4473d14d919d966c35fb8ab4a325c3c9aa037f997e59a56cdcfe6f7fd0ea07ad

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-05-2024 02:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

34218d185dd6ad81d899251502064bb2
SHA1

4e3c6d359107a9a2dc23851e85f403bf7be39c15
SHA256

5c6f21dd95f5a3886af7c20bfbb27a23623eb64f776794d0f63be9e048fd6c0d
SHA512

bb740f82ec61d24d0c41d529ef5e93ea1fe6339a8faf21a4cb2457fc742b1000ea99fe0c40b689403e9bb868378030838df19c1e62fad407cd63f8bb7dd40b5e
SSDEEP

3072:S9t7Qdd9ilp1/w8yfkMY+BES09JXAnyrZalI+YQ:S9NWkH+sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4976	msedge.exe
4976	msedge.exe
4488	msedge.exe
4488	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 2852	4488	msedge.exe	84
PID 4488 wrote to memory of 2852	4488	msedge.exe	84
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 2720	4488	msedge.exe	85
PID 4488 wrote to memory of 4976	4488	msedge.exe	86
PID 4488 wrote to memory of 4976	4488	msedge.exe	86
PID 4488 wrote to memory of 4232	4488	msedge.exe	87
PID 4488 wrote to memory of 4232	4488	msedge.exe	87
PID 4488 wrote to memory of 4232	4488	msedge.exe	87
PID 4488 wrote to memory of 4232	4488	msedge.exe	87
PID 4488 wrote to memory of 4232	4488	msedge.exe	87
PID 4488 wrote to memory of 4232	4488	msedge.exe	87
PID 4488 wrote to memory of 4232	4488	msedge.exe	87
PID 4488 wrote to memory of 4232	4488	msedge.exe	87
PID 4488 wrote to memory of 4232	4488	msedge.exe	87
PID 4488 wrote to memory of 4232	4488	msedge.exe	87
PID 4488 wrote to memory of 4232	4488	msedge.exe	87
PID 4488 wrote to memory of 4232	4488	msedge.exe	87
PID 4488 wrote to memory of 4232	4488	msedge.exe	87
PID 4488 wrote to memory of 4232	4488	msedge.exe	87
PID 4488 wrote to memory of 4232	4488	msedge.exe	87
PID 4488 wrote to memory of 4232	4488	msedge.exe	87
PID 4488 wrote to memory of 4232	4488	msedge.exe	87
PID 4488 wrote to memory of 4232	4488	msedge.exe	87
PID 4488 wrote to memory of 4232	4488	msedge.exe	87
PID 4488 wrote to memory of 4232	4488	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa292946f8,0x7ffa29294708,0x7ffa29294718
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,2799403604610807010,8353099958168916069,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,2799403604610807010,8353099958168916069,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,2799403604610807010,8353099958168916069,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,2799403604610807010,8353099958168916069,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,2799403604610807010,8353099958168916069,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,2799403604610807010,8353099958168916069,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3088 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2ed276daf5e7a22f590c5d9d7feeef09

SHA1
ce36f5b62a34674dff2b5e6cdb178d20ddfad615

SHA256
568d2f5eb534f845b2558c3e732b2d99ddd6ceab1073f0ea5a40b0773b8913a4

SHA512
d5efc1ab4e067aa66077c89e95f86a01531807ed82f450a645c66f8a602a1ea8429bf96aad995473b7d9eded2bda150482a499fa3abac6871f37f62e93a4cc1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
844d38b52c29a4d3b1be742947ec40f9

SHA1
7e12392381196493314a3d3012b64b6faa934ea7

SHA256
bac5ac84f727beb0da90189eb4efba83a176bcb15f3e9e76d0275d2426187c36

SHA512
39235a1b6e6836234d8a9bce178a0ef9da6c0dcf2661202fc9a13cc07d112b0c990e9deadc84e81d77dd93b15d10ce79a2cf2a54dfa803bc98997331616fd38a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4f4f1305e661350b3fa2cfec9ee06914

SHA1
c4dc3934fa7592a963d3a99bccf319c6782b3d41

SHA256
c4db0b358bc338d2b73561f0c235c9fd9c9eece86402dea6b5c073d0a00a91e3

SHA512
95ddb2df2faca77e4c43cd648ff7ff29efde7b14ba076d5389332c273ef93afd7fca3b2921924bbd895444f4071c0948374cc899e8a0d366d404b123a7fb5145

Download Submit