6c6890adb010510ff088f737f86f42fc3ace955fc86df53bfdb3fe5887f3ca17

General

Target

sample.html
Size

220KB
MD5

5a87ec0d702619aa05a7f948f4462c93
SHA1

10b0f61cd43ebdd80e3e1bec69d78820263a5dff
SHA256

a750eb6bad1a615dc9f7f4e56ca3fbbdb3a6a676aecb9210cb196765d4dddf29
SHA512

c93e9fdcc97c9fe51bbcd8ed09f04a7fdbdfcb5e647a0cbb5e4defab137125f90cea71754e410281db95ab82d3cd91590e9bf982d2ef1195d5405a8e6de94075
SSDEEP

3072:Su76Xmvpp33UkyfkMY+BES09JXAnyrZalI+YQ:Su4KDIsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

4940 msedge.exe
4940 msedge.exe
944 msedge.exe
944 msedge.exe
2040 msedge.exe
2040 msedge.exe
2040 msedge.exe
2040 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

944 msedge.exe
944 msedge.exe

pid	process
4940	msedge.exe
4940	msedge.exe
944	msedge.exe
944	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 944 wrote to memory of 3872	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 3872	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4588	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4940	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4940	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4868	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4868	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4868	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4868	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4868	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4868	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4868	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4868	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4868	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4868	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4868	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4868	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4868	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4868	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4868	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4868	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4868	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4868	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4868	944	msedge.exe	msedge.exe
PID 944 wrote to memory of 4868	944	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80fb846f8,0x7ff80fb84708,0x7ff80fb84718
2⤵
PID:3872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,18421581853049094001,10224496002376863586,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
2⤵
PID:4588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,18421581853049094001,10224496002376863586,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,18421581853049094001,10224496002376863586,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
2⤵
PID:4868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,18421581853049094001,10224496002376863586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
2⤵
PID:4524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,18421581853049094001,10224496002376863586,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
2⤵
PID:1524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,18421581853049094001,10224496002376863586,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2972 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
36155f86204c8adf224ca478e7ebacf4

SHA1
fc03b2828ecd8d7d8d88cb82e86b2e31ca8038c8

SHA256
1a7a3d4210925377488fc8ea64095295e793eab50da18f1284d130819b8f5746

SHA512
fa5f6134cbeab0785aa6f1ca512d6d6c06cd56f35050f7c94e0ddabdad186a342c364b9902867e650f2c36bb31c26d110fa2d9cebc3d059463276d3489256eb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6558fe0a71d70763b1366708d45a2de1

SHA1
a3485c47df8f2c294ab9c5230bf5ceff5eb78d97

SHA256
2f7cdb66eb0b84593127ac1a9ba5269834e37c39d946d836d2f41dcf477d84ff

SHA512
dd0369699bfd43037d798e9867ffc33b09ce549c899cce06cd51f851566624956675f0872200759167042ae5c11c4ddc5f116ae14b4e8b6d718a2d29f61cd20c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
414b956c856fea83f632b9bdcc1a6b42

SHA1
973df98c8467c2596054606c8d7b26a68fbc5b6d

SHA256
625c75a93f6808e542f45fcd7532c954cc4ab2adc9aa054cd1fbe00922f36fe7

SHA512
93b4d74e1ecd429fa941aa12915c38076fe2a66e26fb11e9aa04d7299a18c006aef728348d11e18e7517870f1d8f09235845d33bf7c3fcc32e2a1d4a1b808b02

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads