Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27-04-2024 22:30
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240426-en
General
-
Target
sample.html
-
Size
213KB
-
MD5
7d3c199dedbb2053ab067d42e372dc73
-
SHA1
e22b19c12cbe54beaafd3374e534254910207a12
-
SHA256
b0e972f7c0b0ae84847811b10ccd4282e560312706ac0d5aeb6fcfb28286b0fe
-
SHA512
7f295148396f72688ed849755633afb395a798b3bceba8c009cfec6dec256a986a53002e570245cc0d2ec182afdc8788afed93fb47569483cf00c64debad5fbf
-
SSDEEP
3072:SljdOLdJVPtyfkMY+BES09JXAnyrZalI+YQ:SlmJ4sMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
msedge.exemsedge.exemsedge.exepid process 1456 msedge.exe 1456 msedge.exe 3604 msedge.exe 3604 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
msedge.exepid process 3604 msedge.exe 3604 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe 3604 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3604 wrote to memory of 4208 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4208 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 4676 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 1456 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 1456 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 8 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 8 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 8 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 8 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 8 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 8 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 8 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 8 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 8 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 8 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 8 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 8 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 8 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 8 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 8 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 8 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 8 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 8 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 8 3604 msedge.exe msedge.exe PID 3604 wrote to memory of 8 3604 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff92b6e46f8,0x7ff92b6e4708,0x7ff92b6e47182⤵PID:4208
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,14459990718391904271,9763500073645510280,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:22⤵PID:4676
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,14459990718391904271,9763500073645510280,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1456 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,14459990718391904271,9763500073645510280,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:82⤵PID:8
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14459990718391904271,9763500073645510280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:3708
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,14459990718391904271,9763500073645510280,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵PID:3064
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,14459990718391904271,9763500073645510280,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4840 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5020
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1172
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3104
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5ae54e9db2e89f2c54da8cc0bfcbd26bd
SHA1a88af6c673609ecbc51a1a60dfbc8577830d2b5d
SHA2565009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
SHA512e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5f53207a5ca2ef5c7e976cbb3cb26d870
SHA149a8cc44f53da77bb3dfb36fc7676ed54675db43
SHA25619ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
SHA512be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD50606ae34861e4395d2004bdf20bf8527
SHA19249c855de473e2d1def85253f469a1a47253dbf
SHA25670043663dbd84529cd1474602ae44153059c81402d72437c846de4b79a4da8c2
SHA51200188abdf95a10287c6eacc78be058d7d8d75b1cbb9f95fff4de3763645ccb19e7336228469c34aa7167b178da0e501dc6847fd3561b376dd2dba2f819529756
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD58758f36f9234740ab6c5c65e89d2f92f
SHA1b529cce5328e42889029e92667ee4defc7b41140
SHA2565535e92f0ee70eeaffbb0d7cc4790c209b2d5927830a9ee531eaaed9c5e92c66
SHA51254109ba77b6e306b9c75e5ea164741b6dc86f1afe0cb882332592966d78abef60f2c6ddb893ebc39dfcf4975377ce56d8f1296c740b2a385d4efc1fa76c3588a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD51d0c524df64c32dad87ede3922a8f72f
SHA17dda4150f344b11faebc711acbf59aa0ceef7764
SHA2562de741bc592e2ab28fdae683330152de29a9e0cb9c51676f1446d2e0a5c0318f
SHA512720d7cea752305ab26718058e1b4fe0b84659619a65685bae1b6fd1b4c1669e75e768d9acd429a898eb43b6dfb985acfb5e4f06e23f75fb0534c415f6f75a498
-
\??\pipe\LOCAL\crashpad_3604_EASPZFTIOARMINEUMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e