dfa30f31acb5ae391d53520a18853e45d35f144b971e5d295c3799cee818ae68

General

Target

sample.html
Size

41KB
MD5

291ff8f37b333e0ab1dc69aae74b9c16
SHA1

606502fc3155606a2e1e1ee06c56a57e964c60fe
SHA256

b82112d3d9534b842c4d0b1294f6621ae6229bdf5c3f669d8b33ccdebb97fbf6
SHA512

f13f4871f6cc8f7419a76092faa2bec88355804ac978984e4e5b633e0f3a3ac384148d64f385952c7d708689d6c776a4ada93fc6a7b52f0b83f5b98e8b63f639
SSDEEP

768:Stmh0OfXvKvdaxw60GgGBc3Z8vfxY+9AfkKsJ+JoOGoJty+2eHC6bj+1NxIw3m+l:StmS+ivdag0Bc3Z8vfxY+9AfkKsJ+Jov

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1400	msedge.exe
1400	msedge.exe
1824	msedge.exe
1824	msedge.exe
784	identity_helper.exe
784	identity_helper.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1824 msedge.exe
1824 msedge.exe
1824 msedge.exe
1824 msedge.exe
1824 msedge.exe
1824 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1824 wrote to memory of 3888	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 3888	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1380	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1400	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 1400	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 4932	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 4932	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 4932	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 4932	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 4932	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 4932	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 4932	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 4932	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 4932	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 4932	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 4932	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 4932	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 4932	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 4932	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 4932	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 4932	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 4932	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 4932	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 4932	1824	msedge.exe	msedge.exe
PID 1824 wrote to memory of 4932	1824	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec2bb46f8,0x7ffec2bb4708,0x7ffec2bb4718
2⤵
PID:3888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,15941046241299686198,13003302978234580505,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
2⤵
PID:1380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,15941046241299686198,13003302978234580505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,15941046241299686198,13003302978234580505,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
2⤵
PID:4932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15941046241299686198,13003302978234580505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
2⤵
PID:4816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15941046241299686198,13003302978234580505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
2⤵
PID:4524

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,15941046241299686198,13003302978234580505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
2⤵
PID:4312

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,15941046241299686198,13003302978234580505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15941046241299686198,13003302978234580505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
2⤵
PID:2372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15941046241299686198,13003302978234580505,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
2⤵
PID:4356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15941046241299686198,13003302978234580505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
2⤵
PID:4936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15941046241299686198,13003302978234580505,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
2⤵
PID:1088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,15941046241299686198,13003302978234580505,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5336 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5a460518-eff6-4e83-a6ff-d8b7b98f713a.tmp

Filesize
11KB

MD5
abc48883503b16c9860465cf8f3ae201

SHA1
8826ef581966601acf2610b6ec8b6a19d19ebc0e

SHA256
18625fc77eec1889f1f68478fd064e713959e9c61f9bd0f9a1a9a2d6fd53f4e6

SHA512
73614de0c14ad7b2aeec23a6e33cd4f086bda13d0da9186b24ac5a9bd3282aa75c18c125668c009d388837dc41490bcb7272734610fd756b043510039a4f16c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4ad2ebebd1ec39816e9c92d86b704586

SHA1
1744be8985b68167dae402e0d89b08ba313322ed

SHA256
5b26ff13b8dc0dd1df7aff1f084a85da50255207fb345f5c49f0da928cae4f22

SHA512
947b89d3e509bdc384812eaa76d29e16fe8675a262b90680257c2c3dac256efe41ffea2ac467d0f653a87de8b5cbeb45de0d53a2f691df6b7ed3085f77ea6871

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f6e8c257939e66637087e1e772d2efa3

SHA1
a433082aeead8ad7663192cb17cbaea55d9e435b

SHA256
b8f5386a6e38e754c5b4edd036e5ade19dc9983608e2eb07fab01959b29d67b5

SHA512
2a502de168653e649d3481cc6e83bed552e5948157f840809c64fde98d18504b5db97f2e57f1628698d654c1809fd089383547b0a9c1547e06e596705460d3d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
\??\pipe\LOCAL\crashpad_1824_UADYCYKRPUUSVTRX

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads