Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
14/03/2024, 00:03
Static task
static1
Behavioral task
behavioral1
Sample
c72f55ec973cc3df36d89ce0a89b4487.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
c72f55ec973cc3df36d89ce0a89b4487.html
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target c72f55ec973cc3df36d89ce0a89b4487.html
- Size 11KB
- Sample240314-acfvvafg63
- SHA256 dc6fe35e1fbc15b972bd53cf077e61c8f5df30c0411ddd98b8b7f18e3551b751
- MD5 c72f55ec973cc3df36d89ce0a89b4487
- SHA1 dcd7d0077a59310db8b3a8d6e2418e17cfcd2419
- SHA512 32b9eed79c1c9e712f8bd94bf1a8b14c9039cbf05a5bad569d9cc9311f33a786d3f1ed3a0ce34467f02c0d9d1ac50635a0c0c27a48ae3067e80731cbe1685dc0
- SSDEEP 192:2V4lIsr03MN8k/w1wvqyVBrGnqfRK2t01bAuBuLbdU8d:s4lIcuMv/gcVBrGnqfRK2t0bAguLZ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1604 msedge.exe 1604 msedge.exe 5000 msedge.exe 5000 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe 5000 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5000 wrote to memory of 3440 5000 msedge.exe 90 PID 5000 wrote to memory of 3440 5000 msedge.exe 90 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 548 5000 msedge.exe 91 PID 5000 wrote to memory of 1604 5000 msedge.exe 92 PID 5000 wrote to memory of 1604 5000 msedge.exe 92 PID 5000 wrote to memory of 1228 5000 msedge.exe 93 PID 5000 wrote to memory of 1228 5000 msedge.exe 93 PID 5000 wrote to memory of 1228 5000 msedge.exe 93 PID 5000 wrote to memory of 1228 5000 msedge.exe 93 PID 5000 wrote to memory of 1228 5000 msedge.exe 93 PID 5000 wrote to memory of 1228 5000 msedge.exe 93 PID 5000 wrote to memory of 1228 5000 msedge.exe 93 PID 5000 wrote to memory of 1228 5000 msedge.exe 93 PID 5000 wrote to memory of 1228 5000 msedge.exe 93 PID 5000 wrote to memory of 1228 5000 msedge.exe 93 PID 5000 wrote to memory of 1228 5000 msedge.exe 93 PID 5000 wrote to memory of 1228 5000 msedge.exe 93 PID 5000 wrote to memory of 1228 5000 msedge.exe 93 PID 5000 wrote to memory of 1228 5000 msedge.exe 93 PID 5000 wrote to memory of 1228 5000 msedge.exe 93 PID 5000 wrote to memory of 1228 5000 msedge.exe 93 PID 5000 wrote to memory of 1228 5000 msedge.exe 93 PID 5000 wrote to memory of 1228 5000 msedge.exe 93 PID 5000 wrote to memory of 1228 5000 msedge.exe 93 PID 5000 wrote to memory of 1228 5000 msedge.exe 93
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c72f55ec973cc3df36d89ce0a89b4487.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ff9ef2d46f8,0x7ff9ef2d4708,0x7ff9ef2d47182⤵PID:3440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,16470809541830208580,16203484322823308446,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:22⤵PID:548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,16470809541830208580,16203484322823308446,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16470809541830208580,16203484322823308446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3032 /prefetch:12⤵PID:1228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16470809541830208580,16203484322823308446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3044 /prefetch:12⤵PID:1928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,16470809541830208580,16203484322823308446,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3384 /prefetch:82⤵PID:2340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,16470809541830208580,16203484322823308446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4276 /prefetch:12⤵PID:4652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,16470809541830208580,16203484322823308446,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3484 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4524
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:860
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2060
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac
- MD5 47b2c6613360b818825d076d14c051f7
- SHA1 7df7304568313a06540f490bf3305cb89bc03e5c
- SHA512 08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c
- MD5 e0811105475d528ab174dfdb69f935f3
- SHA1 dd9689f0f70a07b4e6fb29607e42d2d5faf1f516
- SHA512 8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 168B
- SHA256 c4287b619829265c6c7aedfac790c0e3d812a019d076d80b4373d77722bcaf0f
- MD5 00bcfb12d6fcc1bc3bb5af4cb1e56574
- SHA1 7ba381b7850d1d565958228e40e825177a60e42e
- SHA512 f44f1ea6ab11685ff5caee46dcfc01c6d8002d57c55b93daa81436260dfb1b73629887c29db9ee2269d440dd4eaa5660e8213a6eec6b66c9c2dbf6aff18b3d35
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
- Size 111B
- SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
- MD5 807419ca9a4734feaf8d8563a003b048
- SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
- SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 d6d7d6c8a301b628f7ce0c3e89649be73a728c1c2191dfb8de0a5277aa5aca8b
- MD5 aa7c934a476ece36c4d301f6f057877f
- SHA1 ead2205daa9c134f59ee2149810c7863a6657758
- SHA512 976e33e85e0d6edca0ca65da3e76bcd2230f52acbacf34f80c8fd23e4df55b6c53dac27c9d14961e6a3d667f472be5d568971e1888d9e1bd57ba00b863ea9cbf
- SSDEEP 96:n0kj81YwwpvWMoiVmdeH0Qrt0BUWQyV+VD7AiEwb:n0kQewGWMXBt0Brg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 71a37d035b671940f8d1ae1d303e7cb7f2b407931a22c82d6edc9006920dd0d7
- MD5 f106b54e47d8f0efed8e4dbc2dd5e5cb
- SHA1 ff139ef769f530cf499d2cf9814b2a4d79ced8e6
- SHA512 14889b632a371111facde5edd828a1b5c800e488e9e974f50189526b8918637d2c9740016f647502b2f057133ab9423b2b046b3ac6039cda6201fd3615752fd5
- SSDEEP 96:n0kI81YUwpvWMoiVmdeH0Qrt0BUWQyV+VD7ziEwb:n0k5eUGWMXBt0Brt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 041d91579f1eb47a61850d829f312d00af1056b2aef8aa35cd82f78691496bf0
- MD5 dc89938409cb7ac1c3d363857c14825d
- SHA1 7ac1c9d801f60fa5785f454a623c55e2e0b38a54
- SHA512 199a10827a3c6a3e4d87f60e6e88e4b6b9a42341dbfc304b39c3e13a6b26b2ba9b9e366215fdbd9e03add194b6f7fc6222aae3beda8cda68cec34fd65803cec6
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup3l2YVe2RUOxbX1S9xUX1Mm:A9iIxuERzA83h09RZxYVLh89E1MeuBO1
- MD5 SHA1 SHA512 SSDEEP