Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14/03/2024, 10:00
Static task
static1
Behavioral task
behavioral1
Sample
c8577b0dfb9e59173421fe935ec010db.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c8577b0dfb9e59173421fe935ec010db.html
Resource
win10v2004-20240226-en
General
-
Target
c8577b0dfb9e59173421fe935ec010db.html
-
Size
177KB
-
MD5
c8577b0dfb9e59173421fe935ec010db
-
SHA1
f531c1423d4c7ea627502787f5d451249fe1c727
-
SHA256
dd82ae54ae911af0db4e3b36d8249d09ccbe53ebe807cf25e8c944be25ea826b
-
SHA512
c335da28265e9dbe1da41f225c57b4c1d82f3c5b4542f2ad37cdea16a20df3e6b13e8aadb39aa384c716d1a08f5ac5ea47292d81e87282cccf13ea30ecee1191
-
SSDEEP
3072:SL957QJFySM0yfkMY+BES09JXAnyrZalI+YFrGOiDXev:SL957QJFySM5sMYod+X3oI+YRGDev
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2080 msedge.exe 2080 msedge.exe 4648 msedge.exe 4648 msedge.exe 1536 identity_helper.exe 1536 identity_helper.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe 4648 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4648 wrote to memory of 4384 4648 msedge.exe 88 PID 4648 wrote to memory of 4384 4648 msedge.exe 88 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 4236 4648 msedge.exe 89 PID 4648 wrote to memory of 2080 4648 msedge.exe 90 PID 4648 wrote to memory of 2080 4648 msedge.exe 90 PID 4648 wrote to memory of 4716 4648 msedge.exe 91 PID 4648 wrote to memory of 4716 4648 msedge.exe 91 PID 4648 wrote to memory of 4716 4648 msedge.exe 91 PID 4648 wrote to memory of 4716 4648 msedge.exe 91 PID 4648 wrote to memory of 4716 4648 msedge.exe 91 PID 4648 wrote to memory of 4716 4648 msedge.exe 91 PID 4648 wrote to memory of 4716 4648 msedge.exe 91 PID 4648 wrote to memory of 4716 4648 msedge.exe 91 PID 4648 wrote to memory of 4716 4648 msedge.exe 91 PID 4648 wrote to memory of 4716 4648 msedge.exe 91 PID 4648 wrote to memory of 4716 4648 msedge.exe 91 PID 4648 wrote to memory of 4716 4648 msedge.exe 91 PID 4648 wrote to memory of 4716 4648 msedge.exe 91 PID 4648 wrote to memory of 4716 4648 msedge.exe 91 PID 4648 wrote to memory of 4716 4648 msedge.exe 91 PID 4648 wrote to memory of 4716 4648 msedge.exe 91 PID 4648 wrote to memory of 4716 4648 msedge.exe 91 PID 4648 wrote to memory of 4716 4648 msedge.exe 91 PID 4648 wrote to memory of 4716 4648 msedge.exe 91 PID 4648 wrote to memory of 4716 4648 msedge.exe 91
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c8577b0dfb9e59173421fe935ec010db.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9208146f8,0x7ff920814708,0x7ff9208147182⤵PID:4384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,5445295608841539041,7312480569106542779,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:22⤵PID:4236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,5445295608841539041,7312480569106542779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,5445295608841539041,7312480569106542779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:82⤵PID:4716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5445295608841539041,7312480569106542779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:2004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5445295608841539041,7312480569106542779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,5445295608841539041,7312480569106542779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5820 /prefetch:82⤵PID:440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,5445295608841539041,7312480569106542779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5820 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5445295608841539041,7312480569106542779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:12⤵PID:4404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5445295608841539041,7312480569106542779,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:12⤵PID:4620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5445295608841539041,7312480569106542779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:4556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5445295608841539041,7312480569106542779,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:12⤵PID:440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,5445295608841539041,7312480569106542779,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2700 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3196
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3856
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3032
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5fd7944a4ff1be37517983ffaf5700b11
SHA1c4287796d78e00969af85b7e16a2d04230961240
SHA256b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74
SHA51228c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b
-
Filesize
152B
MD5a774512b00820b61a51258335097b2c9
SHA138c28d1ea3907a1af6c0443255ab610dd9285095
SHA25601946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4
SHA512ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6824f721-b103-45d1-8dee-6303407d4d99.tmp
Filesize6KB
MD59283b1c510f93e87a179bd509806a3d1
SHA1a196e21d48166c061cf0a0b0f2c6cf945d0edb9d
SHA25676bbb022fd157ecfb85171956130f3f99c13336329fb84605c1aa008a8bd7818
SHA5124bb7d92e4e41b39e57d38ab040e18f05c124c5d3b7002d2d6fc54fdbc7c3023306a000b930ccb3cca77261efc1eb2d1b3b95f82cac4065dcff0a063ae79f8588
-
Filesize
6KB
MD5baa68ea692fd284da5e7144ee912af77
SHA1e3e568df531e718f58c1fef9970fbbfaf2d6e21e
SHA2569afa8c894c08b33a81fd82823a957ad9ccfd01ab8b51d1b573eca996102bab6f
SHA512d0e9cb20203aaacc9d44be811c96bf71d0610881f75c0ca77e69fbcbc6c71194aee9f574ae899dc9c4261f79aff5c486a6a08749482b0a41a1bdb9be3576ee11
-
Filesize
6KB
MD56bbe2684cedd797a6586c625da02a78c
SHA119c83ab5957df6e3e1d0f36e35aea5753615a047
SHA256d262738fdd6ba13f6085f1d6e270afa3edf85ac23fcc711c050150f9992736e4
SHA512d2e9aece75457e7dd409f163c3567c1e7bd2416af0a6d2f49faba762cb7d75bbe1f6b9074a88064fb99fd27f3e7154b3561ae2e3fe7079b99610258ee9558983
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD59c603f6137aee39c3dac357806ed0873
SHA1524b719b237507ce34a56db3ceb62fb5405c631e
SHA2563ad2eee02992a41c6c47de76851faf527e491db3996647289cb1e78d3013ce58
SHA5122e8bc55d1e4b6c39a8be1c271e6af39097408616beaef3d0b3e9e8b037c78da4ab8570df1c697cf4f19527f959aa6d397f83721cf0a992264beb87957fcaeb3a