88baa94dea4465ab189b6e0b2ad6e100c8e70c2e65a1ac497aff097cf3b8afd9

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2024 13:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb945a3c77429047a7d9b680663c0fe5.html
Size

30KB
MD5

cb945a3c77429047a7d9b680663c0fe5
SHA1

b9d7aa9e60fa35ae8527e97c1918087236980125
SHA256

88baa94dea4465ab189b6e0b2ad6e100c8e70c2e65a1ac497aff097cf3b8afd9
SHA512

d8304c387df158f2e588c523e50d69d1e5e3454203aaf7f17a83aeb7330ed09a7678cc966c6fc072c1721221865b1d3fc68471153e2338a43424aadb6bf5dfa9
SSDEEP

384:Y39ylPMFbl+3x6gMltnzoLZAsK1UBoOcucu:w9KPMFbl+zStULZJKAoOcM

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
1280	msedge.exe
1280	msedge.exe
3228	identity_helper.exe
3228	identity_helper.exe
6068	msedge.exe
6068	msedge.exe
6068	msedge.exe
6068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 2848	1280	msedge.exe	88
PID 1280 wrote to memory of 2848	1280	msedge.exe	88
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 640	1280	msedge.exe	89
PID 1280 wrote to memory of 2172	1280	msedge.exe	90
PID 1280 wrote to memory of 2172	1280	msedge.exe	90
PID 1280 wrote to memory of 3268	1280	msedge.exe	91
PID 1280 wrote to memory of 3268	1280	msedge.exe	91
PID 1280 wrote to memory of 3268	1280	msedge.exe	91
PID 1280 wrote to memory of 3268	1280	msedge.exe	91
PID 1280 wrote to memory of 3268	1280	msedge.exe	91
PID 1280 wrote to memory of 3268	1280	msedge.exe	91
PID 1280 wrote to memory of 3268	1280	msedge.exe	91
PID 1280 wrote to memory of 3268	1280	msedge.exe	91
PID 1280 wrote to memory of 3268	1280	msedge.exe	91
PID 1280 wrote to memory of 3268	1280	msedge.exe	91
PID 1280 wrote to memory of 3268	1280	msedge.exe	91
PID 1280 wrote to memory of 3268	1280	msedge.exe	91
PID 1280 wrote to memory of 3268	1280	msedge.exe	91
PID 1280 wrote to memory of 3268	1280	msedge.exe	91
PID 1280 wrote to memory of 3268	1280	msedge.exe	91
PID 1280 wrote to memory of 3268	1280	msedge.exe	91
PID 1280 wrote to memory of 3268	1280	msedge.exe	91
PID 1280 wrote to memory of 3268	1280	msedge.exe	91
PID 1280 wrote to memory of 3268	1280	msedge.exe	91
PID 1280 wrote to memory of 3268	1280	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\cb945a3c77429047a7d9b680663c0fe5.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffacefe46f8,0x7ffacefe4708,0x7ffacefe4718
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,10391951506411979810,12041223025075792147,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,10391951506411979810,12041223025075792147,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,10391951506411979810,12041223025075792147,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10391951506411979810,12041223025075792147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10391951506411979810,12041223025075792147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,10391951506411979810,12041223025075792147,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,10391951506411979810,12041223025075792147,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10391951506411979810,12041223025075792147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10391951506411979810,12041223025075792147,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10391951506411979810,12041223025075792147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10391951506411979810,12041223025075792147,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2376 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,10391951506411979810,12041223025075792147,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1260 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cbec32729772aa6c576e97df4fef48f5

SHA1
6ec173d5313f27ba1e46ad66c7bbe7c0a9767dba

SHA256
d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e

SHA512
425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
279e783b0129b64a8529800a88fbf1ee

SHA1
204c62ec8cef8467e5729cad52adae293178744f

SHA256
3619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932

SHA512
32730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
835B

MD5
0542c82e0f24c04958c58faf8c62d7f7

SHA1
1563d521569833523f8271a0cb050e57c963fc22

SHA256
0e07456af02528aebaedf72bf922468bc0d073f0e5f47d850ce8e826f655870a

SHA512
a134ea2cbf959439064d73ea3874431d783ada5760eef15671644258a21137242ba55f375cb3a761ae194894de3c1051dae5332d8dd70546450b849b0645c3d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2c03c6a53741ccc9e4e4219a17264960

SHA1
908d7c3642a0931fefc1758a003f161a820fde76

SHA256
759d083f38990e1dece0c762c401f1c7f69683cb0eed4681b2af0a511ce79b0c

SHA512
13c25a4d47200076de33f4162c6a50646489f6a4565d513decba5a88785eea7d6cd5d751cf375f1089536ff2230e52c1b117bc7547164ea28bc6e2010984518c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
079e2db24599ed3c308edf3882ac80d8

SHA1
3a1be8b96b66dd84c7503cb8c315d9ebcfed1d39

SHA256
356149112308b9b6e69b19fd35c966d20e0adb1c14a683d6e950e7f326abd85c

SHA512
9fb086cc30c6ffb2e4f25b0fc84fb0fb395d3d9b697868e2933172873863fc2500170980aeb56a218fcad5c86241db8510d28174eb28dff1771c1f53123680d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
182486d1d28f9920b5b62621bf296377

SHA1
71113ae54e6b65fc25a977f7902710fa26ed008b

SHA256
fad3ffbd9601386d501897da47f04ae1bab485ff224a46d992f7a1e2d145dd91

SHA512
f761b7b90d2d9d684ba651170f119993a46e9e5cb6ad8d29deb37e5d403656769e941371ca239067ad5fb9d5bbce8ef462236f0f8b876c46afba7b77802b581f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
167502eadeab26fccad143aea791e619

SHA1
6b3feaa97ff2d65561ac2ae404261ef779130e8c

SHA256
6001226e3564d7cf95b06c4db5178bb2c188149bf4944f19842e15b2669d7287

SHA512
5d35f027918d2d13b67a578af7430efeb5bbf6c13fb31ba8a2012317d0504393e3d11a0f2198a6e434b6ac6519418951c7757b9a24fa23dfa5786d56c6c0b132

Download Submit