c950bb9080135e5afb438cb1bf194c7bfc826219079d3e400fc083f8e16f2f35

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 17:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

form/index.html
Size

5KB
MD5

f2241c5923e69e3b49833f77e3afe16e
SHA1

ff02a9652c6e18f40b2b82cfda71e549283df66e
SHA256

b3e69f3fdfb801c24721f31a484284da6ff3802d7e45d1656df7057b03e6dd42
SHA512

e3d7b7f40142150cd27541e3e84adb27554b49b057c70c58b08bde4c385eb3545268acb1798329448f2a993c2ab00575b55c6962f9ee4fec0ac6cf913d9a5228
SSDEEP

96:/SuhfsN04J1hMidddddcQddddddws+hWddddddGZE+Udddddd0jnUddddddLdddC:/734J10hYglEG

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
940	msedge.exe
940	msedge.exe
4708	msedge.exe
4708	msedge.exe
1076	identity_helper.exe
1076	identity_helper.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 4296	4708	msedge.exe	81
PID 4708 wrote to memory of 4296	4708	msedge.exe	81
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 4516	4708	msedge.exe	82
PID 4708 wrote to memory of 940	4708	msedge.exe	83
PID 4708 wrote to memory of 940	4708	msedge.exe	83
PID 4708 wrote to memory of 3088	4708	msedge.exe	84
PID 4708 wrote to memory of 3088	4708	msedge.exe	84
PID 4708 wrote to memory of 3088	4708	msedge.exe	84
PID 4708 wrote to memory of 3088	4708	msedge.exe	84
PID 4708 wrote to memory of 3088	4708	msedge.exe	84
PID 4708 wrote to memory of 3088	4708	msedge.exe	84
PID 4708 wrote to memory of 3088	4708	msedge.exe	84
PID 4708 wrote to memory of 3088	4708	msedge.exe	84
PID 4708 wrote to memory of 3088	4708	msedge.exe	84
PID 4708 wrote to memory of 3088	4708	msedge.exe	84
PID 4708 wrote to memory of 3088	4708	msedge.exe	84
PID 4708 wrote to memory of 3088	4708	msedge.exe	84
PID 4708 wrote to memory of 3088	4708	msedge.exe	84
PID 4708 wrote to memory of 3088	4708	msedge.exe	84
PID 4708 wrote to memory of 3088	4708	msedge.exe	84
PID 4708 wrote to memory of 3088	4708	msedge.exe	84
PID 4708 wrote to memory of 3088	4708	msedge.exe	84
PID 4708 wrote to memory of 3088	4708	msedge.exe	84
PID 4708 wrote to memory of 3088	4708	msedge.exe	84
PID 4708 wrote to memory of 3088	4708	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\form\index.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe542a46f8,0x7ffe542a4708,0x7ffe542a4718
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,11798053843572778945,15938173459986968626,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,11798053843572778945,15938173459986968626,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,11798053843572778945,15938173459986968626,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11798053843572778945,15938173459986968626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11798053843572778945,15938173459986968626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,11798053843572778945,15938173459986968626,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4700 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,11798053843572778945,15938173459986968626,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11798053843572778945,15938173459986968626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11798053843572778945,15938173459986968626,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11798053843572778945,15938173459986968626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11798053843572778945,15938173459986968626,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,11798053843572778945,15938173459986968626,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3080 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
203B

MD5
fcee382bbe8fa3ba1c0705a5771d9f23

SHA1
d43d609ce584096a16cbb988852977116447a48d

SHA256
19b50e39232d3b1cc07f5c1f4b2dae3e3a4523282000e6e10b8504c140c88aa2

SHA512
944008f34987273b74e4302feb16b79afd5ee4662deaf43d8f7a6002d412b67d9640b40b6ed6a77e50b4b4c7cfc6eecbca9b792b553164001251bbb0788cc537

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e5dbddeaba1a427406620acf1ce4e383

SHA1
1dbabcbf1038adccfa30d4d28bedbd9ba0255d10

SHA256
3b92e2654eed70b806dcdf1eb0c1430402006e5903b9412e378d773a4905032d

SHA512
299376e7b96814e6e4db52e9116bb0f473b2b2b888ee4710e2eec42a4f1c365c2b4cb63050a37818666a66f3b554e5d2a22f3423e7e02c66da2f490da59af85c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b7c53712242c7d31414e0b8ceb355b37

SHA1
5d87c29bac36d41cc23176f07fd564b532ebed84

SHA256
d5539decd947b1ac5ad2d64a38c92b4f0618f3cfc51b7c223252c03a1082f1dd

SHA512
7c7873fff1eb10af658e7b466e2ff4385850e75f8eceef0a56ec6ff907001c6c3929adcd094e6914af182c723b1a77e8a306b7c95a6121a1e7c98867881604b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
87369847bf088a233be3e3c7b9a7cb9a

SHA1
9acd9ba7ad1bc6187af6593323fa78621dce59c4

SHA256
ed5940ec0b367421bdb2cccb8e198f1010e422d5eb63644586e52e70dee533f9

SHA512
4edb29dfa93620df48a68af31cacfec1ca3f9573139abbd34a8f9d6240ff0c54dccc33183eee4b210af378cadeb3944447c26b80d413c6ab4fd69bd95b63d597

Download Submit