3bebfd51f5d8af995d06ea01aee4d71f07d6d38aac029dd7a81967c1c14c7d4b

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 07:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d597a78f898586a92316bf115c616763.html
Size

57KB
MD5

d597a78f898586a92316bf115c616763
SHA1

b72575f2a1de9290d7f5a4b10f27adf58f778f15
SHA256

3bebfd51f5d8af995d06ea01aee4d71f07d6d38aac029dd7a81967c1c14c7d4b
SHA512

d447122770508c8eb3ee0c78ea33af0ac65364e8e7998f5e45755a3b4a65c6c55ef83d299a1d9df7bb5486fa0341dd3554b941a027113b5bfec7dfd8ce210931
SSDEEP

768:8XY07DzP5d3jzdWRhWbwyGoivq2cR3gFcuN3+8l2eKlw:8h7/P5d39WRhWENo0Q3gFcuNO8l2eKlw

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe
1100	msedge.exe
1100	msedge.exe
5568	identity_helper.exe
5568	identity_helper.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe
5736	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 1348	1100	msedge.exe	88
PID 1100 wrote to memory of 1348	1100	msedge.exe	88
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 916	1100	msedge.exe	89
PID 1100 wrote to memory of 5028	1100	msedge.exe	90
PID 1100 wrote to memory of 5028	1100	msedge.exe	90
PID 1100 wrote to memory of 3108	1100	msedge.exe	91
PID 1100 wrote to memory of 3108	1100	msedge.exe	91
PID 1100 wrote to memory of 3108	1100	msedge.exe	91
PID 1100 wrote to memory of 3108	1100	msedge.exe	91
PID 1100 wrote to memory of 3108	1100	msedge.exe	91
PID 1100 wrote to memory of 3108	1100	msedge.exe	91
PID 1100 wrote to memory of 3108	1100	msedge.exe	91
PID 1100 wrote to memory of 3108	1100	msedge.exe	91
PID 1100 wrote to memory of 3108	1100	msedge.exe	91
PID 1100 wrote to memory of 3108	1100	msedge.exe	91
PID 1100 wrote to memory of 3108	1100	msedge.exe	91
PID 1100 wrote to memory of 3108	1100	msedge.exe	91
PID 1100 wrote to memory of 3108	1100	msedge.exe	91
PID 1100 wrote to memory of 3108	1100	msedge.exe	91
PID 1100 wrote to memory of 3108	1100	msedge.exe	91
PID 1100 wrote to memory of 3108	1100	msedge.exe	91
PID 1100 wrote to memory of 3108	1100	msedge.exe	91
PID 1100 wrote to memory of 3108	1100	msedge.exe	91
PID 1100 wrote to memory of 3108	1100	msedge.exe	91
PID 1100 wrote to memory of 3108	1100	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d597a78f898586a92316bf115c616763.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa728e46f8,0x7ffa728e4708,0x7ffa728e4718
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,14364123896142113373,14269193133396724698,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,14364123896142113373,14269193133396724698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2564 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,14364123896142113373,14269193133396724698,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,14364123896142113373,14269193133396724698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,14364123896142113373,14269193133396724698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,14364123896142113373,14269193133396724698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,14364123896142113373,14269193133396724698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,14364123896142113373,14269193133396724698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,14364123896142113373,14269193133396724698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,14364123896142113373,14269193133396724698,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,14364123896142113373,14269193133396724698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,14364123896142113373,14269193133396724698,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,14364123896142113373,14269193133396724698,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1408 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c6136bc98a5aedca2ea3004e9fbe67d

SHA1
74318d997f4c9c351eef86d040bc9b085ce1ad4f

SHA256
50c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2

SHA512
2d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c6aef82e50d05ffc0cf52a6c6d69c91

SHA1
c203efe5b45b0630fee7bd364fe7d63b769e2351

SHA256
d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32

SHA512
77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
177B

MD5
54db39595a09c070a41a9da2506ad332

SHA1
d792da5d1ed7cabcfcef4656083f60d65388f6e7

SHA256
acb585bcc718921a2b0c235835730cfba5af4e49be010701eda26e7562ed9ebe

SHA512
7b184e817568b1e8e42162d2af5ff2496a57adf7a9523ef64e2d25b300ee3b91ec4daed192d824c46011e012004b3d1f7cfe9ee87cc6bb278234892e211fb383

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2acb72678c3d6519cf63f64e25e74678

SHA1
64cc058bc9de1ea0427e6e9f8a07f819b4ec80c7

SHA256
c37dba39b34f8e94881d68bdb08e3e86ea62e563d97c4a6964ce38a4ac24ac38

SHA512
c8bb71074d28e40bd69eb2baae1abb5912e8f5cc31464779ddf4af46f7366c26665bda7729df7fde1c4dc875cafcb29643d585da072538561a49311e5e0bbaac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
372bc9c2241a002661bfe440e91da767

SHA1
5720206736b8eeef445d265251f2a798df79efa9

SHA256
6aedf34fe5e5e71a36bb5b75b04fcc624e3adda6d093bfd2dfa1be966e832c2d

SHA512
7bc2e2f1a38f993857bc5f003a5049a753a3bf7a4b80864d4928c299895c9e6a48da80371730c9f68c414dbe0fca63cc2f7aa070d38a9093cd9b31d4f52a9753

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
347181ecf5673e463852319553d31a7b

SHA1
79ea9560cdce1e5325856f62338d58165a3eebac

SHA256
fe22fffbb4a24cb8d33ede76e2c1c9784d847635166941eea74fb314f5717fbd

SHA512
25f52a431ff9931302d401dbeab1f58b11615c3988a4a87405104e93d58a17d88d3e5aafaeafd417dcf1528a7763be4bc9f452f1346a90e3f0060a57865f14f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b0159035e2492644250b923286ff8bd8

SHA1
2732b67424ce529261513400081c5939502df315

SHA256
0c6f43781c411b229635aa8d7de89c61dc07947342b551467432d090c47ebe07

SHA512
d820858101593ca004e9556a905023b3deea51f6994b811c381046ee35febae642991dec1baf59af7146e2198651994db1fde8af48dd4ed6dc3f4e09723e52b0

Download Submit