e8b74012ddc261edb1efc1489604f227fe7fd2a7065453f1c359e9f6ee23c80b

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13-03-2024 05:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c511bb764dece43602beb7ee456e6c92.html
Size

31KB
MD5

c511bb764dece43602beb7ee456e6c92
SHA1

c2755653cbf25f63d55a4faa61140a8f81d2b081
SHA256

e8b74012ddc261edb1efc1489604f227fe7fd2a7065453f1c359e9f6ee23c80b
SHA512

eedc6871ed3c23923986b496588135f3ebb991b46a15f89de1c480ffe8c3eff0a7ef4f4b7e50d792b1e957b99a56436cfa5046407eef340c0013abde60ded211
SSDEEP

384:9FQKumPjbT0IO3C/JIr/fpz2/I0k2xVMWHyuiOhpWHJyem+aWC/+k0LunzQvtxZ2:9Fprb/yWHyXO/WH0+MM3n2uM

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1444	msedge.exe
1444	msedge.exe
2956	msedge.exe
2956	msedge.exe
2732	identity_helper.exe
2732	identity_helper.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 3920	2956	msedge.exe	90
PID 2956 wrote to memory of 3920	2956	msedge.exe	90
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 4528	2956	msedge.exe	91
PID 2956 wrote to memory of 1444	2956	msedge.exe	92
PID 2956 wrote to memory of 1444	2956	msedge.exe	92
PID 2956 wrote to memory of 1860	2956	msedge.exe	93
PID 2956 wrote to memory of 1860	2956	msedge.exe	93
PID 2956 wrote to memory of 1860	2956	msedge.exe	93
PID 2956 wrote to memory of 1860	2956	msedge.exe	93
PID 2956 wrote to memory of 1860	2956	msedge.exe	93
PID 2956 wrote to memory of 1860	2956	msedge.exe	93
PID 2956 wrote to memory of 1860	2956	msedge.exe	93
PID 2956 wrote to memory of 1860	2956	msedge.exe	93
PID 2956 wrote to memory of 1860	2956	msedge.exe	93
PID 2956 wrote to memory of 1860	2956	msedge.exe	93
PID 2956 wrote to memory of 1860	2956	msedge.exe	93
PID 2956 wrote to memory of 1860	2956	msedge.exe	93
PID 2956 wrote to memory of 1860	2956	msedge.exe	93
PID 2956 wrote to memory of 1860	2956	msedge.exe	93
PID 2956 wrote to memory of 1860	2956	msedge.exe	93
PID 2956 wrote to memory of 1860	2956	msedge.exe	93
PID 2956 wrote to memory of 1860	2956	msedge.exe	93
PID 2956 wrote to memory of 1860	2956	msedge.exe	93
PID 2956 wrote to memory of 1860	2956	msedge.exe	93
PID 2956 wrote to memory of 1860	2956	msedge.exe	93

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c511bb764dece43602beb7ee456e6c92.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd616a46f8,0x7ffd616a4708,0x7ffd616a4718
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,16229591642137044327,16765360352756901150,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,16229591642137044327,16765360352756901150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,16229591642137044327,16765360352756901150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16229591642137044327,16765360352756901150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16229591642137044327,16765360352756901150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16229591642137044327,16765360352756901150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16229591642137044327,16765360352756901150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,16229591642137044327,16765360352756901150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,16229591642137044327,16765360352756901150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16229591642137044327,16765360352756901150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16229591642137044327,16765360352756901150,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16229591642137044327,16765360352756901150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2060 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16229591642137044327,16765360352756901150,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,16229591642137044327,16765360352756901150,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5016 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\682c46d9-0886-4858-9a04-192a8145ea6e.tmp

Filesize
11KB

MD5
2872d09f6002f5026049d0f857032bf9

SHA1
bba4bed967d8e8687c1fbba3c40eb18adc74d1a2

SHA256
3b47d33ab494bcbf44a6027c033c2d014efc6a917a7a7eda13a2a674586e61cd

SHA512
d8687f51af0eb0571336e50a342d92e57e89abcc714eabec0be0c3d2bf150b2f461c897bca5da70ed7fc6d91183e7467ec04b048cbe6f14d591bc4acdf4c68e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
73c8d54f775a1b870efd00cb75baf547

SHA1
33024c5b7573c9079a3b2beba9d85e3ba35e6b0e

SHA256
1ce86be0476a2a9e409fcb817126285bc4ad83efd03ee06a2f86910fe18d4d94

SHA512
191344f5830cfea68499bd49073ffa7215a42265a9629d203d07849b2417c0ffdbdbf288bf2c669e91009a0d7e8bd6a6b378c92fc283049141231ca7bf4da3b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b206e54d55dcb61072236144d1f90f8

SHA1
c2600831112447369e5b557e249f86611b05287d

SHA256
87bf9a4c3564eb3d8bef70450da843ae6003271222734c4d28d9961c52782e0b

SHA512
c9e8d2452368873e0622b002a0c2f8a2714b5897a09475738a9f9740122d716a9f0d3841725230d58e039564c820d32a6f3a675a7bb04bd163bab53dcb4e22f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
50837530027a5da5a27b8a2fce4dead7

SHA1
7ee7ccb6df87b7d87c4c739910f04956346e4ac5

SHA256
0cbe72be8d0f97839ada6c6dca78b9311c0f62a815b83f3958c7dffe958f8098

SHA512
89e71fe4f55e0a1efb1263700c4d6bd51308482f076d55bc3039b18ed508ce352561e236fa7a1ea3c4414d022dc7c5c85ce8d80596af6b8cc2132c31b5bff096

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
407B

MD5
1a3cab70784b3cd3e281fb884bf66264

SHA1
a01f36f2920a2b295d0b46213cbcf4b1ae80436d

SHA256
5fd822c214ba921049558f43e686f53ee5456d07915c0134337c572a008f9ddf

SHA512
60fbd40a5d46e312cb99074ba92259e9e147dbb8265b34987ca7045e274fe966129cc7beced4c9ff555d11bb0b58730efc9ad48e49254324a5a06301b2f9be50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c30b3dfb8aaa86ad3c553547e16ea5df

SHA1
f7eca7792f40c5cb815ed3fca04200d2d512868c

SHA256
18168afd9323696c7fcf38f36ebd1fa286a6a1a6b2d4bb9774104ab716aa00f3

SHA512
7da56b09a64553e1c0eca2560f63b756a301cf23dbd4192282bba1ccf2e30d42590b771adb6de038514bf73cb1f0cad8acac7e0d5566f7838caad3f225290b00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0776e80fd8bfd6b107207095652f3148

SHA1
d2fa04c05a4a6f7f5b4d717fdb2d29bedf27e62e

SHA256
fc9a0029f6eadeaac4b867c6d88a2f438e5d2dc13cbe66507ff00af3115e82f9

SHA512
194c3d0f6c2fdba110611443635636c6c4abfce47b7ea01253f9bd792d55db6f940b4075e7c3894f5b46a3e3d097718c870ba9429779d5dced33e39325ce576c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit