dbb32f17db16d49aa16e8527778cbf304c7f6073ff1b6f0e3aed7f101250147a

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 01:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ca23e7bbe1c9e9bdc6a483a80ae519f3.html
Size

3.5MB
MD5

ca23e7bbe1c9e9bdc6a483a80ae519f3
SHA1

808eecb0a5ec2437085ab52d7add5899b607af50
SHA256

dbb32f17db16d49aa16e8527778cbf304c7f6073ff1b6f0e3aed7f101250147a
SHA512

1f3b0b14e733ced33690505894fd5fd0bc54f95c173c8937c4ec5caa4455140229c0cd731ad0f4ac63dbd6c538781e02516eb7ea013d3b5cc71160eabea0e5f4
SSDEEP

12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6Nyv:jvpjte4tT6sv

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3108	msedge.exe
3108	msedge.exe
3920	msedge.exe
3920	msedge.exe
2640	identity_helper.exe
2640	identity_helper.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe
5156	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 3984	3920	msedge.exe	88
PID 3920 wrote to memory of 3984	3920	msedge.exe	88
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 220	3920	msedge.exe	89
PID 3920 wrote to memory of 3108	3920	msedge.exe	90
PID 3920 wrote to memory of 3108	3920	msedge.exe	90
PID 3920 wrote to memory of 4256	3920	msedge.exe	91
PID 3920 wrote to memory of 4256	3920	msedge.exe	91
PID 3920 wrote to memory of 4256	3920	msedge.exe	91
PID 3920 wrote to memory of 4256	3920	msedge.exe	91
PID 3920 wrote to memory of 4256	3920	msedge.exe	91
PID 3920 wrote to memory of 4256	3920	msedge.exe	91
PID 3920 wrote to memory of 4256	3920	msedge.exe	91
PID 3920 wrote to memory of 4256	3920	msedge.exe	91
PID 3920 wrote to memory of 4256	3920	msedge.exe	91
PID 3920 wrote to memory of 4256	3920	msedge.exe	91
PID 3920 wrote to memory of 4256	3920	msedge.exe	91
PID 3920 wrote to memory of 4256	3920	msedge.exe	91
PID 3920 wrote to memory of 4256	3920	msedge.exe	91
PID 3920 wrote to memory of 4256	3920	msedge.exe	91
PID 3920 wrote to memory of 4256	3920	msedge.exe	91
PID 3920 wrote to memory of 4256	3920	msedge.exe	91
PID 3920 wrote to memory of 4256	3920	msedge.exe	91
PID 3920 wrote to memory of 4256	3920	msedge.exe	91
PID 3920 wrote to memory of 4256	3920	msedge.exe	91
PID 3920 wrote to memory of 4256	3920	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ca23e7bbe1c9e9bdc6a483a80ae519f3.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa53df46f8,0x7ffa53df4708,0x7ffa53df4718
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,3152190604105425291,16830727030823258724,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,3152190604105425291,16830727030823258724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,3152190604105425291,16830727030823258724,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3152190604105425291,16830727030823258724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3152190604105425291,16830727030823258724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,3152190604105425291,16830727030823258724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,3152190604105425291,16830727030823258724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3152190604105425291,16830727030823258724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2536 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3152190604105425291,16830727030823258724,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3152190604105425291,16830727030823258724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3152190604105425291,16830727030823258724,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,3152190604105425291,16830727030823258724,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
981B

MD5
69b7e5d2d17aec7b6d32d3ebb74376b4

SHA1
1a7581b6f939aa47b88ac899f77426c42a5d88ed

SHA256
b1696a14bb678b3c831487517fa21aa5878c3496e1fa3cdd72de72e0ca79b570

SHA512
682119077d00eab587cfb19dc60155df761aec152582c4ce8f3d14efdd99d6767bcbb028a769f59d801df676633b4327eea8acb34ae0131bac087635cb4564ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
de90b64149dc684ad5656b98562b45d2

SHA1
04b734f7392cd6673fa856199adfa2827c3f40e2

SHA256
3b8cba39e7caea3ce052fb1f95e27bbaaac8edb8d29d2ea5c6ff7a110ddc8354

SHA512
06a65130949b7ff108663f52a85f380dd28fdbd628740cd8b44b7c17d83344da6128da5e0ffdebc3d14bc2a11e6fee7a27790de974a7bfe7d1d80356552cffdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e0e06017bc666e0681adef7be808dc37

SHA1
980b17386a7658ca8e5b9b7080deeef8ad235cff

SHA256
d40b3de9ab79ced7591d858690626e86b1e982ded8f59db2d4922065b4a601f0

SHA512
b07605910ee34995ba2cebe53a4a880621d5fce3528b06a71aca838d50adc74420fd5361ffe65a061930472f24a653c0a23e2c2adb24a3044cca5c320c96e6ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
0fbe611f2ca4158e7d0f03df5f582980

SHA1
39c32c6dc16222b8a8b6f9fece9d4e55565b07b3

SHA256
acb7fa2aed714c34cae2a259af122d1d69ec587bbaee16a1d46ab6b008b61b72

SHA512
f9fc462ddd293686f6a5eb32a77dfbf5d7b82294fce434fe788d189428d2576ba1e5c83ccefb316b032b047fe1a3d202a989e9026f1f6f46459030ecfc013c16

Download Submit