0b06a1bffc49c73110fedead00c992cd5f9339cb1744bd071ad6f62b0eebe3dd

General

Target

sample.html
Size

213KB
MD5

d433594e6d2b2f1886f2d8d1ac7e34e9
SHA1

e8a0b8a4536edb675775cc8441cc7af67f3dfcbd
SHA256

a8fafc38a80cf3c9ee39ba1c024021ce86252b6c1658cc8f4741871d66c6170c
SHA512

0a202eb5eec94c24711293ddae8ad196c3c6eb68972e411dff978d98c1e3f205d5c666e6dc9a4785c85b36b4e333134f4ce2a58c5c1cdf0a0624eae5dccdb0ab
SSDEEP

3072:SPG0e2KkSsxByfkMY+BES09JXAnyrZalI+YQ:SPtr/EsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

2324 msedge.exe
2324 msedge.exe
2968 msedge.exe
2968 msedge.exe
2264 msedge.exe
2264 msedge.exe
2264 msedge.exe
2264 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

2968 msedge.exe
2968 msedge.exe

pid	process
2324	msedge.exe
2324	msedge.exe
2968	msedge.exe
2968	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe
2968	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2968 wrote to memory of 4160	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 4160	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2416	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2324	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2324	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2808	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2808	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2808	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2808	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2808	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2808	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2808	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2808	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2808	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2808	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2808	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2808	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2808	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2808	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2808	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2808	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2808	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2808	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2808	2968	msedge.exe	msedge.exe
PID 2968 wrote to memory of 2808	2968	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe24a846f8,0x7ffe24a84708,0x7ffe24a84718
2⤵
PID:4160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2296,17884535421348689938,11826966012330097732,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2300 /prefetch:2
2⤵
PID:2416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2296,17884535421348689938,11826966012330097732,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2296,17884535421348689938,11826966012330097732,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
2⤵
PID:2808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,17884535421348689938,11826966012330097732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
2⤵
PID:4276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2296,17884535421348689938,11826966012330097732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
2⤵
PID:1572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2296,17884535421348689938,11826966012330097732,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4948 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
db6e8dbd15a3e116c3ad44cc2aa0f343

SHA1
9ebd9f5473d2daa0136204ef80baddb9925b55a4

SHA256
1c1799b9f29022ee2aa880999f6656755ec5df30657cd072ec80a83668485b50

SHA512
663d762bf0991731a5f6bead7fce6a38ec368afc56f0bf7f50fdef2a4b56c5a6b7056e67c9a86f74b1bb67db08bf3c780047c31e681d477a94b75e11e5b3130a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
57f7502074f4caf308844bbaca362e84

SHA1
cb6493419d9ab4ceaea4e0e8151cc251b7f2fcbb

SHA256
8e437bb511ae5970d4c6c1238c6ec31b7a0ed431d44a8f0025f76b0951300234

SHA512
5361af278498656b76317b49903ac2dd0cc3750f3205a9df41f5f796a997387146a7d1f2e71b6335cb6f138335cb4683bc7846df3a433585869c544f71400076

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
03886ecf8f3c81a29edd7c3867f96672

SHA1
51dd9891fd3414ed07f1d0a1ebc9abbbab78830e

SHA256
94df186db92a98616b6e8179da77cff605ae67e9950e1a967d980da4eb705598

SHA512
4c36243021d43c56382af83a0c069e827218cdef211f9750709dd72d3fbb67306538c65346003f1a9793e23ff60df48894314571a6d85fb40df362def44f3b70

Download Submit
\??\pipe\LOCAL\crashpad_2968_TYRNGRKLDKQBAVQY

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads