Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/05/2024, 03:40
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target sample.html
- Size 213KB
- Sample240503-d8mvtagc72
- SHA256 963c808a3651cfec0afaf2bbce651d3d32ecf95c37869e1a1e84f251599faf99
- MD5 81b9d4a14e8996405c52b6ee6a521a59
- SHA1 36117d7cf1b5d66dd4df8abddc29ddc672506656
- SHA512 2174734938ac2ca624fbd7b05d9e12aaab1673bf54b0e807997edada0c771ea7492fcb6aef27be4d8f4f29d7e60dd034e0130ee364642e202f55b474ea521904
- SSDEEP 3072:SSrG9Xk2UqthrcWj2NqXzLlObRyfkMY+BES09JXAnyrZalI+YQ:ShlSUsMYod+X3oI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2132 msedge.exe 2132 msedge.exe 1436 msedge.exe 1436 msedge.exe 3712 msedge.exe 3712 msedge.exe 3712 msedge.exe 3712 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1436 msedge.exe 1436 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe 1436 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1436 wrote to memory of 1208 1436 msedge.exe 81 PID 1436 wrote to memory of 1208 1436 msedge.exe 81 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 3076 1436 msedge.exe 82 PID 1436 wrote to memory of 2132 1436 msedge.exe 83 PID 1436 wrote to memory of 2132 1436 msedge.exe 83 PID 1436 wrote to memory of 4508 1436 msedge.exe 84 PID 1436 wrote to memory of 4508 1436 msedge.exe 84 PID 1436 wrote to memory of 4508 1436 msedge.exe 84 PID 1436 wrote to memory of 4508 1436 msedge.exe 84 PID 1436 wrote to memory of 4508 1436 msedge.exe 84 PID 1436 wrote to memory of 4508 1436 msedge.exe 84 PID 1436 wrote to memory of 4508 1436 msedge.exe 84 PID 1436 wrote to memory of 4508 1436 msedge.exe 84 PID 1436 wrote to memory of 4508 1436 msedge.exe 84 PID 1436 wrote to memory of 4508 1436 msedge.exe 84 PID 1436 wrote to memory of 4508 1436 msedge.exe 84 PID 1436 wrote to memory of 4508 1436 msedge.exe 84 PID 1436 wrote to memory of 4508 1436 msedge.exe 84 PID 1436 wrote to memory of 4508 1436 msedge.exe 84 PID 1436 wrote to memory of 4508 1436 msedge.exe 84 PID 1436 wrote to memory of 4508 1436 msedge.exe 84 PID 1436 wrote to memory of 4508 1436 msedge.exe 84 PID 1436 wrote to memory of 4508 1436 msedge.exe 84 PID 1436 wrote to memory of 4508 1436 msedge.exe 84 PID 1436 wrote to memory of 4508 1436 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1fe446f8,0x7fff1fe44708,0x7fff1fe447182⤵PID:1208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,2321279510552550969,17854226654117679453,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:22⤵PID:3076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,2321279510552550969,17854226654117679453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2512 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,2321279510552550969,17854226654117679453,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:82⤵PID:4508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,2321279510552550969,17854226654117679453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,2321279510552550969,17854226654117679453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:4864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,2321279510552550969,17854226654117679453,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4968 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3712
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4004
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1172
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
- MD5 1ac52e2503cc26baee4322f02f5b8d9c
- SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
- SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
- MD5 b2a1398f937474c51a48b347387ee36a
- SHA1 922a8567f09e68a04233e84e5919043034635949
- SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 fdfedc48802d5ce46571937d6290cd2a405cc2fc612c41869990c6b557db97cc
- MD5 8c6612c8f25c4f731a3c3fd1965c2877
- SHA1 82d25fea3c59b99c7d84847a46bb3cbb076e4405
- SHA512 05780ec22b9c56aeeb628cd7bd62112949fa92bd27fcd6078349a0475898de20aeb3ae4c5535e277a5f62fae0cbac8698715a6c1848916dd822a679e370a84cd
- SSDEEP 96:nokGxm/enmqG103z3ga9IQwpvWMoiVmdeHpCr1bwUWQyV+VDCAiEwb:nokrZpkzQaCQGWMXp+bwrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 90ad12f91998f91784ff16679647203a42a4f031208b900846eabad009c020e2
- MD5 5655ba04743e83eb84d7981455f5f126
- SHA1 71d7e8daf9863560db146e88d302606882907fae
- SHA512 fa9010cc84a2b376f2da865a72d880708ea738294fbd8a5572c18035eddb7f5b88270fe8bacdd53273021f0e4d3924daf98afac51872b6a58e23b40200b6c2d3
- SSDEEP 96:nokGxm/eQYmqG103zmga9IQwpvWMoiVmdeHpCr1bwUWQyV+VDCziEwb:nokrHpkz1aCQGWMXp+bwro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 99ea8ab9d3dc68d6aee0e38f43d6dff3f28810d9652d6b7b8436e0036b819fb2
- MD5 51255389412ebefd2579e2ac229a6ae9
- SHA1 611ec294d675ead2ab3fbe6e202b5ee9c58fe4be
- SHA512 c51e3d6e70e3619af3d62a5b4003df0583b4efa4728f1855bbb5507c96522a4f1d515f83dca4ef95558bbe84c672e5d7ddd60e89fe5234c3bdb3bef0f6c6d56d
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSkfe2RU8jf7Zf+OblfBhDU:A9iIxuERzA83h09RZxYSknhzZf/XDaft
- MD5 SHA1 SHA512 SSDEEP