Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 01:28
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240508-en
General
-
Target
sample.html
-
Size
213KB
-
MD5
1c64afa1a4a85eabd3c2fb71f641a000
-
SHA1
0f1f7a6900283b4fa26e5cdb7ace6a5099bbc443
-
SHA256
7590054977fb3d86f9e65ecd5a1ea58f78d7e97ab3f59a3bb172f38d9ca97d61
-
SHA512
9447ff87d79e5bdaa88bc8786c8a5b7bdf5ba148005b2c06206bf418b7d9dfbb845b108be620def8ca98dfe3966a1c51fa9c67841cdbccde36abb4280907302b
-
SSDEEP
3072:ShCAuqXsj+bhiyfkMY+BES09JXAnyrZalI+YQ:ShFTnsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
msedge.exemsedge.exemsedge.exepid process 3152 msedge.exe 3152 msedge.exe 3144 msedge.exe 3144 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe 1680 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
msedge.exepid process 3144 msedge.exe 3144 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe 3144 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3144 wrote to memory of 2808 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 2808 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 1812 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 3152 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 3152 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 2920 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 2920 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 2920 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 2920 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 2920 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 2920 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 2920 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 2920 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 2920 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 2920 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 2920 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 2920 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 2920 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 2920 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 2920 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 2920 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 2920 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 2920 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 2920 3144 msedge.exe msedge.exe PID 3144 wrote to memory of 2920 3144 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ffc752146f8,0x7ffc75214708,0x7ffc752147182⤵PID:2808
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,9986786626214626865,10892704900239107588,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:22⤵PID:1812
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,9986786626214626865,10892704900239107588,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3152 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,9986786626214626865,10892704900239107588,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:82⤵PID:2920
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9986786626214626865,10892704900239107588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:2200
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,9986786626214626865,10892704900239107588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:1968
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,9986786626214626865,10892704900239107588,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1940 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1680
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3308
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2056
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA256284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
SHA512971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
-
Filesize
152B
MD587f7abeb82600e1e640b843ad50fe0a1
SHA1045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA256b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
SHA512ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
-
Filesize
5KB
MD5ae4ca38dff3cabbec807f11f419cb7c4
SHA139798b0c743ffaad84d83eef71e55432ecaf3af0
SHA25679e7fef8489e56d8a728e2365e8c1601a75e40ef8d15e5c2a5c5302c96a94358
SHA51258d93bd35b24d433ddf671d9e705a794ed2f65cf324895e9ba8fd5feba7c145c60c735adeaa5e3917f4afa173d554e228af421c5b2c53d58f7a090e94d3cf9c2
-
Filesize
6KB
MD53882d83cfbf00510c28f6e9ebc8db23a
SHA10a56fd839a4ec9e2efd52e581f669e1a5e78d58b
SHA2567e7db0474a5844694aa6da3141993b657e248930389bff4f55e4518e036953d8
SHA512787b09511c0bd0f51d74d89bf2a6b53fb568736487724be80c2631f2654d816140bb44e5c0c96ea818b4dbcf818637ac4f3a3f35a263d2ed6df8de814ad3f9e2
-
Filesize
11KB
MD59748307917c9cad36bf78b0ac5d5385b
SHA145c29f47614f36b21f7e9c4a163ea191880f2107
SHA25623615406a816cce987bf7de1ebd61de109b498d931fc8cf6570ae252e9e9a6fb
SHA512d242bad19653eac104eb5783a044c51c6c7c6eb2af9b28f8448109c05aa8e08cfc006d2ccf1b0e44e35339942035edd51c660212d6f517d048c7c774f254bfc4
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e