e0025546bcc896c9d158e9231903413c6e1b850d119e295d83ba32e808a4d71c

Analysis

max time kernel
158s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 00:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c48dffbc599447192225a409ec3f2223.html
Size

10KB
MD5

c48dffbc599447192225a409ec3f2223
SHA1

a268ef89fccb656a8229d79ddc730e2a5c981d48
SHA256

e0025546bcc896c9d158e9231903413c6e1b850d119e295d83ba32e808a4d71c
SHA512

1305352621f0693856f1229c94688dd6bbeefcbdd03c53ad5ea6ce3a7b320ee512c06785be07b0789806e2d6d1ecbcfbbe5ee12d19b0dbfc697cf435e1769136
SSDEEP

96:uzVs+ux7gULLY1k9o84d12ef7CSTUkGT/kvSxp5DnQ7Yog+gQ30lVHcEZ7ru7f:csz7gUAYS/BaN6+n1PHb76f

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
2056	msedge.exe
2056	msedge.exe
4316	identity_helper.exe
4316	identity_helper.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 4132	2056	msedge.exe	89
PID 2056 wrote to memory of 4132	2056	msedge.exe	89
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 1040	2056	msedge.exe	90
PID 2056 wrote to memory of 5100	2056	msedge.exe	91
PID 2056 wrote to memory of 5100	2056	msedge.exe	91
PID 2056 wrote to memory of 4820	2056	msedge.exe	92
PID 2056 wrote to memory of 4820	2056	msedge.exe	92
PID 2056 wrote to memory of 4820	2056	msedge.exe	92
PID 2056 wrote to memory of 4820	2056	msedge.exe	92
PID 2056 wrote to memory of 4820	2056	msedge.exe	92
PID 2056 wrote to memory of 4820	2056	msedge.exe	92
PID 2056 wrote to memory of 4820	2056	msedge.exe	92
PID 2056 wrote to memory of 4820	2056	msedge.exe	92
PID 2056 wrote to memory of 4820	2056	msedge.exe	92
PID 2056 wrote to memory of 4820	2056	msedge.exe	92
PID 2056 wrote to memory of 4820	2056	msedge.exe	92
PID 2056 wrote to memory of 4820	2056	msedge.exe	92
PID 2056 wrote to memory of 4820	2056	msedge.exe	92
PID 2056 wrote to memory of 4820	2056	msedge.exe	92
PID 2056 wrote to memory of 4820	2056	msedge.exe	92
PID 2056 wrote to memory of 4820	2056	msedge.exe	92
PID 2056 wrote to memory of 4820	2056	msedge.exe	92
PID 2056 wrote to memory of 4820	2056	msedge.exe	92
PID 2056 wrote to memory of 4820	2056	msedge.exe	92
PID 2056 wrote to memory of 4820	2056	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c48dffbc599447192225a409ec3f2223.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb93fd46f8,0x7ffb93fd4708,0x7ffb93fd4718
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,4509522042032945491,3135043239636422794,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,4509522042032945491,3135043239636422794,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,4509522042032945491,3135043239636422794,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4509522042032945491,3135043239636422794,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4509522042032945491,3135043239636422794,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,4509522042032945491,3135043239636422794,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,4509522042032945491,3135043239636422794,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4509522042032945491,3135043239636422794,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4509522042032945491,3135043239636422794,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4509522042032945491,3135043239636422794,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4509522042032945491,3135043239636422794,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,4509522042032945491,3135043239636422794,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1868 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fd7944a4ff1be37517983ffaf5700b11

SHA1
c4287796d78e00969af85b7e16a2d04230961240

SHA256
b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

SHA512
28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
79519708d9977b4d343000a5390bec5b

SHA1
9112e713d6e673b513615eafe4e3c85c25cbac81

SHA256
641ec0aeb9e54a1e3930a23efe0df3c0d1ec29a7c44a8e506eb4920650a68a86

SHA512
67c18e998069d8f249c59f158983824ca46c5a409a820c74d12b6bcf3264de8cb16f9b934c63cabd2a942aaf6709527c0cfc447b3ea293a153a39bb44f527061

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fe6c48b6a36cbebbd6f8fe33cba1bd4f

SHA1
6bb7a4617d13d14969959c017589bd1894ad3e53

SHA256
bbaebec0fbd21cc82a8b1c298f63b02fc642a50b2d26a5a59e42ea714941c088

SHA512
46ba2a08b60de6292f6ee7ef4e8b5481f468556f0a8d8760cf7224bf3e327a7ea033428c3268b528f28e0f32eb5ee860f99320caf8fcaa10c76ad122a0c0d47a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c6bb6e16461b9ddf30f26ffb9b0cefdf

SHA1
c14a4d5307aa99db754c829e17cd338e0a3a20a3

SHA256
43de751d29f600abeca3133cf4f460a1ff6e30cfecac9594d163b04e2ae0a197

SHA512
9242968d80e19927618ce092143154af6f64c25e7a8fef4f927a5f5967d777e9163bad1f7f15bcb9c9a3c76117d0b50f8c63325b20f5e1f620da3a0f7377a636

Download Submit