78f92034e601133239fcaca27e06e400159f89e49090d7d5793555b15c6a6513

Analysis

max time kernel
40s
max time network
42s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
15-04-2024 13:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

email-html-2.html
Size

18KB
MD5

bf4f5505a0789c050fe4a126ec4813b6
SHA1

4423c638be1e6b19ad89605ea8c0b0987011e2ae
SHA256

d9545b0586dce1c31eaefef171fba41e65cb47ff76df46f1413a72e0ad07b1c6
SHA512

9efa70d8981b13f8f6667a5712527e3b57680e67cd661e7a349f8cb43f850b1154c5d87c98336ccc84f4786a5cd94ce24c43b0998f49e73017cd8824ece32698
SSDEEP

192:2O6jg3MJy4pyMJymKQOZwMdymLUMZymaZQUFDVh65X+o3D3WY39sMJy4pO2d:2OH/72RzFbYT3FiV2d

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
1112	msedge.exe
1112	msedge.exe
4084	msedge.exe
4084	msedge.exe
976	identity_helper.exe
976	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	240	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	240	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 4036	1112	msedge.exe	77
PID 1112 wrote to memory of 4036	1112	msedge.exe	77
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4376	1112	msedge.exe	78
PID 1112 wrote to memory of 4048	1112	msedge.exe	79
PID 1112 wrote to memory of 4048	1112	msedge.exe	79
PID 1112 wrote to memory of 2344	1112	msedge.exe	80
PID 1112 wrote to memory of 2344	1112	msedge.exe	80
PID 1112 wrote to memory of 2344	1112	msedge.exe	80
PID 1112 wrote to memory of 2344	1112	msedge.exe	80
PID 1112 wrote to memory of 2344	1112	msedge.exe	80
PID 1112 wrote to memory of 2344	1112	msedge.exe	80
PID 1112 wrote to memory of 2344	1112	msedge.exe	80
PID 1112 wrote to memory of 2344	1112	msedge.exe	80
PID 1112 wrote to memory of 2344	1112	msedge.exe	80
PID 1112 wrote to memory of 2344	1112	msedge.exe	80
PID 1112 wrote to memory of 2344	1112	msedge.exe	80
PID 1112 wrote to memory of 2344	1112	msedge.exe	80
PID 1112 wrote to memory of 2344	1112	msedge.exe	80
PID 1112 wrote to memory of 2344	1112	msedge.exe	80
PID 1112 wrote to memory of 2344	1112	msedge.exe	80
PID 1112 wrote to memory of 2344	1112	msedge.exe	80
PID 1112 wrote to memory of 2344	1112	msedge.exe	80
PID 1112 wrote to memory of 2344	1112	msedge.exe	80
PID 1112 wrote to memory of 2344	1112	msedge.exe	80
PID 1112 wrote to memory of 2344	1112	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8ac123cb8,0x7ff8ac123cc8,0x7ff8ac123cd8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,1659615112871359814,16369877549821373028,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,1659615112871359814,16369877549821373028,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,1659615112871359814,16369877549821373028,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1659615112871359814,16369877549821373028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1659615112871359814,16369877549821373028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,1659615112871359814,16369877549821373028,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4052 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,1659615112871359814,16369877549821373028,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1659615112871359814,16369877549821373028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1659615112871359814,16369877549821373028,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1659615112871359814,16369877549821373028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1659615112871359814,16369877549821373028,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1659615112871359814,16369877549821373028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,1659615112871359814,16369877549821373028,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1900,1659615112871359814,16369877549821373028,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2464 /prefetch:8
  2⤵
  PID:1156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2380

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004E0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54caf18c2cda579e0dad6a9fc5179562

SHA1
357d25de14903392900d034e37f5918b522e17c9

SHA256
28d77529de92eb605d8afee0e133a7d08e13d4386e5e38d63e2da34623eaad6b

SHA512
88da5a33df9d82408afb8344ec7dbaf7686435fdb55eccfb85d5560f39861e84cef5d71949d5efe7a191778e6be755a8448f3fc3d7043007037f9f5227e10210

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
696ffba7b83ecf008523e96918f200d9

SHA1
970d90e22c8b3674fc33cdd1913c51ef28514255

SHA256
dc6dacd725d7385b2e4db1f488d93f2840d2289efdaaf3737849304d1ab9ba34

SHA512
f8528683b70b58376f3eba3338fa6b462c9e9248c72524573005cff6397a0556bdcc2fdc2ebb020ba8218bc8174ba552002f223a245dfe3d3688826d24d63237

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
94016c98a8b32ac12ee7a0e31b4d297a

SHA1
86fab184cadb913ac596a81c59fb2705a48bfcf3

SHA256
98981ddb99c521cb3554c7b3fe1f33ed67b9670ef344e49d03b149aeb1e319bd

SHA512
c8e2f0a9248ff70d9b19d1cbe138c3a743e10c6ec5754dbedc9983fd6368bab3eb4ccb55f2f2bf306acf4a18fe7170496b034c0f8c78b83e9f498193cfde658e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d27bafe8bf9b1c6c337343b5b9cfa7c4

SHA1
d8c2f1851f4687325a71cd7908636325eefff9a1

SHA256
5f785aa5d980f4627e089843955c15b74dbc493640f1e23baef1057993b15801

SHA512
002b7de1bfaabcf74d5154c12396d6866a00a19a89f21dd16392be94a6f1cd33666ee12163e6f35b6b0992481774aa2115bc744a26a294b4b5d8960ad1ab1a0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1821d96b0dcc6f4461259fc291fcf0f1

SHA1
d2532b67237828342273b8cda2faa974634f47f2

SHA256
92af7d77f90098682c35f35de4c7dfd49e71b7928f388f99ac985216355762f0

SHA512
4c0b62049b297f6e9fa7f7d950c9779d35c2d6800b23c4e835b653090e4f3acee76c5b0902a29dfe63fa0b65b9ba8fc77127c6c24c35672e765dd0178a2754c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2b6f964d81bb1c5f02a3fb42c7c81a35

SHA1
f8db74cc31773b7f9bbcd45cd395a50db945feda

SHA256
961f7a3183c1a545615a623345aa5ca06c3aeed37d34580d249a5c5f73a29b11

SHA512
7ad941577085e2c6db0c8f79b3805e3f35312e5f9fafc219b8edc2f270a36a598aab56358f511088a6e275861e142463db0719824ae331488f997a6f5ab09619

Download Submit