Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
13-05-2024 23:05
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240426-en
General
-
Target
sample.html
-
Size
40KB
-
MD5
8cc25f9b1781ee52799fb8075644c62b
-
SHA1
1fd09e7ace6752a988dcdb8d864a69a50d47ac99
-
SHA256
09c5986032aebb1e794e1beba96df405fddcbf0ed12bc68ccfe083676b415b3c
-
SHA512
6eaf9a0c17df362e5ff76db068da3a9b0cb96e50ce25cedf8b1fa334b63845e5173a5b65d5efa2f68994bf5e65d2f046876ad306f75dba0fd9cb6ecadb040799
-
SSDEEP
768:SjnyZ+mh0OG0m+zhOnb5c4g9DBc3Z8vfSU+ttk7EWJ+dwYhAHl+4YSACZ/j+MecM:S7yZ+mSyvwb5Pg9DBc3Z8vfSU+ttk7EP
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4512 msedge.exe 4512 msedge.exe 3720 msedge.exe 3720 msedge.exe 5072 identity_helper.exe 5072 identity_helper.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe 2908 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe 3720 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3720 wrote to memory of 2748 3720 msedge.exe 82 PID 3720 wrote to memory of 2748 3720 msedge.exe 82 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4676 3720 msedge.exe 84 PID 3720 wrote to memory of 4512 3720 msedge.exe 85 PID 3720 wrote to memory of 4512 3720 msedge.exe 85 PID 3720 wrote to memory of 2892 3720 msedge.exe 86 PID 3720 wrote to memory of 2892 3720 msedge.exe 86 PID 3720 wrote to memory of 2892 3720 msedge.exe 86 PID 3720 wrote to memory of 2892 3720 msedge.exe 86 PID 3720 wrote to memory of 2892 3720 msedge.exe 86 PID 3720 wrote to memory of 2892 3720 msedge.exe 86 PID 3720 wrote to memory of 2892 3720 msedge.exe 86 PID 3720 wrote to memory of 2892 3720 msedge.exe 86 PID 3720 wrote to memory of 2892 3720 msedge.exe 86 PID 3720 wrote to memory of 2892 3720 msedge.exe 86 PID 3720 wrote to memory of 2892 3720 msedge.exe 86 PID 3720 wrote to memory of 2892 3720 msedge.exe 86 PID 3720 wrote to memory of 2892 3720 msedge.exe 86 PID 3720 wrote to memory of 2892 3720 msedge.exe 86 PID 3720 wrote to memory of 2892 3720 msedge.exe 86 PID 3720 wrote to memory of 2892 3720 msedge.exe 86 PID 3720 wrote to memory of 2892 3720 msedge.exe 86 PID 3720 wrote to memory of 2892 3720 msedge.exe 86 PID 3720 wrote to memory of 2892 3720 msedge.exe 86 PID 3720 wrote to memory of 2892 3720 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffe875746f8,0x7ffe87574708,0x7ffe875747182⤵PID:2748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,4413051892245181645,10914846396483041239,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵PID:4676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,4413051892245181645,10914846396483041239,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,4413051892245181645,10914846396483041239,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:82⤵PID:2892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4413051892245181645,10914846396483041239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:3916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4413051892245181645,10914846396483041239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:3748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,4413051892245181645,10914846396483041239,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3380 /prefetch:82⤵PID:2728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,4413051892245181645,10914846396483041239,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3380 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4413051892245181645,10914846396483041239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:12⤵PID:2372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4413051892245181645,10914846396483041239,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:12⤵PID:1068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4413051892245181645,10914846396483041239,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:12⤵PID:1156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4413051892245181645,10914846396483041239,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:12⤵PID:2652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,4413051892245181645,10914846396483041239,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5228 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2908
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2728
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2924
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54f7152bc5a1a715ef481e37d1c791959
SHA1c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA256704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
SHA5122e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
-
Filesize
152B
MD5ea98e583ad99df195d29aa066204ab56
SHA1f89398664af0179641aa0138b337097b617cb2db
SHA256a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
-
Filesize
6KB
MD5ab778dea4a7717fe96dcaf4eb586163b
SHA1abce756df5bc7bde9f0fcdb121749b0fe48aa618
SHA256381a5a262771518145e21e5572f7b8eb1504c6d035ed3ad2662aaf57d427d1b8
SHA512deafcd5737d3993ce38f4d0bfe056449c366135644a28b50405d822b3ae321a1d788d1df06366ad74d7b2669616b6b31e5f11dfcaf3bedafec5114f9627b4909
-
Filesize
5KB
MD5be4f5513260cbdb5b65e0799caa3dc39
SHA1b8ed1c5e6f923a289e1c65705bc78ee899e05867
SHA256b488889e9ed32cfd75d6987581855d3bc7d6c1137a92340918766594251ef081
SHA512ae92c6103e3ed1deda2b353ed3901abee1aa9246a61739ea1752510e3f6bfff06b277e167e7fc7ae9236b381aefb2ceaaf4de5df982c8fcfef28aac44aa468d6
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5525f8484a24ba477f1f7a8a5d2dd155d
SHA1693544e095c981c54b2cf7d318ac604453a3b007
SHA256e8e92208feb23d0fa07910a7a0d6b0b318cdcd5b83f02f3e384c82edbd794ea3
SHA512b7cdc0c4fbe41d0b8affe2786df3a90c09da03e29c16a33f952d69b09d6c1c3bee041d98bf44ddf3340962e8ff03507823e8e949d18b49787e04c9a67bcb8dbc