dd82ae54ae911af0db4e3b36d8249d09ccbe53ebe807cf25e8c944be25ea826b

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 10:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c8577b0dfb9e59173421fe935ec010db.html
Size 177KB
Sample240314-l1435abe46
SHA256 dd82ae54ae911af0db4e3b36d8249d09ccbe53ebe807cf25e8c944be25ea826b
MD5 c8577b0dfb9e59173421fe935ec010db
SHA1 f531c1423d4c7ea627502787f5d451249fe1c727
SHA512 c335da28265e9dbe1da41f225c57b4c1d82f3c5b4542f2ad37cdea16a20df3e6b13e8aadb39aa384c716d1a08f5ac5ea47292d81e87282cccf13ea30ecee1191
SSDEEP 3072:SL957QJFySM0yfkMY+BES09JXAnyrZalI+YFrGOiDXev:SL957QJFySM5sMYod+X3oI+YRGDev
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2080	msedge.exe
2080	msedge.exe
4648	msedge.exe
4648	msedge.exe
1536	identity_helper.exe
1536	identity_helper.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4384	4648	msedge.exe	88
PID 4648 wrote to memory of 4384	4648	msedge.exe	88
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 4236	4648	msedge.exe	89
PID 4648 wrote to memory of 2080	4648	msedge.exe	90
PID 4648 wrote to memory of 2080	4648	msedge.exe	90
PID 4648 wrote to memory of 4716	4648	msedge.exe	91
PID 4648 wrote to memory of 4716	4648	msedge.exe	91
PID 4648 wrote to memory of 4716	4648	msedge.exe	91
PID 4648 wrote to memory of 4716	4648	msedge.exe	91
PID 4648 wrote to memory of 4716	4648	msedge.exe	91
PID 4648 wrote to memory of 4716	4648	msedge.exe	91
PID 4648 wrote to memory of 4716	4648	msedge.exe	91
PID 4648 wrote to memory of 4716	4648	msedge.exe	91
PID 4648 wrote to memory of 4716	4648	msedge.exe	91
PID 4648 wrote to memory of 4716	4648	msedge.exe	91
PID 4648 wrote to memory of 4716	4648	msedge.exe	91
PID 4648 wrote to memory of 4716	4648	msedge.exe	91
PID 4648 wrote to memory of 4716	4648	msedge.exe	91
PID 4648 wrote to memory of 4716	4648	msedge.exe	91
PID 4648 wrote to memory of 4716	4648	msedge.exe	91
PID 4648 wrote to memory of 4716	4648	msedge.exe	91
PID 4648 wrote to memory of 4716	4648	msedge.exe	91
PID 4648 wrote to memory of 4716	4648	msedge.exe	91
PID 4648 wrote to memory of 4716	4648	msedge.exe	91
PID 4648 wrote to memory of 4716	4648	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c8577b0dfb9e59173421fe935ec010db.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9208146f8,0x7ff920814708,0x7ff920814718
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,5445295608841539041,7312480569106542779,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,5445295608841539041,7312480569106542779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,5445295608841539041,7312480569106542779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5445295608841539041,7312480569106542779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5445295608841539041,7312480569106542779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,5445295608841539041,7312480569106542779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,5445295608841539041,7312480569106542779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5445295608841539041,7312480569106542779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5445295608841539041,7312480569106542779,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5445295608841539041,7312480569106542779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5445295608841539041,7312480569106542779,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,5445295608841539041,7312480569106542779,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2700 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74
MD5 fd7944a4ff1be37517983ffaf5700b11
SHA1 c4287796d78e00969af85b7e16a2d04230961240
SHA512 28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4
MD5 a774512b00820b61a51258335097b2c9
SHA1 38c28d1ea3907a1af6c0443255ab610dd9285095
SHA512 ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1
MD5 SHA1 SHA512

Submit Download

6824f721-b103-45d1-8dee-6303407d4d99.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6824f721-b103-45d1-8dee-6303407d4d99.tmp
Size 6KB
SHA256 76bbb022fd157ecfb85171956130f3f99c13336329fb84605c1aa008a8bd7818
MD5 9283b1c510f93e87a179bd509806a3d1
SHA1 a196e21d48166c061cf0a0b0f2c6cf945d0edb9d
SHA512 4bb7d92e4e41b39e57d38ab040e18f05c124c5d3b7002d2d6fc54fdbc7c3023306a000b930ccb3cca77261efc1eb2d1b3b95f82cac4065dcff0a063ae79f8588
SSDEEP 96:n6kdwG1zp0wpvWMoiVmdeHI/cUWQyV+VD7AiEwb:n6kGGBp0GWMXXrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9afa8c894c08b33a81fd82823a957ad9ccfd01ab8b51d1b573eca996102bab6f
MD5 baa68ea692fd284da5e7144ee912af77
SHA1 e3e568df531e718f58c1fef9970fbbfaf2d6e21e
SHA512 d0e9cb20203aaacc9d44be811c96bf71d0610881f75c0ca77e69fbcbc6c71194aee9f574ae899dc9c4261f79aff5c486a6a08749482b0a41a1bdb9be3576ee11
SSDEEP 96:n6kGwG1zp0wpvWMoiVmdeHI/cUWQyV+VD7ziEwb:n6kFGBp0GWMXXrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d262738fdd6ba13f6085f1d6e270afa3edf85ac23fcc711c050150f9992736e4
MD5 6bbe2684cedd797a6586c625da02a78c
SHA1 19c83ab5957df6e3e1d0f36e35aea5753615a047
SHA512 d2e9aece75457e7dd409f163c3567c1e7bd2416af0a6d2f49faba762cb7d75bbe1f6b9074a88064fb99fd27f3e7154b3561ae2e3fe7079b99610258ee9558983
SSDEEP 96:n6kdwG1zU0wpvWMoiVmdeHI/cUWQyV+VD7AiEwb:n6kGGBU0GWMXXrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 3ad2eee02992a41c6c47de76851faf527e491db3996647289cb1e78d3013ce58
MD5 9c603f6137aee39c3dac357806ed0873
SHA1 524b719b237507ce34a56db3ceb62fb5405c631e
SHA512 2e8bc55d1e4b6c39a8be1c271e6af39097408616beaef3d0b3e9e8b037c78da4ab8570df1c697cf4f19527f959aa6d397f83721cf0a992264beb87957fcaeb3a
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuphse2RUYbblM9xUX1MPeuue:A9iIxuERzA83h09RZxYwFM9E1MeuBOI7
MD5 SHA1 SHA512 SSDEEP

Submit Download