ed77e7e6a3986ada0d67fcd438959c60471c71c3b250992caa59f8bb7b767742

Analysis

max time kernel
145s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 11:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

exploit.html
Size

82KB
MD5

d5479b22ced00963113b6bf487ec2df4
SHA1

325e78e306b8fca16634281c4444bec95fbebda0
SHA256

7ef723e7400e714a70ec437e9fe072347fa93fac03e4be7ae0176c60638a7a4e
SHA512

f0a41af10691b078e4708d9eb770a092ca342483e2535b3daf4bb2f259d8efe4d47068af84500fe23e427535cb4ae622655292ad9cdde7a8b896ca7492aafacc
SSDEEP

1536:VN886nBkC3IGl9psZ/FClHbysK+LY9Q+FdYRuavDSA6:Z

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
4296	msedge.exe
4296	msedge.exe
4400	identity_helper.exe
4400	identity_helper.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 1144	4296	msedge.exe	86
PID 4296 wrote to memory of 1144	4296	msedge.exe	86
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 4916	4296	msedge.exe	87
PID 4296 wrote to memory of 3144	4296	msedge.exe	88
PID 4296 wrote to memory of 3144	4296	msedge.exe	88
PID 4296 wrote to memory of 3692	4296	msedge.exe	89
PID 4296 wrote to memory of 3692	4296	msedge.exe	89
PID 4296 wrote to memory of 3692	4296	msedge.exe	89
PID 4296 wrote to memory of 3692	4296	msedge.exe	89
PID 4296 wrote to memory of 3692	4296	msedge.exe	89
PID 4296 wrote to memory of 3692	4296	msedge.exe	89
PID 4296 wrote to memory of 3692	4296	msedge.exe	89
PID 4296 wrote to memory of 3692	4296	msedge.exe	89
PID 4296 wrote to memory of 3692	4296	msedge.exe	89
PID 4296 wrote to memory of 3692	4296	msedge.exe	89
PID 4296 wrote to memory of 3692	4296	msedge.exe	89
PID 4296 wrote to memory of 3692	4296	msedge.exe	89
PID 4296 wrote to memory of 3692	4296	msedge.exe	89
PID 4296 wrote to memory of 3692	4296	msedge.exe	89
PID 4296 wrote to memory of 3692	4296	msedge.exe	89
PID 4296 wrote to memory of 3692	4296	msedge.exe	89
PID 4296 wrote to memory of 3692	4296	msedge.exe	89
PID 4296 wrote to memory of 3692	4296	msedge.exe	89
PID 4296 wrote to memory of 3692	4296	msedge.exe	89
PID 4296 wrote to memory of 3692	4296	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\exploit.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ff9872f46f8,0x7ff9872f4708,0x7ff9872f4718
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,14628566310105410339,17407435306694549601,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,14628566310105410339,17407435306694549601,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,14628566310105410339,17407435306694549601,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14628566310105410339,17407435306694549601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14628566310105410339,17407435306694549601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,14628566310105410339,17407435306694549601,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,14628566310105410339,17407435306694549601,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14628566310105410339,17407435306694549601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14628566310105410339,17407435306694549601,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14628566310105410339,17407435306694549601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14628566310105410339,17407435306694549601,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,14628566310105410339,17407435306694549601,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5388 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7b56675b54840d86d49bde5a1ff8af6a

SHA1
fe70a1b85f88d60f3ba9fc7bb5f81fc41e150811

SHA256
86af7213f410df65d0937f4331f783160f30eaeb088e28a9eef461713b9a3929

SHA512
11fc61b83365391efee8084de5c2af7e064f0182b943a0db08d95a0f450d3877bde5b5e6a6b9f008e58b709bb1a34f7b50085c41927f091df1eea78f039402e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
48cff1baabb24706967de3b0d6869906

SHA1
b0cd54f587cd4c88e60556347930cb76991e6734

SHA256
f6b5fbc610a71b3914753feb2bd4475a7c77d0d785cc36255bf93b3fe3ccb775

SHA512
fd0c848f3f9de81aca81af999262f96ea4c1cd1d1f32d304f56c7382f3b1bb604e5fbe9f209ad6e4b38988d92357ef82e9668806d0727f2856c7dc1f07aae2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e7c5ae3d2d3e0d7c714dc15d7f03c957

SHA1
bced16e768d95a3eec39b639bd15909b8e9d6811

SHA256
e6f6bdb51454223187cab3b630a072051d201dca764ae86f92ab03deb43df4ad

SHA512
a4340a6f3b519b5d015b850b19b780d1034c31d34154879048be08e98f0b9d4fd266f5d56dcaac2108661f2e69458f5fcf65568a334374387ebf2b861ace5fb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3701076e286516e2c669737b6330eae8

SHA1
5f4ad796063c9fd41b4c28a88579e88447ed66ef

SHA256
2ae423e302071a03b8dbc6b3d5502be6f206fabce4242bb5bcf5af34831386c1

SHA512
0d854dafc24535fc37c720874b75a0eb858197b8cdbb8f39b8dd03dc919c28a58decc61952c39500d0859c7f56ee5012c6fe68f195b85336e471c182c86ac853

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ca166ffe85de9095fba0d4375b46e482

SHA1
19b876ef72d5ec3f7df9f3360b0b4d255a0872f5

SHA256
5bbe436364054571fe0eeb1a5d463352d7853a3e49df5397ffaa9877fa044d0e

SHA512
908802785d56059aecd0470d47eec863b9154aa1fa9bb7e771b42c854787a777860beb719614ca2463c51ade93fd3f89fc221b5c1eda66719da983f719bd890f

Download Submit