727541ca9fd8dc34fb9e42bbf7eb3c5596e31f4f4d97341b400d80cb26753088

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 17:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

217KB
MD5

8e09067aa09fa16ce4964a95eab3a58f
SHA1

69bc23ab2e6d6cc688549a242ed1fc6b4ce296f2
SHA256

2d38a05f1b2429c7de01946cc74e8136b8d8642835814ff3037135cf5f356a4c
SHA512

235611330572f09242e4afde32fb05dcfd1b8230f37feb0a6ce90e404b430928b6f3405a0c6490d8882e6115673129070a92167d6126c43816aa77a82549ee9a
SSDEEP

3072:SnIhy5x2AF2yfkMY+BES09JXAnyrZalI+YQ:SIhOxLFzsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe
2908	msedge.exe
2908	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe
1880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2908	msedge.exe
2908	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 1452	2908	msedge.exe	81
PID 2908 wrote to memory of 1452	2908	msedge.exe	81
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4544	2908	msedge.exe	83
PID 2908 wrote to memory of 4204	2908	msedge.exe	84
PID 2908 wrote to memory of 4204	2908	msedge.exe	84
PID 2908 wrote to memory of 4472	2908	msedge.exe	85
PID 2908 wrote to memory of 4472	2908	msedge.exe	85
PID 2908 wrote to memory of 4472	2908	msedge.exe	85
PID 2908 wrote to memory of 4472	2908	msedge.exe	85
PID 2908 wrote to memory of 4472	2908	msedge.exe	85
PID 2908 wrote to memory of 4472	2908	msedge.exe	85
PID 2908 wrote to memory of 4472	2908	msedge.exe	85
PID 2908 wrote to memory of 4472	2908	msedge.exe	85
PID 2908 wrote to memory of 4472	2908	msedge.exe	85
PID 2908 wrote to memory of 4472	2908	msedge.exe	85
PID 2908 wrote to memory of 4472	2908	msedge.exe	85
PID 2908 wrote to memory of 4472	2908	msedge.exe	85
PID 2908 wrote to memory of 4472	2908	msedge.exe	85
PID 2908 wrote to memory of 4472	2908	msedge.exe	85
PID 2908 wrote to memory of 4472	2908	msedge.exe	85
PID 2908 wrote to memory of 4472	2908	msedge.exe	85
PID 2908 wrote to memory of 4472	2908	msedge.exe	85
PID 2908 wrote to memory of 4472	2908	msedge.exe	85
PID 2908 wrote to memory of 4472	2908	msedge.exe	85
PID 2908 wrote to memory of 4472	2908	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c04046f8,0x7ff8c0404708,0x7ff8c0404718
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,18299747188798672099,17673281214260452746,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,18299747188798672099,17673281214260452746,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,18299747188798672099,17673281214260452746,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18299747188798672099,17673281214260452746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18299747188798672099,17673281214260452746,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,18299747188798672099,17673281214260452746,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3124 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
de0c0e7b3f5eecddfb9affe0d1ee92ac

SHA1
6aea296424a95b0013411b541b9035c7fc67eada

SHA256
faf9f7682a1aeed7a09724b27cb27709bf0b600813d3cd1cd4e7541338e10261

SHA512
7de927767e3962bc0257e493d68723b2c9d706fcb06099105d95e9cb04b3d973564a679a2563bd47fe295509fab356a93f0867c3fa791f70f13d928bf01461bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
71dfc055b8402bdb4b96ddeef5715a41

SHA1
cebf839c3b63b37a8541e90ff5278190b3b2f68d

SHA256
54ef85ce9ff4d2102f9c40bddd8d7db3a454a9b2c6f2a968897de113c0c304c7

SHA512
443526c5fca9f9b7d8ac6ccd1730971e45ed684e1d35a540b7fa0ba1a63f4812529a2a18230292512b49681849112d70cadc0df6bf3bb182a52392a1bfd74d01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7cb515a026f0ca95acc4c9430a6a3e3d

SHA1
4236dd9b7fb665d5c60534f98ef0533c35b8673a

SHA256
c1ba8d04a4dcd5f1a623057c59346feaeb2f2830adad556b2393a103175487c0

SHA512
ea88e92808cb676673091d394a7f34aa4573d8d3b53f62d2c6f2fc81a044c69861648a8e39b0a7a10900d1fc505aa23180e86cb491c207dc6c1ec7f9ae3686f0

Download Submit