a81d6020ca889afbd1038931b740450bc04a979aec9182a3a565f95769be77b7

General

Target

sample.html
Size

219KB
MD5

e68929788082a3dcc0223d6d856e4c58
SHA1

7751d6f764045de229a676ad41157c575f2d7e35
SHA256

9dc3ea28459d77cb1e75f2a9d7700166eae3f8438ebe4c71404c11df050ec45d
SHA512

d57961f6fe97af985a60d890775c2d006a76b9a9887b0912cb79408693ff1b18994cf6ab29c47c1e7082fa16fe7610ab3596d3af0c5aefb78ad61287e7006d83
SSDEEP

3072:SxaQAkRWqJnz03EyfkMY+BES09JXAnyrZalI+YQ:SxLQD5sMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

1148 msedge.exe
1148 msedge.exe
2064 msedge.exe
2064 msedge.exe
3260 msedge.exe
3260 msedge.exe
3260 msedge.exe
3260 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

2064 msedge.exe
2064 msedge.exe

pid	process
1148	msedge.exe
1148	msedge.exe
2064	msedge.exe
2064	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2064 wrote to memory of 2524	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2524	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 2552	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 1148	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 1148	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4336	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4336	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4336	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4336	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4336	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4336	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4336	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4336	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4336	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4336	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4336	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4336	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4336	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4336	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4336	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4336	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4336	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4336	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4336	2064	msedge.exe	msedge.exe
PID 2064 wrote to memory of 4336	2064	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbac2346f8,0x7ffbac234708,0x7ffbac234718
2⤵
PID:2524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,10128910153992853979,15136562981705396253,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
2⤵
PID:2552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,10128910153992853979,15136562981705396253,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,10128910153992853979,15136562981705396253,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
2⤵
PID:4336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10128910153992853979,15136562981705396253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
2⤵
PID:1924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10128910153992853979,15136562981705396253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
2⤵
PID:2924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,10128910153992853979,15136562981705396253,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5000 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5084

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
622f409a3787e9ef0094f897e7ac2f17

SHA1
80a028026d87d60e4253eb32a11dc30759a41158

SHA256
0750f5edc37edb818fc7bf4359c69283f7dae8c6b03259d6388a3d6d6f008ade

SHA512
e4158686ee225b5f749b6c0b50976b3eec0360d94e9e598cce0a02538ae957e996e10fabd982928c201fc9a1b4ae5a815473bb0224c4639494dd36faa84ffbdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
9126df28d714ed33c54756bcfd423c67

SHA1
8438c8cf7b863569773ddfff892fbae05978153c

SHA256
3aa7ff54039a28fa4b365afe6fabd3fd81a14153e2b22f02319f154c26b29c15

SHA512
ff02630195c571c72a9173af5d96818f889c1ebdd7716b4f1748b4f9ecefda858ca108705811edc37a7ceea36bba76cc10bf35cde7d47184edc8632e285406e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
1efd2c7196301546fe00423e357c7c43

SHA1
13afb68c234dbd39b8dad4b8eb5d1bb183a9f1d5

SHA256
0ba99fd550f984d80910bf047c45603d0b72835e087421eb49004c8058a54959

SHA512
eb3a8aa4f9b2d7fbba64b1aa28d6fe1b55f99c5f6233b9d8dca90339c8d66b692f2b1a0d804e0a380b7265fccf49aa30f2c696ddf3403ad98a41a70123da6b54

Download Submit
\??\pipe\LOCAL\crashpad_2064_CXEGQVZMEDQFTSIG
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads