070b68afefa21c54770b64174f475832cbf177d13e29f97ba1b7e89263969a12

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 05:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ca982a3e2d2159a6cc3470f8d2703ef8.html
Size

38KB
MD5

ca982a3e2d2159a6cc3470f8d2703ef8
SHA1

b78612fed5719b25a2741e94e9ef7c3a53004eae
SHA256

070b68afefa21c54770b64174f475832cbf177d13e29f97ba1b7e89263969a12
SHA512

4fc0b9e259cceee210ae3949e7580d06e35c186c5450064c4f1c330d78a432232ffbcf083fa51a00880362ebc27c17f9bb6eef45274eddafe59c417bc6d3f14b
SSDEEP

768:v2oxRCYOx3gKNXkl5WZqoKNf/VMbBFjkVGxnPn:vxgZBRBPZqpHMbRP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe
4260	msedge.exe
4260	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
3824	identity_helper.exe
3824	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 1356	4260	msedge.exe	87
PID 4260 wrote to memory of 1356	4260	msedge.exe	87
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 3508	4260	msedge.exe	88
PID 4260 wrote to memory of 4628	4260	msedge.exe	89
PID 4260 wrote to memory of 4628	4260	msedge.exe	89
PID 4260 wrote to memory of 4528	4260	msedge.exe	90
PID 4260 wrote to memory of 4528	4260	msedge.exe	90
PID 4260 wrote to memory of 4528	4260	msedge.exe	90
PID 4260 wrote to memory of 4528	4260	msedge.exe	90
PID 4260 wrote to memory of 4528	4260	msedge.exe	90
PID 4260 wrote to memory of 4528	4260	msedge.exe	90
PID 4260 wrote to memory of 4528	4260	msedge.exe	90
PID 4260 wrote to memory of 4528	4260	msedge.exe	90
PID 4260 wrote to memory of 4528	4260	msedge.exe	90
PID 4260 wrote to memory of 4528	4260	msedge.exe	90
PID 4260 wrote to memory of 4528	4260	msedge.exe	90
PID 4260 wrote to memory of 4528	4260	msedge.exe	90
PID 4260 wrote to memory of 4528	4260	msedge.exe	90
PID 4260 wrote to memory of 4528	4260	msedge.exe	90
PID 4260 wrote to memory of 4528	4260	msedge.exe	90
PID 4260 wrote to memory of 4528	4260	msedge.exe	90
PID 4260 wrote to memory of 4528	4260	msedge.exe	90
PID 4260 wrote to memory of 4528	4260	msedge.exe	90
PID 4260 wrote to memory of 4528	4260	msedge.exe	90
PID 4260 wrote to memory of 4528	4260	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ca982a3e2d2159a6cc3470f8d2703ef8.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd661146f8,0x7ffd66114708,0x7ffd66114718
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,1751001000814575550,12283342748180386030,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,1751001000814575550,12283342748180386030,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,1751001000814575550,12283342748180386030,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1751001000814575550,12283342748180386030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1751001000814575550,12283342748180386030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1751001000814575550,12283342748180386030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1700 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,1751001000814575550,12283342748180386030,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2396 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,1751001000814575550,12283342748180386030,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,1751001000814575550,12283342748180386030,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1751001000814575550,12283342748180386030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1751001000814575550,12283342748180386030,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1751001000814575550,12283342748180386030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1700 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1751001000814575550,12283342748180386030,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:3164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fd7944a4ff1be37517983ffaf5700b11

SHA1
c4287796d78e00969af85b7e16a2d04230961240

SHA256
b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

SHA512
28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
9cc3a2d7eb21f5b208906cdaccd9990b

SHA1
2733c63d4e1bbf86a526efe6b311ddb34eab0ea0

SHA256
c0424592235185e76182a93bf5c88a43ab358b577ef9c2746cac00ba711c34d7

SHA512
4a1ecc9a698016af76a5efddc81d0255a2f6ef73365f6d6973983338287d277ddffef2dcd2aa7d8b26518ce1d18ca83a07b4968bdb60e7c6b70dd19ae5046504

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
488B

MD5
7de53ab172fcc5563ebf97016164a0e1

SHA1
6356e80e48679864bcfd200dcfa38d5e572eb8bf

SHA256
218ebc4160ecd2952618c93cbf87ed9b0b9473f2ad80ad8f4d80b9713afa4e73

SHA512
5fbf35a8b6a87a2b745f425be6e6c8ba7e7ff0a9ed9612e22f47b44ef0dd3e588ed42014ca1c7d3d2d29d77d874852f711f6d94514395154a791b1b4b0fe732d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b91aa89f9b184e65ea086c35e7e9cb6c

SHA1
854114fb5caa5d90590433e186e279f23c52c599

SHA256
8f085989bdc1ca3c211012f4fffde2b0acc71705c22095124e7e8f1fdabe9c98

SHA512
abebbbed634744dc4148c30c08dd5989ca31bc9fe346faa39d54ec6285e68c7fc0dbbfbd7fd0c0ff933b4b80c29aa14133af25904365ed74aabbf7ab185ef94b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7a0d0400e01285fba3549c290cf62cc9

SHA1
4a02598bac2de3a0d2de4229c44892fb8c4a02a5

SHA256
940e4adacdfd74d03821664a30b755da91b3e0679049d047ff5fcc5b2dff3bf5

SHA512
7c5a9376472085086e54aef639b55036bb3c8c6bcee345ffdafee38bc8dcaca52fd352df83b18420bfbfe59dea14b6a94158779d576846e6539672eb60f26e59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
03afaa4f0ccfed4a0fedab366f9a1a47

SHA1
6b179f626bcaacc2980a990a0e95e68673c72bc5

SHA256
7e62f5b30815f0867070d5429c103361627a5f26482423b9411babb04a2ac4b7

SHA512
b2dca328797ad65142a327fe8d055b05aea1edeba52e4d79f8aed77ec6e8507409f6af4fb870a940015ff571c44513d7c682058be0d793f6461dd15d1739bb6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e8f839b5fe49820c3126378dd636cb85

SHA1
4b86723b490a0dca2891c2502438e7bc6c9c02cb

SHA256
75137a27c4bf65bae908a459ef63c6a02c3b2fa92cde70c13f838a3b72c309d5

SHA512
0a71e0128dd5b3f15494c657778b82c12bbb38c4f05cbab6ae9d79f998c2fda0b6e51687e530eddd4067939b674c59b808bff967d75c27a44e028ba3fae20ca3

Download Submit