fd4d7cd3bc4c865d3752547a15d7199f3c29dafa7550cec33ebc10ea40628aba

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 13:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

efebf7ffb22463f96e69bdc997668984
SHA1

1e1b15c8a311eff6607b93fa5b09d224be3366e4
SHA256

bb0add0e260b8113bb94d782dbfa96f16ba4c8b66ea5cbe6e830d9eab4b9dce3
SHA512

19d8da7014203be31f5856063c305a37c05a7d43a3e9de83dde0851c8a1a19b32a9209b5860577dfcd17417060a1599833b82be5f8376c7576c028ac2d83f696
SSDEEP

3072:SfMNHfEEptYsyfkMY+BES09JXAnyrZalI+YQ:SfrnRsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
1116	msedge.exe
1116	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1116	msedge.exe
1116	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 1152	1116	msedge.exe	86
PID 1116 wrote to memory of 1152	1116	msedge.exe	86
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 3492	1116	msedge.exe	87
PID 1116 wrote to memory of 4948	1116	msedge.exe	88
PID 1116 wrote to memory of 4948	1116	msedge.exe	88
PID 1116 wrote to memory of 2872	1116	msedge.exe	89
PID 1116 wrote to memory of 2872	1116	msedge.exe	89
PID 1116 wrote to memory of 2872	1116	msedge.exe	89
PID 1116 wrote to memory of 2872	1116	msedge.exe	89
PID 1116 wrote to memory of 2872	1116	msedge.exe	89
PID 1116 wrote to memory of 2872	1116	msedge.exe	89
PID 1116 wrote to memory of 2872	1116	msedge.exe	89
PID 1116 wrote to memory of 2872	1116	msedge.exe	89
PID 1116 wrote to memory of 2872	1116	msedge.exe	89
PID 1116 wrote to memory of 2872	1116	msedge.exe	89
PID 1116 wrote to memory of 2872	1116	msedge.exe	89
PID 1116 wrote to memory of 2872	1116	msedge.exe	89
PID 1116 wrote to memory of 2872	1116	msedge.exe	89
PID 1116 wrote to memory of 2872	1116	msedge.exe	89
PID 1116 wrote to memory of 2872	1116	msedge.exe	89
PID 1116 wrote to memory of 2872	1116	msedge.exe	89
PID 1116 wrote to memory of 2872	1116	msedge.exe	89
PID 1116 wrote to memory of 2872	1116	msedge.exe	89
PID 1116 wrote to memory of 2872	1116	msedge.exe	89
PID 1116 wrote to memory of 2872	1116	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0x100,0x104,0xe4,0x108,0x7ff9ae6946f8,0x7ff9ae694708,0x7ff9ae694718
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,17966500194451498125,4292336993826076740,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1988,17966500194451498125,4292336993826076740,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1988,17966500194451498125,4292336993826076740,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,17966500194451498125,4292336993826076740,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,17966500194451498125,4292336993826076740,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,17966500194451498125,4292336993826076740,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5200 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cff358b013d6f9f633bc1587f6f54ffa

SHA1
6cb7852e096be24695ff1bc213abde42d35bb376

SHA256
39205cdf989e3a86822b3f473c5fc223d7290b98c2a3fb7f75e366fc8e3ecbe9

SHA512
8831c223a1f0cf5f71fa851cdd82f4a9f03e5f267513e05b936756c116997f749ffa563623b4724de921d049de34a8f277cc539f58997cda4d178ea205be2259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc629a750e345390344524fe0ea7dcd7

SHA1
5f9f00a358caaef0321707c4f6f38d52bd7e0399

SHA256
38b634f3fedcf2a9dc3280aa76bd1ea93e192200b8a48904664fac5c9944636a

SHA512
2a941fe90b748d0326e011258fa9b494dc2f47ac047767455ed16a41d523f04370f818316503a5bad0ff5c5699e92a0aaf3952748b09287c5328354bfa6cc902

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
65552d55b161076e516534c884cf2e1c

SHA1
2bc4836adbab8816b69fa95940fd15fb00d4a7ef

SHA256
bfa52b947e78bc21222c41af68a4e692f00250b4ebbd3773d2ed36d931275970

SHA512
8ba6d3ed9a0f59c061a0c785e12c14d78549291797e7b38fc9cdef65d7d3060b4fcc6f77bce4d7cd4dade08e4bf99501d3e4cd7d91a2aa9d5538480bca834312

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
44867c4e1efe2facdcef688a796f36f2

SHA1
6509a6d3489b9787c4ef9404e52fabc978755252

SHA256
38fabdce078c78c1003eaff42aeef5ed4551acc4f600db0eefbc5fb212caca35

SHA512
851ff465040c94050eaa7f95a62a102c3040afe130c8a9dfc3a6f2a7ec841867d92f65bcb6670154ce21abffee64f1172416ad9438e51dedb8195f8af4595b81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3fb9103e947a12d6aad87bad511eb98e

SHA1
30e45e9d11fdc3b107df8ba1be30e4ea8b61d6df

SHA256
ce5d2468c64dd4b2274af077268fbeabdeca7acf03661413b40e3b2e2ed7c54f

SHA512
5c7e670b6ffafecd00654f1a3b584e6bdded5807849da2e9f5dadc91a495d46e81e92450332b941c3989228ffe70d0d84facc838e501ba7810ea234db9cf534f

Download Submit