e018f77842490c1f3608d84b21361af63ba3fe5fe8a1e029341e10272d4c1f1d

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14-03-2024 05:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7d0d7b6b81483cb8a893d36e4fa86f8.html
Size

53KB
MD5

c7d0d7b6b81483cb8a893d36e4fa86f8
SHA1

a2d9b42088ea0751184fca799ecf8c8cb0441746
SHA256

e018f77842490c1f3608d84b21361af63ba3fe5fe8a1e029341e10272d4c1f1d
SHA512

aa9798a444761be1f6cc4dc8663d4994224239029262ee6f47ac9abd3b3c5d5d7c35988f8a1b001b4ea6cad34bb001e4aa3dcee878887e5dee95ef3095ecdb7b
SSDEEP

1536:CkgUiIakTqGivi+PyU3runlY863Nj+q5VyvR0w2AzTICbbloB/t9M/dNwIUTDmDX:CkgUiIakTqGivi+PyU3runlY863Nj+qk

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
4780	msedge.exe
4780	msedge.exe
3068	identity_helper.exe
3068	identity_helper.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe
2204	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 3352	4780	msedge.exe	88
PID 4780 wrote to memory of 3352	4780	msedge.exe	88
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4720	4780	msedge.exe	89
PID 4780 wrote to memory of 4320	4780	msedge.exe	90
PID 4780 wrote to memory of 4320	4780	msedge.exe	90
PID 4780 wrote to memory of 4388	4780	msedge.exe	91
PID 4780 wrote to memory of 4388	4780	msedge.exe	91
PID 4780 wrote to memory of 4388	4780	msedge.exe	91
PID 4780 wrote to memory of 4388	4780	msedge.exe	91
PID 4780 wrote to memory of 4388	4780	msedge.exe	91
PID 4780 wrote to memory of 4388	4780	msedge.exe	91
PID 4780 wrote to memory of 4388	4780	msedge.exe	91
PID 4780 wrote to memory of 4388	4780	msedge.exe	91
PID 4780 wrote to memory of 4388	4780	msedge.exe	91
PID 4780 wrote to memory of 4388	4780	msedge.exe	91
PID 4780 wrote to memory of 4388	4780	msedge.exe	91
PID 4780 wrote to memory of 4388	4780	msedge.exe	91
PID 4780 wrote to memory of 4388	4780	msedge.exe	91
PID 4780 wrote to memory of 4388	4780	msedge.exe	91
PID 4780 wrote to memory of 4388	4780	msedge.exe	91
PID 4780 wrote to memory of 4388	4780	msedge.exe	91
PID 4780 wrote to memory of 4388	4780	msedge.exe	91
PID 4780 wrote to memory of 4388	4780	msedge.exe	91
PID 4780 wrote to memory of 4388	4780	msedge.exe	91
PID 4780 wrote to memory of 4388	4780	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c7d0d7b6b81483cb8a893d36e4fa86f8.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd385346f8,0x7ffd38534708,0x7ffd38534718
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,17950292167657066397,17256342860314449944,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,17950292167657066397,17256342860314449944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,17950292167657066397,17256342860314449944,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17950292167657066397,17256342860314449944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17950292167657066397,17256342860314449944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3128 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17950292167657066397,17256342860314449944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,17950292167657066397,17256342860314449944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,17950292167657066397,17256342860314449944,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17950292167657066397,17256342860314449944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17950292167657066397,17256342860314449944,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17950292167657066397,17256342860314449944,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17950292167657066397,17256342860314449944,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,17950292167657066397,17256342860314449944,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1260 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
47b2c6613360b818825d076d14c051f7

SHA1
7df7304568313a06540f490bf3305cb89bc03e5c

SHA256
47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac

SHA512
08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e0811105475d528ab174dfdb69f935f3

SHA1
dd9689f0f70a07b4e6fb29607e42d2d5faf1f516

SHA256
c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c

SHA512
8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
402B

MD5
35e84ae835b0608a0ff7a08dad1b77a3

SHA1
262db3268fe80303e74a1afecbe17e1cfc3453e5

SHA256
0b4dec753c1dd7ab389ee34561d862a26c3f4ab87ac5b4a8cc11781b5d8a84ee

SHA512
40a8a80118261ba65fcc08080e039c0a59d590980ecb0ae2bd8dd181ab6e8a1969c6c54723c4de91da3ed4741d91d96866dcbdf2deadd9fd2d46d1152203fc15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
912d344ca3a1f022c2df808e3ccbabab

SHA1
a6d32d13bab7f486bfe6df94cf194f63effc5e2d

SHA256
12bc963ea46441411a9ff6a4be223fcf9892882dfc957470d91dfa2c50d9afe9

SHA512
0d3d6382143b96be0fb8dc43637c56c319f02b6b562d0868977906dd43c2781e478c89d6c9be8f79179b00f375744a98f51e69d1196ba57554cbd34f677a6798

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
640b7dcb607efe71770a82673032be71

SHA1
ecd7449075c2c09ba52c703a2a49f1dee9e61ef8

SHA256
f2bb6585fcaa14a71d330e4ec3f268844e00cd59b3e827a2fd3e51abcc8dab82

SHA512
251830c6e65f7f905b281ed33b64c665c515001c5ce933fc5ea81111c95eaab8660810f274de6c22e8d57a7ee8b9d1f973d51bb3e9629072ed2c3d1227c0990b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fddd6ec071063d0a8179104a2dd5a130

SHA1
6c864240ab962d09683775930ab36821c2e401fa

SHA256
8bf5f23cd0c8827786397bb032a9420b086cbea86e037357a2bfbb51702447c5

SHA512
6519752d65e69548207decd6762d562dc94133b3dea0761dcf813e9012f262307d9dea244e6e0c7f3ffedb747669a163b8074d890a183d2c70a608fee3083e63

Download Submit