ae0aea25d73c3e5276017b971a0e0322b705202eb4e6524483629e59978e6305

Analysis

max time kernel
145s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 18:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.html
Size

275KB
MD5

9cc214399c9aa4dfed56939dd51e392d
SHA1

61af6efb89836791868d0f2db032f08240d7a8ce
SHA256

ae0aea25d73c3e5276017b971a0e0322b705202eb4e6524483629e59978e6305
SHA512

eb739dd71ab035f58babeecd150894ac66b76bbf6ef324997fa2a5cdcb5b190d338e09a5c9cc52242f226da0a59015d03780b10a01bba337028a0aaad843cd85
SSDEEP

3072:MiZgAkHnjPIQ6KSEX/uHjPaW+LN7DxRLlzg6r:dgAkHnjPIQBSEGDPCN7jbr

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1192	msedge.exe
1192	msedge.exe
3368	msedge.exe
3368	msedge.exe
4596	identity_helper.exe
4596	identity_helper.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 2296	3368	msedge.exe	83
PID 3368 wrote to memory of 2296	3368	msedge.exe	83
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 3720	3368	msedge.exe	84
PID 3368 wrote to memory of 1192	3368	msedge.exe	85
PID 3368 wrote to memory of 1192	3368	msedge.exe	85
PID 3368 wrote to memory of 2188	3368	msedge.exe	86
PID 3368 wrote to memory of 2188	3368	msedge.exe	86
PID 3368 wrote to memory of 2188	3368	msedge.exe	86
PID 3368 wrote to memory of 2188	3368	msedge.exe	86
PID 3368 wrote to memory of 2188	3368	msedge.exe	86
PID 3368 wrote to memory of 2188	3368	msedge.exe	86
PID 3368 wrote to memory of 2188	3368	msedge.exe	86
PID 3368 wrote to memory of 2188	3368	msedge.exe	86
PID 3368 wrote to memory of 2188	3368	msedge.exe	86
PID 3368 wrote to memory of 2188	3368	msedge.exe	86
PID 3368 wrote to memory of 2188	3368	msedge.exe	86
PID 3368 wrote to memory of 2188	3368	msedge.exe	86
PID 3368 wrote to memory of 2188	3368	msedge.exe	86
PID 3368 wrote to memory of 2188	3368	msedge.exe	86
PID 3368 wrote to memory of 2188	3368	msedge.exe	86
PID 3368 wrote to memory of 2188	3368	msedge.exe	86
PID 3368 wrote to memory of 2188	3368	msedge.exe	86
PID 3368 wrote to memory of 2188	3368	msedge.exe	86
PID 3368 wrote to memory of 2188	3368	msedge.exe	86
PID 3368 wrote to memory of 2188	3368	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\file.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff8dd846f8,0x7fff8dd84708,0x7fff8dd84718
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,4761737507500073431,6902014996903566685,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,4761737507500073431,6902014996903566685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,4761737507500073431,6902014996903566685,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4761737507500073431,6902014996903566685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4761737507500073431,6902014996903566685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4761737507500073431,6902014996903566685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4761737507500073431,6902014996903566685,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,4761737507500073431,6902014996903566685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,4761737507500073431,6902014996903566685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4761737507500073431,6902014996903566685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4761737507500073431,6902014996903566685,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,4761737507500073431,6902014996903566685,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4380 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dd43d23321f0ee81f0271dcf8cb71f08

SHA1
493bc121b9c0ec410d608cff6494d134fcd34323

SHA256
91f9dfcdaf01988f5e65cc74539074c5077245c8b84d0fbb5034f7a054231f5b

SHA512
319a9b11e0b3234faaa9e29515f62fb88f7157c4b291d0595340ecbec829b8bbb0b084ebb5122911b0f376f4856e11bb406369046b714eb9fffeff2b62f9ff46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c872072f5a6f947ebb55667d86b115aa

SHA1
f09de31091c9deaf8297e1ff3205852d076411fb

SHA256
44efdfa16e4fca4222225f9ff4a7abdee7a16e0c78c94d8a96f0d67d18d1ad3f

SHA512
a74770b76ccb77b8e4991bb28bf4b46acb1e33c6c5f42d6f7f595a3ed9670c7666f0c104c474025c75ed8f8a51acb761666b0ef8bd90530a8708d5ff7d3add8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
c1c222dc8d31303aeb1c4c4dbff44836

SHA1
2415fd11d1837a5b48560ed31ea43b1bc32bb8ed

SHA256
c4f2b22b58714924f8dc5c13eb4be9136f6cec8ac73304619bf6260a3941ed40

SHA512
2da9710166b530706cb1f6c8140d8e6f20f0cf2e1d1d47770309850a5fa1971391d3049995e02ba3bba9d9a9c4c952bf5fe01219f180c45c1d73254204da39ec

Download Submit