cef6013f9b4fb2d5ff3176d4be0585ef473e3bcc00633fe051fe5f03ff6ec625

General

Target

sample.html
Size

218KB
MD5

036cb179a20d76e2ef7d41b65727fdcf
SHA1

76cab948bf18088336df73722fef5d8af30b528d
SHA256

3440e95390b88fc997fdd9b9bad58dd94d5e48f6f8b99591df889a2e356d2c99
SHA512

3e78bd61f2b736c55fc88e43147b66c67e98b343c6125c6b3a9fb2a0012ff5df685233971e2a7a470f1ad8d6ff3cb1a8161d2ed797296a2754b93ad64de39fc5
SSDEEP

3072:SCaNsv334bf3yfkMY+BES09JXAnyrZalI+YQ:SCaK/obCsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

64 msedge.exe
64 msedge.exe
1180 msedge.exe
1180 msedge.exe
4792 msedge.exe
4792 msedge.exe
4792 msedge.exe
4792 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

1180 msedge.exe
1180 msedge.exe

pid	process
64	msedge.exe
64	msedge.exe
1180	msedge.exe
1180	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1180 wrote to memory of 720	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 720	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2912	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 64	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 64	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2376	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2376	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2376	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2376	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2376	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2376	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2376	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2376	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2376	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2376	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2376	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2376	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2376	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2376	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2376	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2376	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2376	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2376	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2376	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2376	1180	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffbab746f8,0x7fffbab74708,0x7fffbab74718
2⤵
PID:720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,15920903070621563395,11370292347403576513,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
2⤵
PID:2912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,15920903070621563395,11370292347403576513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:64

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,15920903070621563395,11370292347403576513,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
2⤵
PID:2376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,15920903070621563395,11370292347403576513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
2⤵
PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,15920903070621563395,11370292347403576513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
2⤵
PID:4012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,15920903070621563395,11370292347403576513,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1076

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
0ec38d0cf07eb5a202ad7486a1d4698d

SHA1
a6f23ce5d5eb8f54715a4427b27ecb1aab1ed0b0

SHA256
6f788bdc003705f7542cbf9c9ab0ad5d8abc842eaa02728818ba900ee11648d1

SHA512
821688548adbf02e1266591379e28b2ccb8449e2643fdd77e4ab1556c497dba657bcd2aec88dca445bbdb04f91e9fd2281a73671be0346a8478053901ca5929d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
1b7ebf53ccfd3762a10410d50f192159

SHA1
cb9a49a512103337eaf5649a51826739343719e9

SHA256
d747fc86b328203546ed0c1843f1cd9e007e76681c43b0dcc715f8bf0983f9bb

SHA512
4853539acf15ccd66c01a5ae518b3d185093d71ecab9cf2e7e6b21f8b80eee371c0fd9d0f3fc443aefcab28012fcf8a78f02519bfcf0f0b160061f6cc63a1a91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
5c65dad0e4ecd8b2f18392bb7b02054f

SHA1
d935433b58dfe5fce85ce8fcd8f47dd8e48368db

SHA256
4f4ea5c4a69abf5a570d202f0536ad5db1809bafbb3dbfa6fe27b153f658eeea

SHA512
72a82902e6f7cd8f0a918c271f67440a1a16c1cd8a66a2121632efc525b82dddc20da6f208f79a75fdab7b466e9614a9c6f4fda6bd199624e907dfa6092b2fcf

Download Submit
\??\pipe\LOCAL\crashpad_1180_QKBUOAHKPBWQLGBI
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads