dd3f9239c8e5247f6c0f614c3e2045ca4b1c3905b2b2cac142a4f89ab59b2c23

Analysis

max time kernel
147s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c74f3c6fdad05fe5407ea766497477c3.html
Size

13KB
MD5

c74f3c6fdad05fe5407ea766497477c3
SHA1

55941fc1d383e77a7622a3527e045160f199ce0b
SHA256

dd3f9239c8e5247f6c0f614c3e2045ca4b1c3905b2b2cac142a4f89ab59b2c23
SHA512

a132ce0a14293cb0642e233d392d59d3083270ac55f6347112308870bb3f7cba945ab9c7554000d878b18b1ca3a47b87b5c01bdf276c42172667fb84200c69c0
SSDEEP

384:szlIcyVnjns/guLBkZcnY1DA70amzguLZ:Sgh6t6xLZ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2388	msedge.exe
2388	msedge.exe
576	msedge.exe
576	msedge.exe
2892	identity_helper.exe
2892	identity_helper.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe
576	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 576 wrote to memory of 64	576	msedge.exe	88
PID 576 wrote to memory of 64	576	msedge.exe	88
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2212	576	msedge.exe	89
PID 576 wrote to memory of 2388	576	msedge.exe	90
PID 576 wrote to memory of 2388	576	msedge.exe	90
PID 576 wrote to memory of 4568	576	msedge.exe	91
PID 576 wrote to memory of 4568	576	msedge.exe	91
PID 576 wrote to memory of 4568	576	msedge.exe	91
PID 576 wrote to memory of 4568	576	msedge.exe	91
PID 576 wrote to memory of 4568	576	msedge.exe	91
PID 576 wrote to memory of 4568	576	msedge.exe	91
PID 576 wrote to memory of 4568	576	msedge.exe	91
PID 576 wrote to memory of 4568	576	msedge.exe	91
PID 576 wrote to memory of 4568	576	msedge.exe	91
PID 576 wrote to memory of 4568	576	msedge.exe	91
PID 576 wrote to memory of 4568	576	msedge.exe	91
PID 576 wrote to memory of 4568	576	msedge.exe	91
PID 576 wrote to memory of 4568	576	msedge.exe	91
PID 576 wrote to memory of 4568	576	msedge.exe	91
PID 576 wrote to memory of 4568	576	msedge.exe	91
PID 576 wrote to memory of 4568	576	msedge.exe	91
PID 576 wrote to memory of 4568	576	msedge.exe	91
PID 576 wrote to memory of 4568	576	msedge.exe	91
PID 576 wrote to memory of 4568	576	msedge.exe	91
PID 576 wrote to memory of 4568	576	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c74f3c6fdad05fe5407ea766497477c3.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeab8346f8,0x7ffeab834708,0x7ffeab834718
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,5406665167537710052,14520387623625702732,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,5406665167537710052,14520387623625702732,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,5406665167537710052,14520387623625702732,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5406665167537710052,14520387623625702732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5406665167537710052,14520387623625702732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5406665167537710052,14520387623625702732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,5406665167537710052,14520387623625702732,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,5406665167537710052,14520387623625702732,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5406665167537710052,14520387623625702732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5406665167537710052,14520387623625702732,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5406665167537710052,14520387623625702732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,5406665167537710052,14520387623625702732,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,5406665167537710052,14520387623625702732,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5832 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fd7944a4ff1be37517983ffaf5700b11

SHA1
c4287796d78e00969af85b7e16a2d04230961240

SHA256
b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

SHA512
28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
22c925d9dc5dc0b3ce0d37f8c6f4ba34

SHA1
dc2dbad21728d9b7be713396810b96fced0e8d75

SHA256
7f62c876b7c9085e1c183ecd53f1cf534ad4438ac80e0732641347b95719bd80

SHA512
21f4cbeb608942c7fd92b6ebf0a156521c12b86fac760314254d23caa43a6a648983b66dd9dc14a0f2d11a6d3133a3eb227a2a96821bff6bfbd9790148d78f30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d60a97f810227335a453d6f26e368424

SHA1
c603a3e5d72e6c9380053c772468dcec1a30f4ca

SHA256
9a263fe1bf2386452b3c13f96f40cf4b97d83df7c7777f5294ad20a06404c2e9

SHA512
7f51a7e36d3bb6c5351a945d97c183b9b0520c2951614e9dcde47ad6c3b081139711d16c7edc84d35950d6c34f095926cca6a1c7cff958c6837624eb0f3a9c28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3d92b33504b8c264dbf6281edbd756e3

SHA1
488d435c0961e1fa556078ab6862f26cad9bfc40

SHA256
4a9603dab03615a5d70e6bed8b82d5ac02f7f86cea8f8b0b8c9f28aa29951dd9

SHA512
e4894cf62cebf57317533ca05940724ca4bced3d21a4efd138a46ee873848539135118a2bea86e647e08cb2d2f4320c4bab910d40606420d8db5dc2d690926f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c2321c07bb2b92324f831a63a4ad03de

SHA1
4972a27d17c9409751845fa2fe7e676bfa42c9e8

SHA256
b5fc86261e524327e4e76ad95f8650d7216374da50112e2e970ca26b6b5bdeb5

SHA512
55bad15ed7daf5d9016a2b0d17af5d5ae782083ad6b9d1f79f6c4c1c490b4a8b8013c3b97c1711122f10f2177b8f2bc95eea6bf4ddf45caa018203c1546f6e72

Download Submit