fed56e9fac13ab5ffadd464b32eda5a20cb6d1e0c06501676a5c7693b5ca5909

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df8ae16ab1e6d7ddcac81529adedb7e5.html
Size

239KB
MD5

df8ae16ab1e6d7ddcac81529adedb7e5
SHA1

90965e71598f541c474d7785044550c250eb20bf
SHA256

fed56e9fac13ab5ffadd464b32eda5a20cb6d1e0c06501676a5c7693b5ca5909
SHA512

88da707f8f17f6463e7aacd5433d4b9066a0aebd36150db921d0fef068ddb3d6a2abf188b296f676edb9d24ec7636d8a994941ee79005ef8fa79f0d5d2db6d27
SSDEEP

3072:b+cyfkMY+BES09JXAnyrZalI+YeyfkMY+BES09JXAnyrZalI+YW:msMYod+X3oI+Y7sMYod+X3oI+YW

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2536	msedge.exe
2536	msedge.exe
3484	msedge.exe
3484	msedge.exe
5108	identity_helper.exe
5108	identity_helper.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 4868	3484	msedge.exe	89
PID 3484 wrote to memory of 4868	3484	msedge.exe	89
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 3436	3484	msedge.exe	90
PID 3484 wrote to memory of 2536	3484	msedge.exe	91
PID 3484 wrote to memory of 2536	3484	msedge.exe	91
PID 3484 wrote to memory of 4220	3484	msedge.exe	92
PID 3484 wrote to memory of 4220	3484	msedge.exe	92
PID 3484 wrote to memory of 4220	3484	msedge.exe	92
PID 3484 wrote to memory of 4220	3484	msedge.exe	92
PID 3484 wrote to memory of 4220	3484	msedge.exe	92
PID 3484 wrote to memory of 4220	3484	msedge.exe	92
PID 3484 wrote to memory of 4220	3484	msedge.exe	92
PID 3484 wrote to memory of 4220	3484	msedge.exe	92
PID 3484 wrote to memory of 4220	3484	msedge.exe	92
PID 3484 wrote to memory of 4220	3484	msedge.exe	92
PID 3484 wrote to memory of 4220	3484	msedge.exe	92
PID 3484 wrote to memory of 4220	3484	msedge.exe	92
PID 3484 wrote to memory of 4220	3484	msedge.exe	92
PID 3484 wrote to memory of 4220	3484	msedge.exe	92
PID 3484 wrote to memory of 4220	3484	msedge.exe	92
PID 3484 wrote to memory of 4220	3484	msedge.exe	92
PID 3484 wrote to memory of 4220	3484	msedge.exe	92
PID 3484 wrote to memory of 4220	3484	msedge.exe	92
PID 3484 wrote to memory of 4220	3484	msedge.exe	92
PID 3484 wrote to memory of 4220	3484	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\df8ae16ab1e6d7ddcac81529adedb7e5.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd7bd646f8,0x7ffd7bd64708,0x7ffd7bd64718
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,8565960414319052662,9886423071803303826,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,8565960414319052662,9886423071803303826,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,8565960414319052662,9886423071803303826,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8565960414319052662,9886423071803303826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8565960414319052662,9886423071803303826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,8565960414319052662,9886423071803303826,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,8565960414319052662,9886423071803303826,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8565960414319052662,9886423071803303826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8565960414319052662,9886423071803303826,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8565960414319052662,9886423071803303826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8565960414319052662,9886423071803303826,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,8565960414319052662,9886423071803303826,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4832 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
47b2c6613360b818825d076d14c051f7

SHA1
7df7304568313a06540f490bf3305cb89bc03e5c

SHA256
47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac

SHA512
08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e0811105475d528ab174dfdb69f935f3

SHA1
dd9689f0f70a07b4e6fb29607e42d2d5faf1f516

SHA256
c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c

SHA512
8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
183B

MD5
a28fc8c7b408c9fec7eb29ba72319a1a

SHA1
2b1815d04fb077e076a7c078db984304b82cf50e

SHA256
1d26a34f3b686ef9b0f4402fd77dbbf4e517c3a60d31f19751f038953abe9e65

SHA512
6a6f10e0011b2e2f335d65b2b5da07e47e06aa5eeb22ac8950f63928c18242952d216526c8a2ba909ad04fdaf073215c4277272c6de2a28c7cb39a211f0a78bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
db84859a9f71a3a26eb26059073814a5

SHA1
58f27c867502c3950893898674ed476551a12227

SHA256
04510ea02703e2c3b1964e9b48ca4f536abebfcc3749afbc9869ac8a171eb08e

SHA512
321c63173b47c4cf9a0d8e0ffb1eef0ffe209c79a131be503d86ff80ba2bc21d63d1375a3a40e0dacad4178d7ab089d8197ca0c6696b885225cc434a5468be47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4287b69220ddac9f7e4c1fede737b300

SHA1
ca09ded50ffbcb274cccb6d3ebe6746088fd7ffb

SHA256
86cd15f51159e2df301807d28c75f5701a05a556e612d51a86b7a152e2407494

SHA512
8a1f528c1af4391b94134a82bf33cb252b4fc9f0015601145d48207b2911fce676eb23693d306f926af175f25558939b328f2a5646b0601fb3088d71feb36ebc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5c7291c1e4fb94957d6af7eee05808a7

SHA1
8198636b2ee91b65bd11830ce255e0299f690783

SHA256
e14c35a030e32f5fb5c1b4b3060ad9a5e9fd8813d61808c28dde831c3fa653eb

SHA512
9ba532e1eff569cf90c7112ce292d1d3dca05a71deb5d61e6b7df53287993b1ed6d902b34a83dfeaf186408baa7fec2f13ce3720ece55b91d40c7903e6aa336d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2312f77501c24e66ac642c8dbf7ab50a

SHA1
2668e8784643fb605373b1428e669ad2e28724fe

SHA256
b3ba1e14e411771c7ca318c3a2423b04afee2793b44c0077b0579637dedfeef9

SHA512
e746ea9c74a95a1db959176e23d612eb5d43e5d3056b9a152e8e418862e10ffabfa12317a1472e4b690b585568061b6598335b0ad749a74541120926c4146453

Download Submit