Analysis
-
max time kernel
145s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 15:04
Static task
static1
Behavioral task
behavioral1
Sample
file.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
file.html
Resource
win10v2004-20240508-en
General
-
Target
file.html
-
Size
176KB
-
MD5
db942883a0390a0227b575feba4b4eb3
-
SHA1
02cef4005fea35165bfb2cc054831f71c50c3bf4
-
SHA256
ba5cbcabe67d1fdada24cf6b8876ee06441e91e08600b35794a6f243d42f8142
-
SHA512
952c1754aabe169d1d8f07909adf81c213be7792a53b02a67d271f8e6ad14c397e72c6b87964b10ec619ef8bc321d2ec993f22647da4f1d443ac5112c7456ddf
-
SSDEEP
1536:ni0zb50ZoTgAJuHnjde83Ml83Mn1CyKBKyf6C9XS6zmFMtMd5/an/RlSb1mwz6e5:ni6gAkHnjPIQ6KSEX/4Hpv4Pt4
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 3504 msedge.exe 3504 msedge.exe 4912 msedge.exe 4912 msedge.exe 4524 identity_helper.exe 4524 identity_helper.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe 4476 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4912 wrote to memory of 624 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 624 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2392 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 3504 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 3504 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2468 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2468 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2468 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2468 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2468 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2468 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2468 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2468 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2468 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2468 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2468 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2468 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2468 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2468 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2468 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2468 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2468 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2468 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2468 4912 msedge.exe msedge.exe PID 4912 wrote to memory of 2468 4912 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\file.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xe0,0xe4,0xd8,0xdc,0x108,0x7ffc19cc46f8,0x7ffc19cc4708,0x7ffc19cc47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,1375549898824657097,14099149322438221150,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,1375549898824657097,14099149322438221150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,1375549898824657097,14099149322438221150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1375549898824657097,14099149322438221150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1375549898824657097,14099149322438221150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1375549898824657097,14099149322438221150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1300 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,1375549898824657097,14099149322438221150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,1375549898824657097,14099149322438221150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1375549898824657097,14099149322438221150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1375549898824657097,14099149322438221150,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1375549898824657097,14099149322438221150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1375549898824657097,14099149322438221150,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,1375549898824657097,14099149322438221150,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6100 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9a3c4801-b0ac-43ba-8ffa-4af97fecb0c2.tmpFilesize
6KB
MD54bbab5350acf97a536c46043cdc1f747
SHA1e9984c79860634066fd3cbfc5612d6de8ed51c5d
SHA256df8d7d75de0cc912dd7d21e57c467cd8ba1993a274e043340c7aee793335a559
SHA512620de9d20b4cd350e3e60b51fa958383e91a8764736c549e7ef2cf1e740af5f6a9dca01e79b9b980e6b0524d0175b3ba4a742ed529e583942315b5d21f5a1bf5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
1KB
MD55ae6b4af4fbcdfeae776196ede7cdc6c
SHA1daf5e645a4d07e8803e880ccc58b91079d7aebd2
SHA256f90664639cb271b19da78e4e40a9350ca16edd195eee6fc58d47fcfe8269d382
SHA512806ad92ef797924e2d072c7e4ca0f2561ba0b6894df54b531ea2655f7b2528c768ac770df3f0700ad68cd7d17caf74dd69ba9ab1c3e827912d15136493f90d7f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD51b2af6440d53238d2786623c4ac59538
SHA162fb6317054e9c30ba62e8cbdc0674ea3c48e4cc
SHA256627c9170e9ad5490aa49881e51288ae5cf140d6465871967ceef1ca878c21398
SHA51217c5fee374dbd293fb768b5273ecce43409b6729a6b870200d48c34f0ba19e543965b77a83c7b6794ad82deb25ee2f58aac20c88f41aa854ffc3cdab78f02013
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD504f13960f5debf7c3e577341cabb2e75
SHA1cdb00b16253cc16fddbf6828c5c95c16a03ba12a
SHA256fc270c00e6640d3de18307c057d0c1f095779cb9cfa39c193b571b66b2fb362d
SHA5128a2f54941b41c1ba702931d199352ef42948aa2603e89215997b58da8f40b9c7adf1ba85c9d5fe51ad9d0f2ed366347b020a383db84c3773e79eebee4ee3d8dd
-
\??\pipe\LOCAL\crashpad_4912_HZAYWLOAQCTTCXSRMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e