32f2fa940d4b4fe19aca1e53a24e5aac29c57b7c5ee78588325b87f1b649c864

General

Target

.html
Size

146B
MD5

9fe3cb2b7313dc79bb477bc8fde184a7
SHA1

4d7b3cb41e90618358d0ee066c45c76227a13747
SHA256

32f2fa940d4b4fe19aca1e53a24e5aac29c57b7c5ee78588325b87f1b649c864
SHA512

c54ad4f5292784e50b4830a8210b0d4d4ee08b803f4975c9859e637d483b3af38cb0436ac501dea0c73867b1a2c41b39ef2c27dc3fb20f3f27519b719ea743db

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3512	msedge.exe
3512	msedge.exe
3024	msedge.exe
3024	msedge.exe
1668	identity_helper.exe
1668	identity_helper.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

3024 msedge.exe
3024 msedge.exe
3024 msedge.exe
3024 msedge.exe
3024 msedge.exe
3024 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe
3024	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3024 wrote to memory of 3144	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 3144	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 180	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 3512	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 3512	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 4872	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 4872	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 4872	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 4872	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 4872	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 4872	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 4872	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 4872	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 4872	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 4872	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 4872	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 4872	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 4872	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 4872	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 4872	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 4872	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 4872	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 4872	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 4872	3024	msedge.exe	msedge.exe
PID 3024 wrote to memory of 4872	3024	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff283846f8,0x7fff28384708,0x7fff28384718
2⤵
PID:3144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,14983253500320862940,4877349360965587727,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
2⤵
PID:180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,14983253500320862940,4877349360965587727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,14983253500320862940,4877349360965587727,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
2⤵
PID:4872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14983253500320862940,4877349360965587727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
2⤵
PID:4736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14983253500320862940,4877349360965587727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
2⤵
PID:3624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14983253500320862940,4877349360965587727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
2⤵
PID:3608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14983253500320862940,4877349360965587727,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
2⤵
PID:3628

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,14983253500320862940,4877349360965587727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:8
2⤵
PID:1588

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,14983253500320862940,4877349360965587727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14983253500320862940,4877349360965587727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
2⤵
PID:4760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14983253500320862940,4877349360965587727,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
2⤵
PID:4500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,14983253500320862940,4877349360965587727,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5560 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36bb45cb1262fcfcab1e3e7960784eaa

SHA1
ab0e15841b027632c9e1b0a47d3dec42162fc637

SHA256
7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae

SHA512
02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1e3dc6a82a2cb341f7c9feeaf53f466f

SHA1
915decb72e1f86e14114f14ac9bfd9ba198fdfce

SHA256
a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c

SHA512
0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
79792b72e1e816f0fd32eeb4a5de78ec

SHA1
f03b1adc3a41327c8fb1889c7467ec43bceb2a40

SHA256
2723097c971fa1a54c648413cbd3e1fa3c932e26b0881546a0fa1586157ab734

SHA512
ef97c578de3de6bc26c7fc1f7da079539785e50515a3b5e29f551cc63a394477ddcfdcb036611385dc6f99218b69e3545a18ba54945b8c93350ad14b77dc0cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bed9b6e96774e3699269b89d984d5b02

SHA1
921a5bea0de18d5150dda7b156d8aad022b8d96f

SHA256
97d583853bdf6069b1517a2ea0c8a10ca7edb2589e9e6b533961aed67f6f4f3c

SHA512
ef1d01969c572e25b433a76db640e7d10856796df8c6df38d51033d8fbedc2e6cbf4b5f81f6f8c7fe4d3bc94c6f8aa287f0ba9e1c135f83b45dcf527210aae6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
112eb2081c1c1902d2ee11d55b6569cb

SHA1
fc0330d26d556f4c0bee9199b552623131e1e240

SHA256
951e4ce90156d4fd374f0b6285eb684ebf4205a142ff6fffc4640949d264f14e

SHA512
a5444d000b20479030417d98b6efb983b778e6d21aa7a349cb373dc85572ee7558899d1f106f1678a2e3813c8a1667ccf1f918d98ab9013ed5107c8ba611043b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dd4fab200fa966ac5245fab4b016bfc2

SHA1
9d644fe060aab1f80097a54fa454bf38d71f5cea

SHA256
a53a77607d89ab82b7223f13ea780d5e400367341d12cf8588d8c71832b4820c

SHA512
dbdefff04578ad0149fea4d9fbc52c9ff3004cbf4d9bb44bfdb53a38e262c556c42931d69642634468c696418dbd88b4fbc608a77475ba1aa71ebdb61eafe914

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads