d4332dc235e2496c189254891497262a99217ed3f7e137423a7e5fda72c42b2e

General

Target

sample.html
Size

218KB
MD5

c9e2891066b1c6ffd8fc5c966a9a451b
SHA1

f3964c397e082c90045f25a2136efac8ffbf750b
SHA256

b6bf1b25ff04028e7b3038a9496cdd38c6472bf2da0b5ccb4eb42553a30217de
SHA512

79f1f2b500f2066dd580d6036d6c72f8430c919067d9db5f3cb185b50e434138f7b3555a49d5ca9f12ba7257c092174ab37720a65d53c1a2ceeeed881a876b3e
SSDEEP

3072:SvRkd3g/N1yfkMY+BES09JXAnyrZalI+YQ:SvRg38gsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

3440 msedge.exe
3440 msedge.exe
5076 msedge.exe
5076 msedge.exe
3904 msedge.exe
3904 msedge.exe
3904 msedge.exe
3904 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

5076 msedge.exe
5076 msedge.exe

pid	process
3440	msedge.exe
3440	msedge.exe
5076	msedge.exe
5076	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 5076 wrote to memory of 3608	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 3608	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 4680	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 3440	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 3440	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 5088	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 5088	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 5088	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 5088	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 5088	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 5088	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 5088	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 5088	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 5088	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 5088	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 5088	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 5088	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 5088	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 5088	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 5088	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 5088	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 5088	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 5088	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 5088	5076	msedge.exe	msedge.exe
PID 5076 wrote to memory of 5088	5076	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff9b3c846f8,0x7ff9b3c84708,0x7ff9b3c84718
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,6561458489561269490,3489074655063086730,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,6561458489561269490,3489074655063086730,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,6561458489561269490,3489074655063086730,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6561458489561269490,3489074655063086730,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6561458489561269490,3489074655063086730,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,6561458489561269490,3489074655063086730,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cfeed81c4840e4c431df6a558314ad5f

SHA1
f1169138b9ed6bffd9c83077b69c1c693d4e519b

SHA256
811d7e3878f0d68a40275605d007487a6b8c305c136bedb5c55715c22a24d04d

SHA512
11d40b8a93e1c2799cc4fbc15159838545d65b51b9621f07e7735f661fc89f336a6aae83fe4a072a7c152ec223fd390967a95f4c06c7276d52cf28e2a4657cca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1ba5dba6a5d7bf8c2ef89d1814129e65

SHA1
b585e82dff6ca3bd02e13fc1f3715f03c68b44e7

SHA256
18d1ce747fccbf8af0aed9e9c77a2135be5a74b70f16da5131fb14f4e121be60

SHA512
9ddd552cfe5fb20f98feae098c2923844d689ff6ee4522e2f9c2ed507d0727d4bc3727707221e577b94d9e07b5f29dbc145f5987c70ff210731364fa6d4f0144

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
12e0aa81bbdd4383a1d8f27326ca3522

SHA1
f1a286d2268230f9b238125dbc70d7de82ac0b68

SHA256
910709b8998cb80357461c44aba0fd95b1e03a1df437fe1bbce9dbdbb5aab9f7

SHA512
7509d62f144eae4015ef9a8c40fc1941c2a247ed7513bc3b666b7838001d14eaae208d7f6b2d52b06b81c69bf7cfa7f4e044f624f3a27fa0ae8188339002c9a2

Download Submit
\??\pipe\LOCAL\crashpad_5076_BMAFDPDJTHTXCWBV

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads