Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 18:46
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240426-en
General
-
Target
sample.html
-
Size
213KB
-
MD5
ca37a16aed38c814ebffaea60d76aa41
-
SHA1
eb4e0bb4b104f44124d2e50f2e29e97c98c9de28
-
SHA256
addf2608d034ea4f4b914482e8e28bd7c55c1fd7dbde1ab4b945620e57c5c079
-
SHA512
b74e4993552149e0ae08175575f14e375a407f1c07618be5a055c0b115f6a2499e93e27f4b6d3e136f7664c915e70c0e34dcc88622ed923daf527c565c0d93d3
-
SSDEEP
3072:SLa3KuY323/gUX/0yfkMY+BES09JXAnyrZalI+YQ:S/M7/5sMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 548 msedge.exe 548 msedge.exe 1752 msedge.exe 1752 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe 1056 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1752 msedge.exe 1752 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe 1752 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1752 wrote to memory of 1420 1752 msedge.exe 85 PID 1752 wrote to memory of 1420 1752 msedge.exe 85 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 3572 1752 msedge.exe 86 PID 1752 wrote to memory of 548 1752 msedge.exe 87 PID 1752 wrote to memory of 548 1752 msedge.exe 87 PID 1752 wrote to memory of 1996 1752 msedge.exe 88 PID 1752 wrote to memory of 1996 1752 msedge.exe 88 PID 1752 wrote to memory of 1996 1752 msedge.exe 88 PID 1752 wrote to memory of 1996 1752 msedge.exe 88 PID 1752 wrote to memory of 1996 1752 msedge.exe 88 PID 1752 wrote to memory of 1996 1752 msedge.exe 88 PID 1752 wrote to memory of 1996 1752 msedge.exe 88 PID 1752 wrote to memory of 1996 1752 msedge.exe 88 PID 1752 wrote to memory of 1996 1752 msedge.exe 88 PID 1752 wrote to memory of 1996 1752 msedge.exe 88 PID 1752 wrote to memory of 1996 1752 msedge.exe 88 PID 1752 wrote to memory of 1996 1752 msedge.exe 88 PID 1752 wrote to memory of 1996 1752 msedge.exe 88 PID 1752 wrote to memory of 1996 1752 msedge.exe 88 PID 1752 wrote to memory of 1996 1752 msedge.exe 88 PID 1752 wrote to memory of 1996 1752 msedge.exe 88 PID 1752 wrote to memory of 1996 1752 msedge.exe 88 PID 1752 wrote to memory of 1996 1752 msedge.exe 88 PID 1752 wrote to memory of 1996 1752 msedge.exe 88 PID 1752 wrote to memory of 1996 1752 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7e4646f8,0x7ffe7e464708,0x7ffe7e4647182⤵PID:1420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,7206684617246985144,7664861088302965121,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:22⤵PID:3572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,7206684617246985144,7664861088302965121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,7206684617246985144,7664861088302965121,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:82⤵PID:1996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7206684617246985144,7664861088302965121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:1944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7206684617246985144,7664861088302965121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:4620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,7206684617246985144,7664861088302965121,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1056
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1668
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:728
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5537815e7cc5c694912ac0308147852e4
SHA12ccdd9d9dc637db5462fe8119c0df261146c363c
SHA256b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
SHA51263969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
-
Filesize
152B
MD58b167567021ccb1a9fdf073fa9112ef0
SHA13baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA25626764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
SHA512726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
-
Filesize
5KB
MD5cdd149cf845f86d18c9cc819ffd5fa39
SHA107ffba72028bcd13274aa0d78c355369bbacc8c1
SHA256a4d3678377708e9921cdaf74597d7bf72c52f0f5319f5df17b21d89f03fbce93
SHA512f93f5a216fa7295253be9cba09211dcc26ebce3498576789c6fcbe270d1952c4619beb7de77345c195f6ef4f790ba9f324802e10d11d48ea496f853b3e204274
-
Filesize
6KB
MD56cfd16d51d078f98f0c6332c9756b8dd
SHA14e7f2ae43a62c95746fe769d0ad20092387f5d22
SHA256ba4fed5d4dd9743aa96232866bbc79171ef1889a1e3d40a5621a970b2e405f88
SHA512ac7ea515b439c0b91c5758e574ed33cb3c6dd48424ede32da15827ef96a90ea64e26524a7cb5ebd7ca3a33b2f8ccfda0a181ecc9b19ff198cc9edbb3e3b45027
-
Filesize
11KB
MD57c341f16ebb1d57ef1c617ff1bfef371
SHA125125eb7af1e67eaf054acd85db3f70ddeaea4aa
SHA2565e4d5849401aff6897d5211b6000265af5f5b49b93d8310cf0f2e6b1099d3a5c
SHA512ca02aaa588f04e17c9f750d8ea933596dc8e13a40a8de8b15e72750355fc461d2a738ad85817f4399700b762c719eb07fe6d21506ca02f9a4804e468c4fa367e