e5a4f00a5050fd2f029b4bacba9fc79c65e8f74809ee53eda02e2059352811d7

Analysis

max time kernel
145s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2024 00:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

doc/mmg.html
Size

3KB
MD5

771965599e76bf6c06f3c44b9a3d58b4
SHA1

e24c100336ddfdfd4edab407e741c0ed5b27db44
SHA256

7e28624c643df26514b203a476581d88ebcc02f7058654753fe28e22a028e30c
SHA512

f8f1300f627593dc2c6bcfae418b65d943633aac73bc3c2a45b51eaf302271cdeedd146238624a8bfd24ec205aed30fce538b7a5f67e690b48efb832ff2d1fc0

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
2380	msedge.exe
2380	msedge.exe
4576	identity_helper.exe
4576	identity_helper.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe
2380	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2064	2380	msedge.exe	87
PID 2380 wrote to memory of 2064	2380	msedge.exe	87
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 4444	2380	msedge.exe	88
PID 2380 wrote to memory of 2484	2380	msedge.exe	89
PID 2380 wrote to memory of 2484	2380	msedge.exe	89
PID 2380 wrote to memory of 924	2380	msedge.exe	90
PID 2380 wrote to memory of 924	2380	msedge.exe	90
PID 2380 wrote to memory of 924	2380	msedge.exe	90
PID 2380 wrote to memory of 924	2380	msedge.exe	90
PID 2380 wrote to memory of 924	2380	msedge.exe	90
PID 2380 wrote to memory of 924	2380	msedge.exe	90
PID 2380 wrote to memory of 924	2380	msedge.exe	90
PID 2380 wrote to memory of 924	2380	msedge.exe	90
PID 2380 wrote to memory of 924	2380	msedge.exe	90
PID 2380 wrote to memory of 924	2380	msedge.exe	90
PID 2380 wrote to memory of 924	2380	msedge.exe	90
PID 2380 wrote to memory of 924	2380	msedge.exe	90
PID 2380 wrote to memory of 924	2380	msedge.exe	90
PID 2380 wrote to memory of 924	2380	msedge.exe	90
PID 2380 wrote to memory of 924	2380	msedge.exe	90
PID 2380 wrote to memory of 924	2380	msedge.exe	90
PID 2380 wrote to memory of 924	2380	msedge.exe	90
PID 2380 wrote to memory of 924	2380	msedge.exe	90
PID 2380 wrote to memory of 924	2380	msedge.exe	90
PID 2380 wrote to memory of 924	2380	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\doc\mmg.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc55746f8,0x7ffdc5574708,0x7ffdc5574718
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,14397944035766606526,16065433009316380742,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,14397944035766606526,16065433009316380742,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,14397944035766606526,16065433009316380742,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14397944035766606526,16065433009316380742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14397944035766606526,16065433009316380742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,14397944035766606526,16065433009316380742,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,14397944035766606526,16065433009316380742,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14397944035766606526,16065433009316380742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2868 /prefetch:1
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14397944035766606526,16065433009316380742,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14397944035766606526,16065433009316380742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14397944035766606526,16065433009316380742,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,14397944035766606526,16065433009316380742,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3052 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
47b2c6613360b818825d076d14c051f7

SHA1
7df7304568313a06540f490bf3305cb89bc03e5c

SHA256
47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac

SHA512
08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e0811105475d528ab174dfdb69f935f3

SHA1
dd9689f0f70a07b4e6fb29607e42d2d5faf1f516

SHA256
c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c

SHA512
8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
88637169f6616acc253dc4ccbd731b47

SHA1
42fa3498225ec2d820d25ee51d97647960b09336

SHA256
56471fc5dbc05b9223dba1ae2192fc2c9b84154750efc2594f75645d4be8376d

SHA512
b3a85d93fe70989f9b774f19caff6c1c481c0fa6e83443b1d946c08afdc34b780aef0f47131a8cb26a4ea20e6c283fee23c63664a92575763200f30deba0cd05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5c390a802fe6da49fb19a580be2f4c27

SHA1
1a9197b9ec95aaaf39b2c617eaa1c78fcc79ef3c

SHA256
5946b69e3362765e79ccf63a3c0b2a3cef1c0f48d2d4b8ef76cf8e4ef64f8a8c

SHA512
36cfc05460e8beb963a13fe42c50d5e3b9df92185db7bbc5942c0d5762930d18132ca45d283a2278cbf24fc692593f84ff892a72137b564ff479cb2459167b85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
617726c9090e2a254ab4e1fbc771e7d6

SHA1
a685b2f0f8deff3e162129899c0a910907410ef9

SHA256
5cf3101eabd5f4addc10321f43c96bf705ce1dc730e2bd8ccde49d904cf764f0

SHA512
0a4b935a985b9ed771775b3dbb62a6165bb6730eb62e8838632ce58129ec63b715e56363c9c3fb984ed3f201a799908e8d491bbe3a59ede76dbf70c2c9b764a4

Download Submit