7aefdc32563ff3550385d9ed676f521372e02794d28036465b54cd675779322a

Analysis

max time kernel
1172s
max time network
1173s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
25/04/2024, 06:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

18KB
MD5

c072cb6b020cf616982d3d3ba7b66c28
SHA1

7656b60414282537cbea4c3e7e595be4bfbf4d61
SHA256

7aefdc32563ff3550385d9ed676f521372e02794d28036465b54cd675779322a
SHA512

f63601d7b30086588d9debd9508f8704e91772d4fcf9511f5a47d65e135906d4d7b7b3a8575bf71921f62887f376c41c5de2fd530a9f6ef476917b643bce0da1
SSDEEP

384:rJc86VDpmReVoOs4mi9ylKeGMXU8Hhhb34I7k5S2LjFrSQ+AVJCBXQL:rJj6VBVoOs4mmyI1MvBhbomgFrSWJQQL

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe
2364	msedge.exe
2364	msedge.exe
4100	msedge.exe
4100	msedge.exe
4572	identity_helper.exe
4572	identity_helper.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe
2364	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2064	2364	msedge.exe	79
PID 2364 wrote to memory of 2064	2364	msedge.exe	79
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 4608	2364	msedge.exe	80
PID 2364 wrote to memory of 5048	2364	msedge.exe	81
PID 2364 wrote to memory of 5048	2364	msedge.exe	81
PID 2364 wrote to memory of 3948	2364	msedge.exe	82
PID 2364 wrote to memory of 3948	2364	msedge.exe	82
PID 2364 wrote to memory of 3948	2364	msedge.exe	82
PID 2364 wrote to memory of 3948	2364	msedge.exe	82
PID 2364 wrote to memory of 3948	2364	msedge.exe	82
PID 2364 wrote to memory of 3948	2364	msedge.exe	82
PID 2364 wrote to memory of 3948	2364	msedge.exe	82
PID 2364 wrote to memory of 3948	2364	msedge.exe	82
PID 2364 wrote to memory of 3948	2364	msedge.exe	82
PID 2364 wrote to memory of 3948	2364	msedge.exe	82
PID 2364 wrote to memory of 3948	2364	msedge.exe	82
PID 2364 wrote to memory of 3948	2364	msedge.exe	82
PID 2364 wrote to memory of 3948	2364	msedge.exe	82
PID 2364 wrote to memory of 3948	2364	msedge.exe	82
PID 2364 wrote to memory of 3948	2364	msedge.exe	82
PID 2364 wrote to memory of 3948	2364	msedge.exe	82
PID 2364 wrote to memory of 3948	2364	msedge.exe	82
PID 2364 wrote to memory of 3948	2364	msedge.exe	82
PID 2364 wrote to memory of 3948	2364	msedge.exe	82
PID 2364 wrote to memory of 3948	2364	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdf66c3cb8,0x7ffdf66c3cc8,0x7ffdf66c3cd8
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,792050359930805177,10154906964107137249,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,792050359930805177,10154906964107137249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,792050359930805177,10154906964107137249,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,792050359930805177,10154906964107137249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,792050359930805177,10154906964107137249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,792050359930805177,10154906964107137249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3964 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,792050359930805177,10154906964107137249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,792050359930805177,10154906964107137249,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,792050359930805177,10154906964107137249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,792050359930805177,10154906964107137249,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,792050359930805177,10154906964107137249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,792050359930805177,10154906964107137249,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4712 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
57e5c5a9236321d336e2c8ce1eeff844

SHA1
8fd4288af72ba3f7a0ecc5583a9265723fefc096

SHA256
ae6496cf397848bf3139858deaf567e3df991bab5a7704a0fa7aae95474872d7

SHA512
bc3f24afe6ce0494022d8201a01a60239ac5cfee54e0650a337036817056424b418cb636d58d07e5034dffe2226906202b56509e4cc07562c0b60f618c420080

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
493e7e14aceba0ff1c0720920cccc4a2

SHA1
468f39cefbcf14a04388b72d4f02552649bf3101

SHA256
a0dd32ed60115f661a4ca537472e0d4e230ff844d56a3db766299cf4cd817842

SHA512
e16c748e4513ea10bf7124cef7b50dc5f3a1802205af9228e0c33fdbf3c24286739db08db4b813079ed7cc36be43d7457f4c26f00ae3126a2fafd77d2696107a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b0c9a5e40b34fc2523bc54f14e16d66e

SHA1
e1393bc3142b69dd375dbe250457361ceeeed725

SHA256
9579fcc11997c8322d9a68836aec82ed5ef25da77c7dad9429e71b5edb1450b6

SHA512
d828beba61783853fa76778cb90fdafe5000d2710963426c47e6690411a7650180f4c0f193b49654a1cb3081290b7423c0e6e76ada38ea23328a4f25fb505bb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8b5d3cb2adaba8a33c2aef77ca63c6df

SHA1
d8eb889ada01fdd7a6e75c7fdb22c9d8e2f954f3

SHA256
9c1ec3d86163a53c0693db39b3fb5af0f528061e930a99fb1dfc84a21ade6584

SHA512
ed8d5b00ce1f09999f6198ff40e1a78e9fce0318655502f50817aead43a32316ad17aee8b3ea3072f9f8d86cf3023587ef8654b28c2a678eb1d9c1080b1572bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
55f8a22e3c2292de3db5c5649677dc9a

SHA1
3cd68bc63fa45581c0cec67d384a53b7aa7be975

SHA256
ffe613aebb4769508eff7c714ba9fb07369d53fed89d5f75eeda9e74499f6b8b

SHA512
28372fce398418f17b09a1d11a47ee371d14ac6b77e1cdc3a732d3c29755d5c230151c2cae908e54ffc7d2b44b8ceaeedd2421dccaaef4f18ee1db2b8cffd7cb

Download Submit