82196972aac9578e6b49cb2e6eb2ede4938127a9d8d18f2a6ab6327eabd17c32

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 04:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ca7baf65e64fdd350863fe3b2370cc04.html
Size

237KB
MD5

ca7baf65e64fdd350863fe3b2370cc04
SHA1

9447a0a8aa06e7e2875dee1a5f450a176bd22f36
SHA256

82196972aac9578e6b49cb2e6eb2ede4938127a9d8d18f2a6ab6327eabd17c32
SHA512

f1481b84212a69be5cb65cd3bed50dc7f56367a62f17508c826d4ae9726336d2b082eb8ecea193685ce331e4aaa7002019bdf73a9c658e7bdc657a5d6e518dcf
SSDEEP

6144:SioDRCixVixc/sMYod+X3oI+Y9sMYod+X3oI+YQ:ToDYixVixcD5d+X3P5d+X3+

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe
4264	msedge.exe
4264	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4264	msedge.exe
4264	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 1928	4264	msedge.exe	85
PID 4264 wrote to memory of 1928	4264	msedge.exe	85
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 3180	4264	msedge.exe	90
PID 4264 wrote to memory of 1168	4264	msedge.exe	91
PID 4264 wrote to memory of 1168	4264	msedge.exe	91
PID 4264 wrote to memory of 4900	4264	msedge.exe	92
PID 4264 wrote to memory of 4900	4264	msedge.exe	92
PID 4264 wrote to memory of 4900	4264	msedge.exe	92
PID 4264 wrote to memory of 4900	4264	msedge.exe	92
PID 4264 wrote to memory of 4900	4264	msedge.exe	92
PID 4264 wrote to memory of 4900	4264	msedge.exe	92
PID 4264 wrote to memory of 4900	4264	msedge.exe	92
PID 4264 wrote to memory of 4900	4264	msedge.exe	92
PID 4264 wrote to memory of 4900	4264	msedge.exe	92
PID 4264 wrote to memory of 4900	4264	msedge.exe	92
PID 4264 wrote to memory of 4900	4264	msedge.exe	92
PID 4264 wrote to memory of 4900	4264	msedge.exe	92
PID 4264 wrote to memory of 4900	4264	msedge.exe	92
PID 4264 wrote to memory of 4900	4264	msedge.exe	92
PID 4264 wrote to memory of 4900	4264	msedge.exe	92
PID 4264 wrote to memory of 4900	4264	msedge.exe	92
PID 4264 wrote to memory of 4900	4264	msedge.exe	92
PID 4264 wrote to memory of 4900	4264	msedge.exe	92
PID 4264 wrote to memory of 4900	4264	msedge.exe	92
PID 4264 wrote to memory of 4900	4264	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ca7baf65e64fdd350863fe3b2370cc04.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad6d046f8,0x7ffad6d04708,0x7ffad6d04718
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,4910081612221995147,4148454990879655181,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,4910081612221995147,4148454990879655181,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,4910081612221995147,4148454990879655181,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4910081612221995147,4148454990879655181,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4910081612221995147,4148454990879655181,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,4910081612221995147,4148454990879655181,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2712 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f35bb0615bb9816f562b83304e456294

SHA1
1049e2bd3e1bbb4cea572467d7c4a96648659cb4

SHA256
05e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71

SHA512
db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1eb86108cb8f5a956fdf48efbd5d06fe

SHA1
7b2b299f753798e4891df2d9cbf30f94b39ef924

SHA256
1b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40

SHA512
e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
255B

MD5
d65f1f26135e9d5798a6a8d6fe48c063

SHA1
5de9ccd65d7028a0d31d2165f159a403b949ea2b

SHA256
1222fd0abb84cfba47942406c6c464b8cd7f953e180b9d7e338d1be8fa29fb5f

SHA512
8b470e0cf29db6f065f785f478f5392c78ab3cf4261f2d922906652a0f134c54cf48905aa0077ec5d598631eb049d2ff2b228833a0c2ad50d5be6c80099c003a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b373a996b8abf3e4d68ca205d1970025

SHA1
dc48262edca072c76fce6363e12bd5db5081c531

SHA256
117c0ce8b80d1ce95e47f02c5ff0cf912dbe4ebdc27803682d906cb204addfdc

SHA512
7cfb090fb563b06003db2ae928537daccf5f6cbb48657d93f65136a0c43f7b4e66b5aa306094056d1cacb1a097e629b4ecd9c3469c121037a58fe19a9edc0a3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
df9208441810045e6402129ceeb80fde

SHA1
074840f851c073d6b120822dc6d0f96e0860c060

SHA256
1dd833396a7c6a084fc4b0bf35f2dc173ccf509b9c4f710e99aa778c34c93f3b

SHA512
9ead6c9a1e68df0579673e93feef6818a0e0b10fffc312655941db79e59f57dd8b70440124657f3f42e4c7f04a89e7362702e26182c920fb26cea48429c14f07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
567b7d464b3b008c5ac64ec5c9e75bea

SHA1
1e429ac255b0c1271d9a83df1e7fa8e6e9584662

SHA256
7d8faa985b4ac99bed786e9e1cc1b5677c432d169993ee25dd75732988585cdc

SHA512
35aadd4be271b167df21b14fba4b9cbfeb377979d90e02eeeaa868b76439c0c7002504942ec5987147cc546b1b0617aee2c1dafaf04d71dec85830b2c4c6d3ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b2ae2e60f57c5368e9af4e63757d2cae

SHA1
5ede37a79b0d2db386b8c1e600d63696f87659c2

SHA256
a5063e490cd444f5f1739594278d0d6b19a87f5bc89be749150fe809a26ade4e

SHA512
946cf4bf39ff00848eaed69f16fdc36f22697be318fd8a02672b43830d2ead41c304fcca282ce52a5615974a18a70cf19a26c7209f65a24770fc4c4dbab1f925

Download Submit