e053d95447f1ff857a7e1837075155f56e182d2c179b0bcef44d954c04643988

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

41915264ac302de93d2ea91337d505b9
SHA1

e661f3d0a0ecc53cbd6b909de8d79f182b532807
SHA256

d7e46a74d4e417e2f762c29f4f0814ccbcd98cd652dce74eef2e12d8b7bbc871
SHA512

57d443572553649d2f82367b41e139bdfa8a3fbe6d1f8bad16a7e65c9acc28e78d03c362929bde87af505d0d98f84fe53c0ff119777b94b2121440be28514717
SSDEEP

3072:SFyNOIbbmD+84yfkMY+BES09JXAnyrZalI+YQ:SF6aB1sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1664	msedge.exe
1664	msedge.exe
4416	msedge.exe
4416	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe
4416	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 4956	4416	msedge.exe	83
PID 4416 wrote to memory of 4956	4416	msedge.exe	83
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 5008	4416	msedge.exe	84
PID 4416 wrote to memory of 1664	4416	msedge.exe	85
PID 4416 wrote to memory of 1664	4416	msedge.exe	85
PID 4416 wrote to memory of 1000	4416	msedge.exe	86
PID 4416 wrote to memory of 1000	4416	msedge.exe	86
PID 4416 wrote to memory of 1000	4416	msedge.exe	86
PID 4416 wrote to memory of 1000	4416	msedge.exe	86
PID 4416 wrote to memory of 1000	4416	msedge.exe	86
PID 4416 wrote to memory of 1000	4416	msedge.exe	86
PID 4416 wrote to memory of 1000	4416	msedge.exe	86
PID 4416 wrote to memory of 1000	4416	msedge.exe	86
PID 4416 wrote to memory of 1000	4416	msedge.exe	86
PID 4416 wrote to memory of 1000	4416	msedge.exe	86
PID 4416 wrote to memory of 1000	4416	msedge.exe	86
PID 4416 wrote to memory of 1000	4416	msedge.exe	86
PID 4416 wrote to memory of 1000	4416	msedge.exe	86
PID 4416 wrote to memory of 1000	4416	msedge.exe	86
PID 4416 wrote to memory of 1000	4416	msedge.exe	86
PID 4416 wrote to memory of 1000	4416	msedge.exe	86
PID 4416 wrote to memory of 1000	4416	msedge.exe	86
PID 4416 wrote to memory of 1000	4416	msedge.exe	86
PID 4416 wrote to memory of 1000	4416	msedge.exe	86
PID 4416 wrote to memory of 1000	4416	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf32f46f8,0x7ffbf32f4708,0x7ffbf32f4718
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,16897043651926692757,14593482163172221759,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,16897043651926692757,14593482163172221759,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,16897043651926692757,14593482163172221759,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16897043651926692757,14593482163172221759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16897043651926692757,14593482163172221759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2096 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,16897043651926692757,14593482163172221759,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4968 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d13c51ffd8680b1b5781d2c4e8944cbd

SHA1
0d1e2053b226e93b6c417e0e26c60600f0583b42

SHA256
c5df8f31e8407e1a91226d1309f3a5b73b84cc6024389132aa354ff3760ded2e

SHA512
f87d500ca8cd5bda8a06436c11183efbb506066966f5d5298ea9abe31ffbad3ef9a9f164b0fb7d7826c8d6417a635b837bca5caebbd8e717e198324933683639

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ad39f32574d374a13d6a3e79664111ee

SHA1
3dbc2e16b0f7ca9cc33cdd23ed638fea3c99f2fc

SHA256
7098d382fc7607aa178cd65bbd29e36da6dd44e52d6d4c0df585f9f8360ff5b9

SHA512
bad57843d9bc6b9a994e598838856c756789aca4c4088c771760cc43f29160addca57774b5e021f35c723984e8095e01f03ab552859bda35859f6148142e9798

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
aa3dae9576f6c76496b510f5f88a33a6

SHA1
c407d460104eea7c58a239c65a969f303bc95838

SHA256
0a35a7396c70ff420aa87a3e6192bddd8ffda10958ebeb88e6d3285f49e065ef

SHA512
c4ed7782957ce320c0ef61fe78a380cb601050a8a03c07e184a625e0577ea55fa5189721368a7d8e65478f4b478e7165a5168a39cc24e6807046efea19d1220c

Download Submit