c20b352ca348823edb6b44a06e0825da57e09c502444588c8405baa6a26ea0bb

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18-03-2024 11:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d36e9d69ea37231dbd50f6e323c3fb8f.html
Size

44KB
MD5

d36e9d69ea37231dbd50f6e323c3fb8f
SHA1

b27a97a4607af180f63c85f0f68ab7d163a76138
SHA256

c20b352ca348823edb6b44a06e0825da57e09c502444588c8405baa6a26ea0bb
SHA512

6dda583fe54967fd2008215b4a0ff8a4b8bb4cd5b33c8a12b0c10d7b86a41703ef064acfb77eecfa6f9c54cc8eb065557f3dc8b676c58de23497251beffb4c59
SSDEEP

768:mwS0l/sGVLsk8ejW4mTNn2olvelgjZLZIcbDk:mZJt/velgjK

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1124	msedge.exe
1124	msedge.exe
3068	msedge.exe
3068	msedge.exe
3392	identity_helper.exe
3392	identity_helper.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 4824	3068	msedge.exe	89
PID 3068 wrote to memory of 4824	3068	msedge.exe	89
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 640	3068	msedge.exe	90
PID 3068 wrote to memory of 1124	3068	msedge.exe	91
PID 3068 wrote to memory of 1124	3068	msedge.exe	91
PID 3068 wrote to memory of 4108	3068	msedge.exe	92
PID 3068 wrote to memory of 4108	3068	msedge.exe	92
PID 3068 wrote to memory of 4108	3068	msedge.exe	92
PID 3068 wrote to memory of 4108	3068	msedge.exe	92
PID 3068 wrote to memory of 4108	3068	msedge.exe	92
PID 3068 wrote to memory of 4108	3068	msedge.exe	92
PID 3068 wrote to memory of 4108	3068	msedge.exe	92
PID 3068 wrote to memory of 4108	3068	msedge.exe	92
PID 3068 wrote to memory of 4108	3068	msedge.exe	92
PID 3068 wrote to memory of 4108	3068	msedge.exe	92
PID 3068 wrote to memory of 4108	3068	msedge.exe	92
PID 3068 wrote to memory of 4108	3068	msedge.exe	92
PID 3068 wrote to memory of 4108	3068	msedge.exe	92
PID 3068 wrote to memory of 4108	3068	msedge.exe	92
PID 3068 wrote to memory of 4108	3068	msedge.exe	92
PID 3068 wrote to memory of 4108	3068	msedge.exe	92
PID 3068 wrote to memory of 4108	3068	msedge.exe	92
PID 3068 wrote to memory of 4108	3068	msedge.exe	92
PID 3068 wrote to memory of 4108	3068	msedge.exe	92
PID 3068 wrote to memory of 4108	3068	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d36e9d69ea37231dbd50f6e323c3fb8f.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c8fb46f8,0x7ff8c8fb4708,0x7ff8c8fb4718
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,1473854832751549717,6969626634374029722,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,1473854832751549717,6969626634374029722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,1473854832751549717,6969626634374029722,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,1473854832751549717,6969626634374029722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,1473854832751549717,6969626634374029722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,1473854832751549717,6969626634374029722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,1473854832751549717,6969626634374029722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,1473854832751549717,6969626634374029722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,1473854832751549717,6969626634374029722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,1473854832751549717,6969626634374029722,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,1473854832751549717,6969626634374029722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,1473854832751549717,6969626634374029722,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,1473854832751549717,6969626634374029722,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1828 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c6136bc98a5aedca2ea3004e9fbe67d

SHA1
74318d997f4c9c351eef86d040bc9b085ce1ad4f

SHA256
50c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2

SHA512
2d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c6aef82e50d05ffc0cf52a6c6d69c91

SHA1
c203efe5b45b0630fee7bd364fe7d63b769e2351

SHA256
d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32

SHA512
77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0263d8ff036a5c40648078da8fabbf65

SHA1
8c04a28ebd971535921619d100b38b143138d811

SHA256
cd40bd57aa39cc6561c129e71823ae60972aa032783f6ee85d38048f439268e0

SHA512
ae4982ff38a106a24d4005c6cbd5e867dadc5486102e59fd3dd8335a170ce051f05902a2b8eb56839473932f950debd9b2bce6a44818e0915f41933eb58ea539

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
069802b7219e70ebe88ab885d627570c

SHA1
aebe980ed786fb4e10501ab35452da670dbad7a1

SHA256
34c58897505d28c1dec5125df991e20bb8a29b90d6ae6be2f4cd152b083b9213

SHA512
8f3158fde99c4e6ba4f59b0b7c28e365c308d8eec192871cea5dee409af5f8398d479eb7759f70a5ef6300f46eb219404f721c62b5021efb076778f558b4c6d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9e51d47c267d0e23613d1d04319c8988

SHA1
32c095893c0fad406a48fd2bb34660eff4a67372

SHA256
d17b29f9184b3b9a0e0ac96997963b0c55cff436d55e33f6b7bd52aba4f6f659

SHA512
761eff76877f1100d34de28207a7b57b3b09d7fe32560fd67f4cbc513aaadd32761135a412cb3c2772d0b479d7475dc9b0cc5101b2a6685b393985fc995a63ef

Download Submit