Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2024, 00:36
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240426-en
General
-
Target
sample.html
-
Size
218KB
-
MD5
71e366fa0e3c0cbde1ba505605df9a17
-
SHA1
967b8a47f7e02831eee22297f8044275f09e9f4c
-
SHA256
99783615afdce4f324ae6ed3d2d042b3699126397145bbad06d8bf8eaf8574a3
-
SHA512
39be9510c1bb93ea4724f654e4a3292eb260c969334d9fea1257e01b677713fd3f92702bfd218a2bce29ca2ba7b9c65313cd2365c648c1ba7c00f7186f26562b
-
SSDEEP
3072:SDRl3Eq81v4q+XtnyfkMY+BES09JXAnyrZalI+YQ:SDRJEIUsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2372 msedge.exe 2372 msedge.exe 2616 msedge.exe 2616 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2616 msedge.exe 2616 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2616 wrote to memory of 2624 2616 msedge.exe 84 PID 2616 wrote to memory of 2624 2616 msedge.exe 84 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 2372 2616 msedge.exe 86 PID 2616 wrote to memory of 2372 2616 msedge.exe 86 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90ff846f8,0x7ff90ff84708,0x7ff90ff847182⤵PID:2624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,9118861485141700536,6122938807648667513,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:22⤵PID:4908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,9118861485141700536,6122938807648667513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,9118861485141700536,6122938807648667513,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:82⤵PID:2736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9118861485141700536,6122938807648667513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:5024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9118861485141700536,6122938807648667513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:4268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,9118861485141700536,6122938807648667513,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3180
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2244
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3760
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5537815e7cc5c694912ac0308147852e4
SHA12ccdd9d9dc637db5462fe8119c0df261146c363c
SHA256b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
SHA51263969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
-
Filesize
152B
MD58b167567021ccb1a9fdf073fa9112ef0
SHA13baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA25626764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
SHA512726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
-
Filesize
5KB
MD5b1409b1a13d18aa02210a9e2120dd6c1
SHA19adfcafe71e4ce630a1f6811627d2e668f3b1112
SHA2568523ff1b3291c5f351de0137f225c93bf54ff1b225cb40eb9cf96960b09e7181
SHA512fd383a5bbe828f1aad797e020bf40653729c4f878b51f1e43b27cfa74a3b31c7c908cc409cd438c1420885c0cf78b8bb073e23e4d2a172b478a7df788adea0ef
-
Filesize
6KB
MD504b5d6a25bf179bd4f10a8300625b203
SHA161cd12afc4200e224e2b0d561901c516662a9b50
SHA2563d19f88c481a6a3e4fa6aced6c9fa89751cd28cb3bb394a322e3b4155cfc1689
SHA512ee3bbb7830306aa2d118e2663d9a82c4438f5d13858a9f88aa4de98748eba7e6cff5b36ea1a8a62708f114f9b8b33fb4858dfa4e9f4bf7bd4a17831913cb3bec
-
Filesize
11KB
MD569c7940ecbb4b7a2f4129c2241970b4b
SHA1e0239304f2d8ee8c7736ecc03a03c2a673c5dc02
SHA2560fabffa7029835cf87fb02cb098b25f2f2c89ab3e3d77b364c35cadc1d8e9183
SHA5123cecb31ed569fa529757da446b2d308a76ffc49420dbb25d523b27759977a214f829b4b22d47bfcb7b650e9eb1a9188e6c2aac88371bc37a2b75160c4cadd20f