e0ea016d0ac924f7f8eab1ffa50de7073eed08d10fcc28d8dacdbbca4d840d83

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18-03-2024 13:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3a42054f1b5c51973d5562087fa48f8.html
Size

31KB
MD5

d3a42054f1b5c51973d5562087fa48f8
SHA1

8f94c78d44552dee2505b8d107247db527e909f2
SHA256

e0ea016d0ac924f7f8eab1ffa50de7073eed08d10fcc28d8dacdbbca4d840d83
SHA512

c19998fe85f882a44c13d47d73255b4eeba01b33a2d7be722f11d0a3023d7af0f058277eca6d6ca6b17ad7d924ce13b0248c7f856768cd3c41d8d7f472ae2e00
SSDEEP

768:5ErAGsN1CmEaE6P8MJB+IQuVFLBNErSbyt54Vs4i:G0GsN0mE6P8MTBQuL0Sbyt54Vs4i

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
2528	msedge.exe
2528	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe
2712	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 1568	2528	msedge.exe	89
PID 2528 wrote to memory of 1568	2528	msedge.exe	89
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 2356	2528	msedge.exe	90
PID 2528 wrote to memory of 3032	2528	msedge.exe	91
PID 2528 wrote to memory of 3032	2528	msedge.exe	91
PID 2528 wrote to memory of 4080	2528	msedge.exe	92
PID 2528 wrote to memory of 4080	2528	msedge.exe	92
PID 2528 wrote to memory of 4080	2528	msedge.exe	92
PID 2528 wrote to memory of 4080	2528	msedge.exe	92
PID 2528 wrote to memory of 4080	2528	msedge.exe	92
PID 2528 wrote to memory of 4080	2528	msedge.exe	92
PID 2528 wrote to memory of 4080	2528	msedge.exe	92
PID 2528 wrote to memory of 4080	2528	msedge.exe	92
PID 2528 wrote to memory of 4080	2528	msedge.exe	92
PID 2528 wrote to memory of 4080	2528	msedge.exe	92
PID 2528 wrote to memory of 4080	2528	msedge.exe	92
PID 2528 wrote to memory of 4080	2528	msedge.exe	92
PID 2528 wrote to memory of 4080	2528	msedge.exe	92
PID 2528 wrote to memory of 4080	2528	msedge.exe	92
PID 2528 wrote to memory of 4080	2528	msedge.exe	92
PID 2528 wrote to memory of 4080	2528	msedge.exe	92
PID 2528 wrote to memory of 4080	2528	msedge.exe	92
PID 2528 wrote to memory of 4080	2528	msedge.exe	92
PID 2528 wrote to memory of 4080	2528	msedge.exe	92
PID 2528 wrote to memory of 4080	2528	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d3a42054f1b5c51973d5562087fa48f8.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd06d346f8,0x7ffd06d34708,0x7ffd06d34718
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3288691190046887790,15131215287646602631,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,3288691190046887790,15131215287646602631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,3288691190046887790,15131215287646602631,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3288691190046887790,15131215287646602631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3288691190046887790,15131215287646602631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3288691190046887790,15131215287646602631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3288691190046887790,15131215287646602631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3288691190046887790,15131215287646602631,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3288691190046887790,15131215287646602631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3288691190046887790,15131215287646602631,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3288691190046887790,15131215287646602631,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3288691190046887790,15131215287646602631,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3288691190046887790,15131215287646602631,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4856 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ffb5f81e8eccd0963c46cbfea1abc20

SHA1
a02a610afd3543de215565bc488a4343bb5c1a59

SHA256
3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc

SHA512
2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1b45169ebca0dceadb0f45697799d62

SHA1
803604277318898e6f5c6fb92270ca83b5609cd5

SHA256
4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60

SHA512
357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
102db4934eb9aa3e3b1ca7fddadeaf30

SHA1
d3c6493cb8c908c395e4776b460010595b571433

SHA256
3ed58e04fa1d92da8de40b680a38a55c0b2ab4b7fb9b309b11e4257495ca18da

SHA512
62c50200a3156847a2ea41f328e8d4ae9459b6c025b4d228c9e52ac8488d96c888482157b0e3378d000afeb3574a57b171b6264374560a44175057fd171fd693

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7c757cbf2e983aee561c128a4b8b3253

SHA1
d6a88d2fbfab01647dff967c2f17dc842fc5e497

SHA256
4283c9d21b56f7bc6c4710c3c4caf7dbcd0c63ce89487e388bec527409def278

SHA512
e9129756b8f4ace4397e7e0bf3dbb0125619ff23fe0dc2df3fa884fa1e3d1fa65684a2936d0384bcbd69c89609ec77e4efc063cad80f5a35f614bc0d505491a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9e82e0bfdc1be77cd18716083d343b7b

SHA1
db1900735e3b8f6512b8159c06ddedfe7e20e7b4

SHA256
9e5564933ffc2f9f7632c9dc6f1b1a881d37fc6725f647052f494118f37df9c1

SHA512
f130f88f7e507a4e7832afbb8b8c543aa93f30fd91eb3330d69332bcf9d1a771afacbc97b67f5461db46fa6ee605e8116a8f350c6fb90aae6be9cbab4be9fb11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a72c50e417e06e2f538ceba0f5d48fba

SHA1
73a724d4939af0aea4985c2820f4182710349fbf

SHA256
17985666879d0fb1c4d67d7555d8abd5c7bfe6f726fd47c3955b93b5d24bcebb

SHA512
4d5a2e35191ecced4e1452c356d17e182f2ae91380b3364d240548c66bc4919b23338afffcf527dd9fd690d825ea50c39aa6751a51bdf2929dbb2943dad42919

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bab0aa2848f1ee6e9a0f6ad876632c9d

SHA1
2638322fa3961ecf943c3b20647208daf870e7de

SHA256
e529400497a506dbe36d4463d95d63885a36fb9f37a968be950a876419aba431

SHA512
663f903036c2398e5911bd463cec1d08d0652a6bb2ca7d47e640664301833a18707146a9de62f7424dfd293065fd4e46266ac444b4a5a91208372213183d4eaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3be6383e5e8f0c7dad38909c60aef385

SHA1
ae7c3ca400ada7c944d91a3a34478ba5023379b5

SHA256
fbeb718997b76606b32d6e57984faf6f725c18acf8bfa13f374d46c76e11e7d6

SHA512
fdd8054c8ca6bdf6e998a05a07117308774cab2872dca12d6652cbbde8f8cabad6219a8e415258ca2b1ab8ca2bb8fceaef0f5fc68c6e9890ea70a268fbbe82df

Download Submit