ebb61ad827f90f3d665b24988f818e6c4286171f4ee3e45662fa9abaa737b8da

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 02:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

1a1a0392c016ae52559f7329df14b531
SHA1

3504ed136d698f640e408033f4c892c83d9c7241
SHA256

c8b8973a54c2e8955b8616b53ff25ff178ec6851f1a59515fdd5aaca6d4b6def
SHA512

66402a92dc41c588d2f0a820d4263a510f974daa188ae5438a7547a3bd89fb7de28b14e34ca61cb2c004b24e41d23a7d39bc4558bda32c744d66489fbd36c4a3
SSDEEP

3072:ShiuXJ7g3gqsuyfkMY+BES09JXAnyrZalI+YQ:Sh/xlLsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1060	msedge.exe
1060	msedge.exe
4680	msedge.exe
4680	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 2216	4680	msedge.exe	81
PID 4680 wrote to memory of 2216	4680	msedge.exe	81
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 2232	4680	msedge.exe	82
PID 4680 wrote to memory of 1060	4680	msedge.exe	83
PID 4680 wrote to memory of 1060	4680	msedge.exe	83
PID 4680 wrote to memory of 3288	4680	msedge.exe	84
PID 4680 wrote to memory of 3288	4680	msedge.exe	84
PID 4680 wrote to memory of 3288	4680	msedge.exe	84
PID 4680 wrote to memory of 3288	4680	msedge.exe	84
PID 4680 wrote to memory of 3288	4680	msedge.exe	84
PID 4680 wrote to memory of 3288	4680	msedge.exe	84
PID 4680 wrote to memory of 3288	4680	msedge.exe	84
PID 4680 wrote to memory of 3288	4680	msedge.exe	84
PID 4680 wrote to memory of 3288	4680	msedge.exe	84
PID 4680 wrote to memory of 3288	4680	msedge.exe	84
PID 4680 wrote to memory of 3288	4680	msedge.exe	84
PID 4680 wrote to memory of 3288	4680	msedge.exe	84
PID 4680 wrote to memory of 3288	4680	msedge.exe	84
PID 4680 wrote to memory of 3288	4680	msedge.exe	84
PID 4680 wrote to memory of 3288	4680	msedge.exe	84
PID 4680 wrote to memory of 3288	4680	msedge.exe	84
PID 4680 wrote to memory of 3288	4680	msedge.exe	84
PID 4680 wrote to memory of 3288	4680	msedge.exe	84
PID 4680 wrote to memory of 3288	4680	msedge.exe	84
PID 4680 wrote to memory of 3288	4680	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe542a46f8,0x7ffe542a4708,0x7ffe542a4718
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13587440604135669966,5172653610084231890,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,13587440604135669966,5172653610084231890,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,13587440604135669966,5172653610084231890,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13587440604135669966,5172653610084231890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13587440604135669966,5172653610084231890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13587440604135669966,5172653610084231890,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1304 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
93469d4ad6a1ca0bd0d94e8510b17516

SHA1
69829e348db8869f93ba653012e3f22bb8444560

SHA256
7506b6a98dabb702c4c0856d7daebd67ddc819eb3092b99cf0dfc880fa2a3462

SHA512
073c1217854056ea3a7464bee587bdef065e7ae70f2951f46dbbaabcfc5f6bb2a4bed986bcadbeb575ff140d1c8c9694fc41c370b7c0ecbad7859a58813e9560

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
815da8047e334735525ddcc5b9bc4db4

SHA1
81a5dcbcd91d104b2029b284dae03c59e7585954

SHA256
af9131b91c0eed7e8678212f15277064f1f4a25e088d7eb8d21c27337fdfe2e4

SHA512
f1685db913e98d78925fc5be2fa615698bf68fec70cf229740bd87f30c09bb561c10c50c5da4a68c2f41bf52f6f3fe18cb969e7af7b98a902cc414cca7e1dd64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
eba5fcc92058539a4e8785160e2f3b43

SHA1
4a5870bae1bd2b4837351200a72e61bd7bce1ac5

SHA256
0e6e929a839b2db2b71c22b1dede46230ec7d6aff039d8430632332fd577e05c

SHA512
3f90ff24bcca2165d2a4c732db4ddffa7957def7206a5701fef9dd6a31dd00a0f5cf98a9b50605b8334f685df50619157c0aab2e500228585701a7f38a444389

Download Submit