Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
25/05/2024, 00:36
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target sample.html
- Size 218KB
- Sample240525-axyldsgf87
- SHA256 99783615afdce4f324ae6ed3d2d042b3699126397145bbad06d8bf8eaf8574a3
- MD5 71e366fa0e3c0cbde1ba505605df9a17
- SHA1 967b8a47f7e02831eee22297f8044275f09e9f4c
- SHA512 39be9510c1bb93ea4724f654e4a3292eb260c969334d9fea1257e01b677713fd3f92702bfd218a2bce29ca2ba7b9c65313cd2365c648c1ba7c00f7186f26562b
- SSDEEP 3072:SDRl3Eq81v4q+XtnyfkMY+BES09JXAnyrZalI+YQ:SDRJEIUsMYod+X3oI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2372 msedge.exe 2372 msedge.exe 2616 msedge.exe 2616 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe 3180 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2616 msedge.exe 2616 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2616 wrote to memory of 2624 2616 msedge.exe 84 PID 2616 wrote to memory of 2624 2616 msedge.exe 84 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 4908 2616 msedge.exe 85 PID 2616 wrote to memory of 2372 2616 msedge.exe 86 PID 2616 wrote to memory of 2372 2616 msedge.exe 86 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87 PID 2616 wrote to memory of 2736 2616 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90ff846f8,0x7ff90ff84708,0x7ff90ff847182⤵PID:2624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,9118861485141700536,6122938807648667513,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:22⤵PID:4908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,9118861485141700536,6122938807648667513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,9118861485141700536,6122938807648667513,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:82⤵PID:2736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9118861485141700536,6122938807648667513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:5024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9118861485141700536,6122938807648667513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:4268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,9118861485141700536,6122938807648667513,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3180
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2244
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3760
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
- MD5 537815e7cc5c694912ac0308147852e4
- SHA1 2ccdd9d9dc637db5462fe8119c0df261146c363c
- SHA512 63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
- MD5 8b167567021ccb1a9fdf073fa9112ef0
- SHA1 3baf293fbfaa7c1e7cdacb5f2975737f4ef69898
- SHA512 726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 8523ff1b3291c5f351de0137f225c93bf54ff1b225cb40eb9cf96960b09e7181
- MD5 b1409b1a13d18aa02210a9e2120dd6c1
- SHA1 9adfcafe71e4ce630a1f6811627d2e668f3b1112
- SHA512 fd383a5bbe828f1aad797e020bf40653729c4f878b51f1e43b27cfa74a3b31c7c908cc409cd438c1420885c0cf78b8bb073e23e4d2a172b478a7df788adea0ef
- SSDEEP 96:ny/kRJY1sj9wpvWMoiVmdeHpRQ4atUWQyV+VDCziEwb:ny/ko2j9GWMXpxatro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 3d19f88c481a6a3e4fa6aced6c9fa89751cd28cb3bb394a322e3b4155cfc1689
- MD5 04b5d6a25bf179bd4f10a8300625b203
- SHA1 61cd12afc4200e224e2b0d561901c516662a9b50
- SHA512 ee3bbb7830306aa2d118e2663d9a82c4438f5d13858a9f88aa4de98748eba7e6cff5b36ea1a8a62708f114f9b8b33fb4858dfa4e9f4bf7bd4a17831913cb3bec
- SSDEEP 96:ny/k8JY1si9wpvWMoiVmdeHpRQ4atUWQyV+VDCAiEwb:ny/kT2i9GWMXpxatrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 0fabffa7029835cf87fb02cb098b25f2f2c89ab3e3d77b364c35cadc1d8e9183
- MD5 69c7940ecbb4b7a2f4129c2241970b4b
- SHA1 e0239304f2d8ee8c7736ecc03a03c2a673c5dc02
- SHA512 3cecb31ed569fa529757da446b2d308a76ffc49420dbb25d523b27759977a214f829b4b22d47bfcb7b650e9eb1a9188e6c2aac88371bc37a2b75160c4cadd20f
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup2one2RUlDqT+s3z2OMDCRO:A9iIxuERzA83h09RZxY2o48+saOMWRHu
- MD5 SHA1 SHA512 SSDEEP