92e20b281ae20789a079d3c28ceea104c668334ff1efb4d5fdcccae7d14b14f0

Analysis

max time kernel
148s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
13/05/2024, 08:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

19KB
MD5

195fc35642996997220c9488597159ea
SHA1

218fdfbf150e8e20ef4987fc6e06fe6ddf64e151
SHA256

92e20b281ae20789a079d3c28ceea104c668334ff1efb4d5fdcccae7d14b14f0
SHA512

de2ad1c3b44bb31bc13f621d25721202affc8dcd23108edea7f64dd2006b929086d61a853a7758cfe0aac6bd4d77f0fa258c3091c9b2f727dd6f28e40e2746b5
SSDEEP

384:r5x0aDpmReVoOs4+i9ylKeGM0U8Hhhb8R67zbo2paWhOwob0Jn+iIJCgMmVn:rX0aBVoOs4+myI1MeBhbw8zaWhOwob0q

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2740	msedge.exe
2740	msedge.exe
868	msedge.exe
868	msedge.exe
1440	identity_helper.exe
1440	identity_helper.exe
896	msedge.exe
896	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 792	868	msedge.exe	79
PID 868 wrote to memory of 792	868	msedge.exe	79
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 4896	868	msedge.exe	80
PID 868 wrote to memory of 2740	868	msedge.exe	81
PID 868 wrote to memory of 2740	868	msedge.exe	81
PID 868 wrote to memory of 2152	868	msedge.exe	82
PID 868 wrote to memory of 2152	868	msedge.exe	82
PID 868 wrote to memory of 2152	868	msedge.exe	82
PID 868 wrote to memory of 2152	868	msedge.exe	82
PID 868 wrote to memory of 2152	868	msedge.exe	82
PID 868 wrote to memory of 2152	868	msedge.exe	82
PID 868 wrote to memory of 2152	868	msedge.exe	82
PID 868 wrote to memory of 2152	868	msedge.exe	82
PID 868 wrote to memory of 2152	868	msedge.exe	82
PID 868 wrote to memory of 2152	868	msedge.exe	82
PID 868 wrote to memory of 2152	868	msedge.exe	82
PID 868 wrote to memory of 2152	868	msedge.exe	82
PID 868 wrote to memory of 2152	868	msedge.exe	82
PID 868 wrote to memory of 2152	868	msedge.exe	82
PID 868 wrote to memory of 2152	868	msedge.exe	82
PID 868 wrote to memory of 2152	868	msedge.exe	82
PID 868 wrote to memory of 2152	868	msedge.exe	82
PID 868 wrote to memory of 2152	868	msedge.exe	82
PID 868 wrote to memory of 2152	868	msedge.exe	82
PID 868 wrote to memory of 2152	868	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff80d903cb8,0x7ff80d903cc8,0x7ff80d903cd8
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,3597739217197058282,2773318165927933125,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,3597739217197058282,2773318165927933125,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,3597739217197058282,2773318165927933125,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3597739217197058282,2773318165927933125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3597739217197058282,2773318165927933125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,3597739217197058282,2773318165927933125,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,3597739217197058282,2773318165927933125,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3597739217197058282,2773318165927933125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3597739217197058282,2773318165927933125,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3597739217197058282,2773318165927933125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,3597739217197058282,2773318165927933125,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,3597739217197058282,2773318165927933125,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5420 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ade01a8cdbbf61f66497f88012a684d1

SHA1
9ff2e8985d9a101a77c85b37c4ac9d4df2525a1f

SHA256
f49e20af78caf0d737f6dbcfc5cc32701a35eb092b3f0ab24cf339604cb049b5

SHA512
fa024bd58e63402b06503679a396b8b4b1bc67dc041d473785957f56f7d972317ec8560827c8008989d2754b90e23fc984a85ed7496f05cb4edc2d8000ae622b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d0f84c55517d34a91f12cccf1d3af583

SHA1
52bd01e6ab1037d31106f8bf6e2552617c201cea

SHA256
9a24c67c3ec89f5cf8810eba1fdefc7775044c71ed78a8eb51c8d2225ad1bc4c

SHA512
94764fe7f6d8c182beec398fa8c3a1948d706ab63121b8c9f933eef50172c506a1fd015172b7b6bac898ecbfd33e00a4a0758b1c8f2f4534794c39f076cd6171

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b83592e5c93200787df4672f130bd862

SHA1
d2de788961a9530f1f53c69b058c90d65676d6fb

SHA256
2313f22ce7b5e1d1881c5cb278e95b189bca761ac6edf84b5ffacbc886116f8b

SHA512
2dfbc642d870106ae61e1bc842cf96a7169cbb8fdff90fb8372c599ba72f48af6e076c87816ec1934a04e4610ba882a3d9745985b8ac2b59a043a613b3fb3cef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5c77556fb56c89aa2ddbb15403a25a76

SHA1
ccd6e1d65501d60d4f8a6788bb2ce6c2b27b9aa6

SHA256
2b2a054c6ac2363d2a52ee3f4c633c108b38d25b89bbb73747c256ab80c9e264

SHA512
26a87025ab2a90627f08e157f333d05fd3f6b4d85240727b21744cbdd3250391ca39e60b8a438b062c73bb102c2de92ad85af5cf969fa069faa23c6e45bee220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
04b437430f157dad9ce5f02ce346bed6

SHA1
d42f51b69848190064ceaf2ef6379b979d0379e6

SHA256
c8ef358fae1f3dfe803eec56cd5d2f585b1bc37c2b1146d6523685ffcb755b45

SHA512
8db1114385fb478cdb024e01d9e7a825ca0578c4fdc67ce69fd055812630d05961d0e596d0ec72b999da75f19fbfaa20397a084881e42cdccbfa4ebcdc6d7d2e

Download Submit