8d2966b719685039bae7d585b935f00f49bfabd06fb5a096dc220a6f0ddeb2ca

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18-03-2024 16:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d409f1fc262cdf08059e881f387965d4.html
Size

61KB
MD5

d409f1fc262cdf08059e881f387965d4
SHA1

cc2fbef4d4a9b4eac0fca4afac1fdefc73999c6b
SHA256

8d2966b719685039bae7d585b935f00f49bfabd06fb5a096dc220a6f0ddeb2ca
SHA512

59dc01fc75925f5337c073ae129c38e8c2f3b30d796cfaf517d0461b5057cb310f462712a387b5b157ecb2a9ca35333c7305947c00cec212b512d4af95ca3c54
SSDEEP

1536:A0tbJ2NLHXHX4m0QocAM1D5ez+ov05tGkAUX/hsef:B2RHX4cocAcD5ezlv05tGkTsef

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
4752	msedge.exe
4752	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 1008	2344	msedge.exe	88
PID 2344 wrote to memory of 1008	2344	msedge.exe	88
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 2240	2344	msedge.exe	89
PID 2344 wrote to memory of 4752	2344	msedge.exe	90
PID 2344 wrote to memory of 4752	2344	msedge.exe	90
PID 2344 wrote to memory of 3932	2344	msedge.exe	91
PID 2344 wrote to memory of 3932	2344	msedge.exe	91
PID 2344 wrote to memory of 3932	2344	msedge.exe	91
PID 2344 wrote to memory of 3932	2344	msedge.exe	91
PID 2344 wrote to memory of 3932	2344	msedge.exe	91
PID 2344 wrote to memory of 3932	2344	msedge.exe	91
PID 2344 wrote to memory of 3932	2344	msedge.exe	91
PID 2344 wrote to memory of 3932	2344	msedge.exe	91
PID 2344 wrote to memory of 3932	2344	msedge.exe	91
PID 2344 wrote to memory of 3932	2344	msedge.exe	91
PID 2344 wrote to memory of 3932	2344	msedge.exe	91
PID 2344 wrote to memory of 3932	2344	msedge.exe	91
PID 2344 wrote to memory of 3932	2344	msedge.exe	91
PID 2344 wrote to memory of 3932	2344	msedge.exe	91
PID 2344 wrote to memory of 3932	2344	msedge.exe	91
PID 2344 wrote to memory of 3932	2344	msedge.exe	91
PID 2344 wrote to memory of 3932	2344	msedge.exe	91
PID 2344 wrote to memory of 3932	2344	msedge.exe	91
PID 2344 wrote to memory of 3932	2344	msedge.exe	91
PID 2344 wrote to memory of 3932	2344	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d409f1fc262cdf08059e881f387965d4.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdfb2446f8,0x7ffdfb244708,0x7ffdfb244718
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,17967219884658986866,16552569028994847390,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,17967219884658986866,16552569028994847390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,17967219884658986866,16552569028994847390,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17967219884658986866,16552569028994847390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17967219884658986866,16552569028994847390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,17967219884658986866,16552569028994847390,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4844 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17967219884658986866,16552569028994847390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:3584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
47b2c6613360b818825d076d14c051f7

SHA1
7df7304568313a06540f490bf3305cb89bc03e5c

SHA256
47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac

SHA512
08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e0811105475d528ab174dfdb69f935f3

SHA1
dd9689f0f70a07b4e6fb29607e42d2d5faf1f516

SHA256
c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c

SHA512
8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5712db9ccb9ae9c3ae24f9dae1c2b7d9

SHA1
5cc6a5864ec377f669e5ef63b12d0ec02e2dc6d2

SHA256
3d9ca4e0a19e6493fcf1a4ae411cbf3315bdd85ebe46041677bf29d9c2788139

SHA512
86c0ce4dcbefba21950884f3c53bde6be02184d358873ddad05f0abd5160ce786def083193d8ec12ffe1419d82dbaf2710a8c170e0307f9d69aceaf65cf33eb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0f400f18265809555cda324457bb44d3

SHA1
d7cfd49adcd6cd8958a1804c9bb7ddb0924025aa

SHA256
202ecbf57a432ba55cb97ae134dd1f4bc5aa94120636e49ac2dcac5f0747c703

SHA512
26c6cbf6e287650bcbacf1b972bb5095c8a8c7366b439d99f3af8820c4d710b2071ef705f55de1e332397b43a363cc250f8e08d3e08372d98949baba65431871

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
409839d1de52008e4b18b4e0cfdac7ea

SHA1
a2bea85193c565baf80a228c1a86efbcbcd358a1

SHA256
70ff4969cd6e2ce7331df266c395abf9513596ae75e28c8bcfa0fd454f1a2278

SHA512
2af4320045031cfc761fb00e7602ada5ecec10c8941f40b1b215507766866febc54cc3fa08e682fac38c6d22b978e68135c4bfa344643d3e2e50046d67fe7018

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
86e9afc8206958d7a2691388e8448f42

SHA1
fe72b8772c36ed35c3f7e546b085f1265568dc18

SHA256
2dc0f3d0e1a7fa8130ea8ffa3a9c9a44ae0465cc4a7176c727fdc820f46712c9

SHA512
18de3bbace26bf70955530cebb27cfd588517dac7ff4b99447f06b4061739750eb97f109de0ae74d914ade3b56a492d7e7650df3d361e451d2f7960c877eafa5

Download Submit