dd8a618d738d9512e2dd8a7d22b9f9a66b0aa0025b42aac30a2064de689b56fc

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 20:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cc5a71dd462e80e36f0c58f661635e0e.html
Size

9KB
MD5

cc5a71dd462e80e36f0c58f661635e0e
SHA1

40e49d68dfbae151bfbceb773af6c3009d9eaa16
SHA256

dd8a618d738d9512e2dd8a7d22b9f9a66b0aa0025b42aac30a2064de689b56fc
SHA512

0175b48d58af196812828476b569db3f3e7f351474c58cd724fa459616256506e49b2a21cb9d83d06cc09655f350bb78dc64ca54fa715b145ca374cac01fd5d2
SSDEEP

96:uzVs+ux7bOLLY1k9o84d12ef7CSTUHGT/kzHZCDpr8CJrK+oCq1/XlVHcEZ7ru7f:csz7bOAYS/WzHoVFSv1fPHb76f

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe
828	msedge.exe
828	msedge.exe
4140	identity_helper.exe
4140	identity_helper.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 3552	828	msedge.exe	89
PID 828 wrote to memory of 3552	828	msedge.exe	89
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2660	828	msedge.exe	90
PID 828 wrote to memory of 2956	828	msedge.exe	91
PID 828 wrote to memory of 2956	828	msedge.exe	91
PID 828 wrote to memory of 4036	828	msedge.exe	92
PID 828 wrote to memory of 4036	828	msedge.exe	92
PID 828 wrote to memory of 4036	828	msedge.exe	92
PID 828 wrote to memory of 4036	828	msedge.exe	92
PID 828 wrote to memory of 4036	828	msedge.exe	92
PID 828 wrote to memory of 4036	828	msedge.exe	92
PID 828 wrote to memory of 4036	828	msedge.exe	92
PID 828 wrote to memory of 4036	828	msedge.exe	92
PID 828 wrote to memory of 4036	828	msedge.exe	92
PID 828 wrote to memory of 4036	828	msedge.exe	92
PID 828 wrote to memory of 4036	828	msedge.exe	92
PID 828 wrote to memory of 4036	828	msedge.exe	92
PID 828 wrote to memory of 4036	828	msedge.exe	92
PID 828 wrote to memory of 4036	828	msedge.exe	92
PID 828 wrote to memory of 4036	828	msedge.exe	92
PID 828 wrote to memory of 4036	828	msedge.exe	92
PID 828 wrote to memory of 4036	828	msedge.exe	92
PID 828 wrote to memory of 4036	828	msedge.exe	92
PID 828 wrote to memory of 4036	828	msedge.exe	92
PID 828 wrote to memory of 4036	828	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\cc5a71dd462e80e36f0c58f661635e0e.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd14b346f8,0x7ffd14b34708,0x7ffd14b34718
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,14772767187700300702,9914255978732480068,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,14772767187700300702,9914255978732480068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,14772767187700300702,9914255978732480068,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14772767187700300702,9914255978732480068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14772767187700300702,9914255978732480068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,14772767187700300702,9914255978732480068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,14772767187700300702,9914255978732480068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14772767187700300702,9914255978732480068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14772767187700300702,9914255978732480068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14772767187700300702,9914255978732480068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,14772767187700300702,9914255978732480068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,14772767187700300702,9914255978732480068,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2e9877d7d469954089ba20dfb06ea85a

SHA1
a0b3e892ee655429a44a8b8d5448909993d23f39

SHA256
19dbdb83fe91d7fb95c775ff5d2fde807fb658f7b6bfca8a23c9220ffe2fbcc2

SHA512
24227dbe790d092092ab94855aa856a904267b431c3171be183e42c4fb00fc3a2ab512ca693203f5bdfe62f8380af7ef56eaa6e89201efd08411ccf1f5f1215f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b73dad006e96f2dfae9fc61805c345c4

SHA1
603c1c94ff5eec5f99b1ba6e478e61a6d4532daa

SHA256
904ce45294e831630fc582f957618752a98130fa3f548cc1573b33096aa85da2

SHA512
084d8009a9620535a9ad8a2d4c515a7999fd89e5712fd8bbb88ab59c446878b77645b5e3ea8a864a1b87f04cfd750d99a45595dcac7e95feb69a86eb18db1006

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
99454c4c2ec5cb8d3c974d18f3309a79

SHA1
75610c52f188ec132d7723fc853e2e6fcf895e0e

SHA256
f9ec4954c5e33ab03b0db45c5faabdd63e0c58f8e39be20ed314d66991fd242b

SHA512
fd228f20bfb994086720d5b27fa961db011f277f083822ae127811867b303dd65671a86bef67b721e4c5fa3025787e8ee917936f6affa65685fe355b2f88b4ac

Download Submit