3a164374102a6f1ef9c2b27c7651b87e9435e99d8bd6f64b0197284d672b32ee

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 16:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

767ce5e7890a64ded988522d117efc71
SHA1

f1a24d06ca02815450f6f70fdf2db6f495a73304
SHA256

d41f9f4838a2c53acaa79db2643b5019d5d3a72a78a2dc3e8bd9b9bc3afdba2d
SHA512

46647260490ea13429a60f559e7df7be1e77ae1eb71d78a532ae0afc1e2bad0c623cc86ab7aee0374fa49139b42098d8aca5bba59db96ce83dd6bff16e6016ed
SSDEEP

3072:S6o14ROCsq6VEDyfkMY+BES09JXAnyrZalI+YQ:S6DOHFsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4264	msedge.exe
4264	msedge.exe
1936	msedge.exe
1936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 4488	1936	msedge.exe	79
PID 1936 wrote to memory of 4488	1936	msedge.exe	79
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 984	1936	msedge.exe	81
PID 1936 wrote to memory of 4264	1936	msedge.exe	82
PID 1936 wrote to memory of 4264	1936	msedge.exe	82
PID 1936 wrote to memory of 1028	1936	msedge.exe	83
PID 1936 wrote to memory of 1028	1936	msedge.exe	83
PID 1936 wrote to memory of 1028	1936	msedge.exe	83
PID 1936 wrote to memory of 1028	1936	msedge.exe	83
PID 1936 wrote to memory of 1028	1936	msedge.exe	83
PID 1936 wrote to memory of 1028	1936	msedge.exe	83
PID 1936 wrote to memory of 1028	1936	msedge.exe	83
PID 1936 wrote to memory of 1028	1936	msedge.exe	83
PID 1936 wrote to memory of 1028	1936	msedge.exe	83
PID 1936 wrote to memory of 1028	1936	msedge.exe	83
PID 1936 wrote to memory of 1028	1936	msedge.exe	83
PID 1936 wrote to memory of 1028	1936	msedge.exe	83
PID 1936 wrote to memory of 1028	1936	msedge.exe	83
PID 1936 wrote to memory of 1028	1936	msedge.exe	83
PID 1936 wrote to memory of 1028	1936	msedge.exe	83
PID 1936 wrote to memory of 1028	1936	msedge.exe	83
PID 1936 wrote to memory of 1028	1936	msedge.exe	83
PID 1936 wrote to memory of 1028	1936	msedge.exe	83
PID 1936 wrote to memory of 1028	1936	msedge.exe	83
PID 1936 wrote to memory of 1028	1936	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa37e46f8,0x7ffaa37e4708,0x7ffaa37e4718
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,9162235081618763282,14853232596792937881,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,9162235081618763282,14853232596792937881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,9162235081618763282,14853232596792937881,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9162235081618763282,14853232596792937881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9162235081618763282,14853232596792937881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,9162235081618763282,14853232596792937881,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
19cd8c5d83554ec7dc335fd31f544f23

SHA1
172d715c53037f35e58acefa02e44c6c58eed0af

SHA256
03f16b66260df24c37d76ad84ae89c593126095b14a4efe191b56153c176bbc6

SHA512
76b3d6b357e60d90df29eec22ef0a94d4cf62e04232f36729b0383ed758bcab12878d258629e6b6b48fef8726b54e7ff62162ea7ba57883def3d547721b779b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ca74c627b392c5e0ed3fdd86a5f33b04

SHA1
0aef5a2b8bee4daecb003ade5b6666dbb42add99

SHA256
e8932ea56a8a832804096ac2930e26663630c86fd4ccb46255bb2d46ea597d48

SHA512
b535e2c08308c874a73ad639a4a26105d3da21acb96e9714a7d11703d0a7f682c3d267eeb59cb0d5d988ad50f57dd49ce998f0730d8429a10279a59ee5f94897

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ee65a185ff0513c25b20eb4b90c9f1f8

SHA1
609c353297e69c769a3a674215cfe8f36d9fdb84

SHA256
78ae0dab41b7bd85f799645022315825113fddf63dadb29e5755b4afc558f3e2

SHA512
e43113a08384d7d111dda7bbd3a09ebce6381b597ac6c2ea8bcc37993f4fda3f3b30bcb047db71c495301d504929ad42f5db1fd682ea9d9eb26191615a9417fb

Download Submit