e0cd7bff05195a4e764e79d55b90d65b634018b56b7181fc180524b6f0dfd183

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cbe0f9f90e1fcc252d59e5f690509f28.html
Size 11KB
Sample240315-tx31nada6w
SHA256 e0cd7bff05195a4e764e79d55b90d65b634018b56b7181fc180524b6f0dfd183
MD5 cbe0f9f90e1fcc252d59e5f690509f28
SHA1 64f4be05655d73a09f4b2429492d57122028112d
SHA512 a7517f8a1af70640276af2671b6150d99f6c00a8b6c2f9fd11f352d3ab2e46c6291a871d333d32091fa164a79c80da552b4fbb13662dee179ca531d0ad368101
SSDEEP 96:uzVs+ux7s6LLY1k9o84d12ef7CSTUAGT/kzupOz7fbPab6lF7bCVbllVHcEZ7rur:csz7s6AYS/BYe2LVZPHb76f
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
3228	msedge.exe
3228	msedge.exe
4860	identity_helper.exe
4860	identity_helper.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe
3228	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 4588	3228	msedge.exe	89
PID 3228 wrote to memory of 4588	3228	msedge.exe	89
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 1424	3228	msedge.exe	90
PID 3228 wrote to memory of 4912	3228	msedge.exe	91
PID 3228 wrote to memory of 4912	3228	msedge.exe	91
PID 3228 wrote to memory of 4272	3228	msedge.exe	92
PID 3228 wrote to memory of 4272	3228	msedge.exe	92
PID 3228 wrote to memory of 4272	3228	msedge.exe	92
PID 3228 wrote to memory of 4272	3228	msedge.exe	92
PID 3228 wrote to memory of 4272	3228	msedge.exe	92
PID 3228 wrote to memory of 4272	3228	msedge.exe	92
PID 3228 wrote to memory of 4272	3228	msedge.exe	92
PID 3228 wrote to memory of 4272	3228	msedge.exe	92
PID 3228 wrote to memory of 4272	3228	msedge.exe	92
PID 3228 wrote to memory of 4272	3228	msedge.exe	92
PID 3228 wrote to memory of 4272	3228	msedge.exe	92
PID 3228 wrote to memory of 4272	3228	msedge.exe	92
PID 3228 wrote to memory of 4272	3228	msedge.exe	92
PID 3228 wrote to memory of 4272	3228	msedge.exe	92
PID 3228 wrote to memory of 4272	3228	msedge.exe	92
PID 3228 wrote to memory of 4272	3228	msedge.exe	92
PID 3228 wrote to memory of 4272	3228	msedge.exe	92
PID 3228 wrote to memory of 4272	3228	msedge.exe	92
PID 3228 wrote to memory of 4272	3228	msedge.exe	92
PID 3228 wrote to memory of 4272	3228	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\cbe0f9f90e1fcc252d59e5f690509f28.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa6f5e46f8,0x7ffa6f5e4708,0x7ffa6f5e4718
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,3437122172582548943,6603493855962891884,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 /prefetch:2
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1868,3437122172582548943,6603493855962891884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1868,3437122172582548943,6603493855962891884,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,3437122172582548943,6603493855962891884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,3437122172582548943,6603493855962891884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1868,3437122172582548943,6603493855962891884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1868,3437122172582548943,6603493855962891884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,3437122172582548943,6603493855962891884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,3437122172582548943,6603493855962891884,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,3437122172582548943,6603493855962891884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,3437122172582548943,6603493855962891884,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,3437122172582548943,6603493855962891884,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1296 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc
MD5 9ffb5f81e8eccd0963c46cbfea1abc20
SHA1 a02a610afd3543de215565bc488a4343bb5c1a59
SHA512 2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60
MD5 e1b45169ebca0dceadb0f45697799d62
SHA1 803604277318898e6f5c6fb92270ca83b5609cd5
SHA512 357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a131cf614ce1fe1aec1db1276fcf7e10850bce6c7a74f469535cee9226cc6d12
MD5 39d6f14d9776d179158e957d56868bcf
SHA1 9b31562aa2a19e3a4ab0676cfc2d41689e03452d
SHA512 039da724815eeaf8b12be0ec01b80b04c28846b2599b57a7613b3851176b90d03d628ca7326d7a00a6020dfb510ab1ac5acebe740a12d786b3f3903918b90ece
SSDEEP 96:nAkID1oc2wpvWMoiVmdeHOHTsJUWQyV+VD7ziEwb:nAkSp2GWMXET0rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a1ff1b2f0d2ee78a04f8b8069a3918e326c0c844156a9d4e04a254f4a3c6a38d
MD5 bfa10eabf76ce5e1a8fedbbfdea475c0
SHA1 cc5c9afc16b7dbd43c3f09a03dd05182e35cad31
SHA512 d494e25c05ec16d108135d5a81f4422fbd7233bad80e7028b8bd4fa7f0403df1b085f7feaac70c45a09f64ae3a2737bcb099b91c9c9bb8ea4ee76df757931fe8
SSDEEP 96:nAkjD1ocmwpvWMoiVmde/qOHTsJUWQyV+VD7AiEwb:nAk/pmGWMPqET0rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 308d70b9034b45c66f66b11384b098ba55bda4b06f643a1505991b7f6fcfeca4
MD5 b1efea14de26e65f08c4a5af82477986
SHA1 f35bf4dc2b56ca513cf16eab4d9858ceb0b477c0
SHA512 e5e7f24257f55734940524aa0b20324cc16cfac42a6392cc12eb7991727e045d592e6cac1ab24b6cf05a6fee61826f82fc8d188d9d9da5954f833997e4d23231
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupwe2RUsHybRH9xUX1MPeuuz:A9iIxuERzA83h09RZxYut+H9E1MeuBOV
MD5 SHA1 SHA512 SSDEEP

Submit Download