247630301ff1795a994d113d50226fffe626a1501840622e32c830cfd9b02d95

Analysis

max time kernel
560s
max time network
569s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
29/04/2024, 23:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

gx.html
Size

99KB
MD5

436bf012ffc5cf1058af206b13c673e1
SHA1

1e877fddea89cace53fcaaddcd866e1c352dbfe0
SHA256

247630301ff1795a994d113d50226fffe626a1501840622e32c830cfd9b02d95
SHA512

9c59be7edd5f127d7c917266725ea10999e4c92d8d14359109c2005412e68ef888b1883b7beb3c7ecdeb6bb999d20789526d22321e5212fde66fb84c8206daa4
SSDEEP

1536:hqJerdk+KTdUJw1H2IabkpBmNhW+JoQEHcEuk8a:c2Iab7hW+3Ra

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
4648	msedge.exe
4648	msedge.exe
4488	msedge.exe
4488	msedge.exe
4552	identity_helper.exe
4552	identity_helper.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe
564	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4068	4648	msedge.exe	80
PID 4648 wrote to memory of 4068	4648	msedge.exe	80
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 1760	4648	msedge.exe	81
PID 4648 wrote to memory of 2280	4648	msedge.exe	82
PID 4648 wrote to memory of 2280	4648	msedge.exe	82
PID 4648 wrote to memory of 3992	4648	msedge.exe	83
PID 4648 wrote to memory of 3992	4648	msedge.exe	83
PID 4648 wrote to memory of 3992	4648	msedge.exe	83
PID 4648 wrote to memory of 3992	4648	msedge.exe	83
PID 4648 wrote to memory of 3992	4648	msedge.exe	83
PID 4648 wrote to memory of 3992	4648	msedge.exe	83
PID 4648 wrote to memory of 3992	4648	msedge.exe	83
PID 4648 wrote to memory of 3992	4648	msedge.exe	83
PID 4648 wrote to memory of 3992	4648	msedge.exe	83
PID 4648 wrote to memory of 3992	4648	msedge.exe	83
PID 4648 wrote to memory of 3992	4648	msedge.exe	83
PID 4648 wrote to memory of 3992	4648	msedge.exe	83
PID 4648 wrote to memory of 3992	4648	msedge.exe	83
PID 4648 wrote to memory of 3992	4648	msedge.exe	83
PID 4648 wrote to memory of 3992	4648	msedge.exe	83
PID 4648 wrote to memory of 3992	4648	msedge.exe	83
PID 4648 wrote to memory of 3992	4648	msedge.exe	83
PID 4648 wrote to memory of 3992	4648	msedge.exe	83
PID 4648 wrote to memory of 3992	4648	msedge.exe	83
PID 4648 wrote to memory of 3992	4648	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\gx.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe4efe3cb8,0x7ffe4efe3cc8,0x7ffe4efe3cd8
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,16018874681151766170,8059121338285414692,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,16018874681151766170,8059121338285414692,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,16018874681151766170,8059121338285414692,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,16018874681151766170,8059121338285414692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,16018874681151766170,8059121338285414692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,16018874681151766170,8059121338285414692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,16018874681151766170,8059121338285414692,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,16018874681151766170,8059121338285414692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,16018874681151766170,8059121338285414692,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1872,16018874681151766170,8059121338285414692,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1872,16018874681151766170,8059121338285414692,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,16018874681151766170,8059121338285414692,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5a85ad170d758e61ae5648c9402be224

SHA1
e6dfce354b5e9719bc4b28a24bb8241fc433e16f

SHA256
af0da8b5ad8127ae0ef7773bc9c4b145ed3fe7fbef4c48278649e1e3aa5ce617

SHA512
641414d91c993f74b6b71654522359d606c7f94ac0fcca6478d1bc33c30f4a9fdb9ce6f8e281c79a2f9b9670fda8a4ccdd80e7d64347c1f66d8c9ef024bcb09b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
22cececc69be16a1c696b62b4e66f90e

SHA1
b20b7f87f8bc64c1008b06a6528fc9c9da449c2f

SHA256
d940b85bc83f69e8370a801951eb6b8bb97efbb3aa427664105db76e44707258

SHA512
2b2e548f2c8f84d321ef2afdf31128065c3593b884ca8111b05800960b5378b99c7efa6165d02fba4c11e6e4b49b14e419d89f76d55ef574f4ac2b7d6ecb3d48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1617b79d-6d1e-4d35-b6eb-1949d301a0a8.tmp

Filesize
5KB

MD5
11bbc3d51b164812fd8065889b1028e9

SHA1
05220a4114e6f50aff7dedb3fcd2cc0cd1989642

SHA256
5af0302d3ec052047a815f367c462e6d37eca1e303df3455c56d008f06ac89dc

SHA512
273617bc43f8b4697ab5a753d676614c83a9b6a378cf312f177a8af9cc3e8cd033d900d596d8a8661f885285c9591f689bca96bf128b7d5ac36d3833e9bb00c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
03cf91140397d50eae3f41fe9556d6bd

SHA1
322f3bdb4d777f466b8e81a9010ad643eb9bf58a

SHA256
9450a693450c192246608874fc487efe8e6384ad8a269ffa71c5c870e6280c95

SHA512
e70a5dba221b727c051a77143179ff63a13f4469017fecd0149f11568e5931105cfbfcd7ac602665f8124928ca30230035c9b8b3f8fe1d8405fda79070264e39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
afea26cdb012d56bde7ea58a04194145

SHA1
145344b5d72a1595062d971b8405f905c8740581

SHA256
85b0bf63ad18f78647ef53ca9891dc0a819a9c8273fa61e034de67bc00143e0f

SHA512
bd12a5ada21b9e76bcf11c1503bebc8eba1d42b62144fabf628ba1b0c7d7861782003a55db2edc4b071dbb9ebea9f5a1f4adb25ada2a8c97f09142b27fbb6850

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fce50feb-966f-48d5-a9e2-d300c86e2467.tmp

Filesize
8KB

MD5
931622c1980b11e1642cd5e8524974cf

SHA1
7a3364f5b7fd7dc29e3b14d137547457b264a6e6

SHA256
b4ce0daf7c03af86f4b01248993795a7ede52b46700a5c140624d4b93fa80ca1

SHA512
aa88d712e725ffc15787a1a120b40a79be8ef2e823a9d5716840b7b67d472bc774098a063f0a095b28f2bbe95d2716a551774f696d3220833809577663c6bd8a

Download Submit