510cb915cab16456be2e9d80c8163e49a5f2f4b51aa6e20aa486a8845a13c78e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 21:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

217KB
MD5

ecd0235d2378f9c7a6480847b54939f7
SHA1

9bc626f1d561aa75d550f1c6d8bd4ead91c4460e
SHA256

5c39e13ae67fc24554867619e12c2991ee2caee0e6fca5dd42ada7bf01dccf34
SHA512

9ed785d7b358b88cd1c367e3f6ca7c2877096f977477554ee8013fe5ff6ffb26a041e73b1aa89c0bbc45ae53c58f27b1973b2a04f0a52abb055a6e1268675efa
SSDEEP

3072:SYDHquR9BpnhfyfkMY+BES09JXAnyrZalI+YQ:SYDp9BvqsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3800	msedge.exe
3800	msedge.exe
4508	msedge.exe
4508	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 4008	4508	msedge.exe	80
PID 4508 wrote to memory of 4008	4508	msedge.exe	80
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3900	4508	msedge.exe	81
PID 4508 wrote to memory of 3800	4508	msedge.exe	82
PID 4508 wrote to memory of 3800	4508	msedge.exe	82
PID 4508 wrote to memory of 460	4508	msedge.exe	83
PID 4508 wrote to memory of 460	4508	msedge.exe	83
PID 4508 wrote to memory of 460	4508	msedge.exe	83
PID 4508 wrote to memory of 460	4508	msedge.exe	83
PID 4508 wrote to memory of 460	4508	msedge.exe	83
PID 4508 wrote to memory of 460	4508	msedge.exe	83
PID 4508 wrote to memory of 460	4508	msedge.exe	83
PID 4508 wrote to memory of 460	4508	msedge.exe	83
PID 4508 wrote to memory of 460	4508	msedge.exe	83
PID 4508 wrote to memory of 460	4508	msedge.exe	83
PID 4508 wrote to memory of 460	4508	msedge.exe	83
PID 4508 wrote to memory of 460	4508	msedge.exe	83
PID 4508 wrote to memory of 460	4508	msedge.exe	83
PID 4508 wrote to memory of 460	4508	msedge.exe	83
PID 4508 wrote to memory of 460	4508	msedge.exe	83
PID 4508 wrote to memory of 460	4508	msedge.exe	83
PID 4508 wrote to memory of 460	4508	msedge.exe	83
PID 4508 wrote to memory of 460	4508	msedge.exe	83
PID 4508 wrote to memory of 460	4508	msedge.exe	83
PID 4508 wrote to memory of 460	4508	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc4ec546f8,0x7ffc4ec54708,0x7ffc4ec54718
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,12469080670615992861,2598195001688089388,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,12469080670615992861,2598195001688089388,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,12469080670615992861,2598195001688089388,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,12469080670615992861,2598195001688089388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,12469080670615992861,2598195001688089388,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,12469080670615992861,2598195001688089388,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1772 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b91be6a6beebc29e19afc91a14192361

SHA1
91c6c74b188c3223110f8e032c8ec8ceaeed4957

SHA256
1fe4da8a51183a26956602391c41ce3d318f376e450229f6c0ca69b783f37d8e

SHA512
2a30dbeb0b45ea77479de484e25da9d6bd8cfe9c8aa28c6a6603a9121bc6bd94f2d66ab4e18ab57c4b3ae9ee771bdbc24488e62d9ee6c4395af29d89634d8ad8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a93ebff34fcae4bf6fa1528a17ad7567

SHA1
df42ec45cf77db02f18de00dbc9759ed9cd29f47

SHA256
a23c8e695068cb0aa4528e15f7e65d008ccae2d451c5b1f40f4909d44e4924bb

SHA512
9043a37ec18cb746198f651cbf5274985f8ccf94599fa9a958d838b00634cb67ad08aa030ccc93eed44a58f7ebc6aec2715ab51d593d2f8cd7649552295d9837

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
027ea2ab6bd72e909ff6e771201c6d96

SHA1
15a8cc2d3786a4640cc1ae03de805bcdc69f9e0e

SHA256
4a2bc0bd5c5f3f0102693f4f4618d162cf9758d1e318ec23458d3d21b7908cb5

SHA512
8e34f3d76214003ae08627c843373c92e329e7ac9bd7af87dad7b834a7a78c9fd3f20638ecec8339a2a915c3b5659b5da800abc0663c55e19c9a11845249fdef

Download Submit