3a95e59b370e34947f0e49ada973ea0844489a720d41e25b80af2e44f6bafb00

Analysis

max time kernel
279s
max time network
275s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2024, 07:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

1KB
MD5

32c07cd003bb58d9952681d975408e5f
SHA1

ea727d595c3408a6ce476b59ce0c5b62b7fe5e65
SHA256

3a95e59b370e34947f0e49ada973ea0844489a720d41e25b80af2e44f6bafb00
SHA512

b971cd846a44df7053d749e3da4cf69e24c84239134bbbdf13ca7734c1dfe0aa47a331d32e80de82d14be482fe9f51a48e6ed70767961dbf6952ef5500375b9a

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1540	msedge.exe
1540	msedge.exe
2404	msedge.exe
2404	msedge.exe
2524	identity_helper.exe
2524	identity_helper.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe
2436	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 3164	2404	msedge.exe	87
PID 2404 wrote to memory of 3164	2404	msedge.exe	87
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 976	2404	msedge.exe	88
PID 2404 wrote to memory of 1540	2404	msedge.exe	89
PID 2404 wrote to memory of 1540	2404	msedge.exe	89
PID 2404 wrote to memory of 5084	2404	msedge.exe	90
PID 2404 wrote to memory of 5084	2404	msedge.exe	90
PID 2404 wrote to memory of 5084	2404	msedge.exe	90
PID 2404 wrote to memory of 5084	2404	msedge.exe	90
PID 2404 wrote to memory of 5084	2404	msedge.exe	90
PID 2404 wrote to memory of 5084	2404	msedge.exe	90
PID 2404 wrote to memory of 5084	2404	msedge.exe	90
PID 2404 wrote to memory of 5084	2404	msedge.exe	90
PID 2404 wrote to memory of 5084	2404	msedge.exe	90
PID 2404 wrote to memory of 5084	2404	msedge.exe	90
PID 2404 wrote to memory of 5084	2404	msedge.exe	90
PID 2404 wrote to memory of 5084	2404	msedge.exe	90
PID 2404 wrote to memory of 5084	2404	msedge.exe	90
PID 2404 wrote to memory of 5084	2404	msedge.exe	90
PID 2404 wrote to memory of 5084	2404	msedge.exe	90
PID 2404 wrote to memory of 5084	2404	msedge.exe	90
PID 2404 wrote to memory of 5084	2404	msedge.exe	90
PID 2404 wrote to memory of 5084	2404	msedge.exe	90
PID 2404 wrote to memory of 5084	2404	msedge.exe	90
PID 2404 wrote to memory of 5084	2404	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9872f46f8,0x7ff9872f4708,0x7ff9872f4718
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,10901142598292980401,3187766089643514121,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,10901142598292980401,3187766089643514121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,10901142598292980401,3187766089643514121,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10901142598292980401,3187766089643514121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10901142598292980401,3187766089643514121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10901142598292980401,3187766089643514121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,10901142598292980401,3187766089643514121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,10901142598292980401,3187766089643514121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10901142598292980401,3187766089643514121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10901142598292980401,3187766089643514121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10901142598292980401,3187766089643514121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10901142598292980401,3187766089643514121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,10901142598292980401,3187766089643514121,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5612 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7b56675b54840d86d49bde5a1ff8af6a

SHA1
fe70a1b85f88d60f3ba9fc7bb5f81fc41e150811

SHA256
86af7213f410df65d0937f4331f783160f30eaeb088e28a9eef461713b9a3929

SHA512
11fc61b83365391efee8084de5c2af7e064f0182b943a0db08d95a0f450d3877bde5b5e6a6b9f008e58b709bb1a34f7b50085c41927f091df1eea78f039402e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
48cff1baabb24706967de3b0d6869906

SHA1
b0cd54f587cd4c88e60556347930cb76991e6734

SHA256
f6b5fbc610a71b3914753feb2bd4475a7c77d0d785cc36255bf93b3fe3ccb775

SHA512
fd0c848f3f9de81aca81af999262f96ea4c1cd1d1f32d304f56c7382f3b1bb604e5fbe9f209ad6e4b38988d92357ef82e9668806d0727f2856c7dc1f07aae2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
a720e99342de1cb56c8a86d63f7983d1

SHA1
c1bae5b52697ce95f919062d31606613b752ba70

SHA256
64b0783daf80ab1ee6a1e9b799dd8f2b23f8140ba365d79607fff81862bb45ee

SHA512
b45441a6b7413514775820b3f9b8b6754457156ba26fe80698cda84036ce5099270edb217ee7c0f83b193478a8e85b38710a2ddcaaa9895eabd025efd804219b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
268B

MD5
3a2abe05dfda47b090dda36cde2dbc13

SHA1
bbbb064e1fb081bf3f53fa2427de25b85e0bac8f

SHA256
9d3385f036e12cde7119c2b4c0108645bd555fe6bef857092bdd11a0b466af9e

SHA512
2d75c9b695012784f446715ebbb56e457fe3f464bc904b73bf7744efdbe8848ecd147424b68606d28775d587ec7efba81754ef902030fb03514309a3a162ea4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4a4f0417359d165752b32bb65b820f36

SHA1
0faacf6f328e53d33ef28070b8f8331d0edc386b

SHA256
cd3f17ca84b5bd5a406b36b6a7dfa9e6fedbf23b202bc4b8cc145d7018d2506a

SHA512
02b8f21211f45783aa63f69b5e2fb6ca69ee521475c0650cdd91be222982c233af9a72804712f1c32c23448408c87012612ce0e1b33e0db22d80809df088a413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8f0cef1bee6af3dbe9d5024aee448c5c

SHA1
197454b2f4bc1e2b30e0e79631ab60737ba57bd7

SHA256
fd39d19443061ce522cfcf1c20288956870b3dd0b8325d2b67938aa74a85f4ee

SHA512
e60a2f3ed0a4a4680bd34cb1c6124529a7cea03e03239f0d3cfe826c62806742b7e59ae0203b4c728c78328ad31b91a404c8b0fd02dbe0f468b1370dc7b5d808

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
71c8235f491123a38c0353e874cf49c6

SHA1
87c1f52179a8d0a628d26abe65074716af35c659

SHA256
c686ea6b3b3e865636186ee8a5653c35d8b6ba86aaae3aa2405fb02f290d52cf

SHA512
eea61931ed525a769433f0ca32dc306e7284efb72c17f2579115f8e5fdb61427f0b2e500bc37662c67c29e05c519c0ef1dbf3245c0e01802966812abbd573411

Download Submit