f0f0fa39c9e77c258fd45467e05ca462a82f1565a52bd8faac24da1ce68deb24

General

Target

sample.html
Size

213KB
MD5

ef82c2c28ae1862fd32634cb8d2b5a3c
SHA1

2bf61cbf7e1dd2c67f42ad6bc49dd6f11f87fc8e
SHA256

06e3c6006f6ae34c68722fba596d5627a2f8f36044033326cea6825424db0093
SHA512

81c630c6f552e7a656270cf587336d9deccc2de9d02211d3d7a10c0cda1773b4fb6f2b424c42caff450783fe416b7e63a29beae968da7f677c8c2f3e9f1de8e9
SSDEEP

3072:SJsY1ephtixQAllK5NQ0J0JqTUzC+TV9h0lAeXwH2+HSppXNFNlyfkMY+BES09Je:SIDdQsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

3752 msedge.exe
3752 msedge.exe
4428 msedge.exe
4428 msedge.exe
3928 msedge.exe
3928 msedge.exe
3928 msedge.exe
3928 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

4428 msedge.exe
4428 msedge.exe

pid	process
3752	msedge.exe
3752	msedge.exe
4428	msedge.exe
4428	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4428 wrote to memory of 908	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 908	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3056	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3752	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3752	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3632	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3632	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3632	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3632	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3632	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3632	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3632	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3632	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3632	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3632	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3632	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3632	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3632	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3632	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3632	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3632	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3632	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3632	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3632	4428	msedge.exe	msedge.exe
PID 4428 wrote to memory of 3632	4428	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e90546f8,0x7ff9e9054708,0x7ff9e9054718
2⤵
PID:908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,9867210666705090600,10979726451783692572,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
2⤵
PID:3056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,9867210666705090600,10979726451783692572,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,9867210666705090600,10979726451783692572,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
2⤵
PID:3632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9867210666705090600,10979726451783692572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
2⤵
PID:4596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9867210666705090600,10979726451783692572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
2⤵
PID:3112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,9867210666705090600,10979726451783692572,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3596

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
6acc7b83a54616a4f8d45a7d84480614

SHA1
4ce3153bbd1fccbaab7b18accfde957e62ebae0e

SHA256
1b4f253a6908fa908afe199f09d7ce9ee5b12016245ce248c9aaa026adcd3df7

SHA512
3ed27eb735ba2a1e97bea2ab08a7de37fe1f0a3187d27f394d41220c744222352ad31dcb4a272bd4ca080ffbdbb2deefbc308b714ee4d2192acf22ef8205059e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
8d493e6fb5cc4c076a34f7594c2b4f90

SHA1
af74009eed0daf648230190fda3bed190bade108

SHA256
af7f6c3482ff00fa42bc54de2da2176b11f854dde495bfbf3bc856323dbb629e

SHA512
6a9b9cba9dd5be0211b119f0ac04a233973ad465acc2cc9c19204fba8cac8b852dd67f827143d723c9a1ca049b4f170865c9f93f6b58b3d5d7ced375446ff451

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
a429878a9948af1b1392303e9e6be383

SHA1
a7cd5d59f3e3a42daf8eb9623c2b3bb77c1073ea

SHA256
0ad9375dd3c100fd7b707cc0f36d73cdd5ff2f08fcd02bb81acfb09dec05728f

SHA512
6dd53ced608a6b207aad89c2f9ba519516c24829f1413f9a96c1209be6222d17f62842ec9406a67695f9723a98ce3dea1878c38462a337ba7ed3b941b6579952

Download Submit
\??\pipe\LOCAL\crashpad_4428_HDSSWASCHYNIQEFY
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads