a27a1cd15a9e01cd32d61ab8efae336f4ab6caeb96e6964a7b820c8fe23fe0bd

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2024 08:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

deb7b654a53219770d1bfd3d4a7c5899.html
Size

73KB
MD5

deb7b654a53219770d1bfd3d4a7c5899
SHA1

7feffb60e794f8cc4426c7e2a09215e38a247019
SHA256

a27a1cd15a9e01cd32d61ab8efae336f4ab6caeb96e6964a7b820c8fe23fe0bd
SHA512

835b70a7da747633be9631af41cee405b60d6f870ff830214d4edee1e7c7f6ae0706cc90df981e8356ef6e58324f8e92300f2c931c57fb81ee3da7375bcd3be3
SSDEEP

1536:5IRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SE1QC:l1Qh+4DkRWc

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3964	msedge.exe
3964	msedge.exe
2780	msedge.exe
2780	msedge.exe
4300	identity_helper.exe
4300	identity_helper.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2760	2780	msedge.exe	88
PID 2780 wrote to memory of 2760	2780	msedge.exe	88
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3688	2780	msedge.exe	89
PID 2780 wrote to memory of 3964	2780	msedge.exe	90
PID 2780 wrote to memory of 3964	2780	msedge.exe	90
PID 2780 wrote to memory of 948	2780	msedge.exe	91
PID 2780 wrote to memory of 948	2780	msedge.exe	91
PID 2780 wrote to memory of 948	2780	msedge.exe	91
PID 2780 wrote to memory of 948	2780	msedge.exe	91
PID 2780 wrote to memory of 948	2780	msedge.exe	91
PID 2780 wrote to memory of 948	2780	msedge.exe	91
PID 2780 wrote to memory of 948	2780	msedge.exe	91
PID 2780 wrote to memory of 948	2780	msedge.exe	91
PID 2780 wrote to memory of 948	2780	msedge.exe	91
PID 2780 wrote to memory of 948	2780	msedge.exe	91
PID 2780 wrote to memory of 948	2780	msedge.exe	91
PID 2780 wrote to memory of 948	2780	msedge.exe	91
PID 2780 wrote to memory of 948	2780	msedge.exe	91
PID 2780 wrote to memory of 948	2780	msedge.exe	91
PID 2780 wrote to memory of 948	2780	msedge.exe	91
PID 2780 wrote to memory of 948	2780	msedge.exe	91
PID 2780 wrote to memory of 948	2780	msedge.exe	91
PID 2780 wrote to memory of 948	2780	msedge.exe	91
PID 2780 wrote to memory of 948	2780	msedge.exe	91
PID 2780 wrote to memory of 948	2780	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\deb7b654a53219770d1bfd3d4a7c5899.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb2a746f8,0x7ffcb2a74708,0x7ffcb2a74718
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,13968815059044628396,17562531342866916923,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,13968815059044628396,17562531342866916923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,13968815059044628396,17562531342866916923,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13968815059044628396,17562531342866916923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13968815059044628396,17562531342866916923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,13968815059044628396,17562531342866916923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,13968815059044628396,17562531342866916923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13968815059044628396,17562531342866916923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13968815059044628396,17562531342866916923,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13968815059044628396,17562531342866916923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13968815059044628396,17562531342866916923,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,13968815059044628396,17562531342866916923,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4952 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fd7944a4ff1be37517983ffaf5700b11

SHA1
c4287796d78e00969af85b7e16a2d04230961240

SHA256
b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

SHA512
28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
460B

MD5
c1d92eef745744beb609311bc0f47d31

SHA1
5ab3d4ba86f1ad5d233dd6c0422fc7fb1ec8df27

SHA256
148faa17e3361a4218b7a94fddccc9c7764b70448c1431e7dd3e4adb2721fbee

SHA512
41c83b2b370f4fb5630a64456b15605aadb576de97354c54306347c34f314335470144965fc24a76ac31a0b7a96286b7b30722ad31f71d474128c8363e649848

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
686538fd04ef235871a475d45bbea170

SHA1
29588f9b64860668c4134b52625135f2e6ffeba8

SHA256
ab869d9c3d9027df9eda6b3c3c0a72e86df373426fce7d336e78a4aae3aeb986

SHA512
5375fb5780df3da29e9cb0ddfb9a31b1b84d4a3e859575d429ba4322d8158b812c4c23a05342c23ed416580a984701efc66cc55bed7d99e36b44faeff317bd85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b8b08c8140c76ee092bd4840e58a145d

SHA1
6f223bc0be5145c1e9926d3d646e8017c627d345

SHA256
f3fdf2649b5c39cf73388b564f6b9fea070bb2379b0fcee98e19a9109b2eaa48

SHA512
4a837e2db6691c3d5a753abd64dad2c08502982407d442569dcbbd9c2dfaa30fe0ba140816bf178488c5590fac1c0fb5395e4ae2c6b7c84090c165602c4d4306

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
be38041a0e31c3a1751885b8c1bfceef

SHA1
7eae9e648463e269c98dcc7db864cf71fd0d6fe4

SHA256
238746c2a4e0ee5d5c6285c6f66b0116b5e93595890f4ce2e6ae0c0b17b67ac7

SHA512
c837f2b37577dd23bb57dc990f539842460c3568e7f934dbfc4b5ed9db2f04df6c30584102ebcec2f3351102f4f263a369f318817841806df081fc78d53a7512

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
74cc396078aa0148e0659eb95403012d

SHA1
50db1925274a83ddcda0eb6d8cadc282aadda8fa

SHA256
db79a23919b1c23e2b0bce072e300c21444603e0b5287dbecfd46dbe3a47a2a8

SHA512
37678bfafc78ca520385b12942c891cb231be31c6ca8e47fb29460fcdb5672d6c7c72973a47199f91761ad85f16f97df5f7014a2a4af1d9a3a796bc238b3a36d

Download Submit