f58173e24d954d9c7d0cfb24

SHA256
9988b52f4b5c7712584865724b8a4ee9ce16a93a2eda6bcf77bcf5e4d2d9aa76

SHA512
e4f2755cb9dff1c814031ce23639a37db90ac35369ab54e6a5d0371e37e97614bc4145f39428c3bfa8847863962141ff6a2ae426d6fca0ba0ac4e515198c7f4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7b3f0ccbee21b9a743e686564c0b3f29

SHA1
5a9994203aa041061c447084361bb46d32f76dde

SHA256
85ed892396d75873695c4222cc4159e9563ce59963e7d4fbdedd6bda31e19756

SHA512
7f167e1df92c2f3b18d766eb05960d953b51ffd3f1737292975c113f76c4da273ead4173d19e607f0e2f7dbd93005d83db186a95cf21be8c1cbc5f2f93c353bf

Download Submit