185dbaebdcc2f1d9c1769cef19daf4d1f14a53f1c2da48df0a07023b443cd4f0

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 22:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

bf4bc2d0ce3c00cd5745ff9eabb8d0ee
SHA1

61826bb8fce2394a68e4c41f7d0b28d8bd926b6d
SHA256

a5c3d2f0f1dc4197ec7ecd45080a8c594f64ede8db9692b819a283a77cee4652
SHA512

89c834ae1a86ed9cb87943f06732c97eda8648fbab02804babc3b57ea44abb738cf239bad68385e0e55ad3aab1ff149ca1623535008499cc50c1eff79d89cdec
SSDEEP

3072:SBxVytJJVQWyfkMY+BES09JXAnyrZalI+YQ:SBSCTsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2720	msedge.exe
2720	msedge.exe
4588	msedge.exe
4588	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 4508	4588	msedge.exe	84
PID 4588 wrote to memory of 4508	4588	msedge.exe	84
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 4436	4588	msedge.exe	85
PID 4588 wrote to memory of 2720	4588	msedge.exe	86
PID 4588 wrote to memory of 2720	4588	msedge.exe	86
PID 4588 wrote to memory of 2936	4588	msedge.exe	87
PID 4588 wrote to memory of 2936	4588	msedge.exe	87
PID 4588 wrote to memory of 2936	4588	msedge.exe	87
PID 4588 wrote to memory of 2936	4588	msedge.exe	87
PID 4588 wrote to memory of 2936	4588	msedge.exe	87
PID 4588 wrote to memory of 2936	4588	msedge.exe	87
PID 4588 wrote to memory of 2936	4588	msedge.exe	87
PID 4588 wrote to memory of 2936	4588	msedge.exe	87
PID 4588 wrote to memory of 2936	4588	msedge.exe	87
PID 4588 wrote to memory of 2936	4588	msedge.exe	87
PID 4588 wrote to memory of 2936	4588	msedge.exe	87
PID 4588 wrote to memory of 2936	4588	msedge.exe	87
PID 4588 wrote to memory of 2936	4588	msedge.exe	87
PID 4588 wrote to memory of 2936	4588	msedge.exe	87
PID 4588 wrote to memory of 2936	4588	msedge.exe	87
PID 4588 wrote to memory of 2936	4588	msedge.exe	87
PID 4588 wrote to memory of 2936	4588	msedge.exe	87
PID 4588 wrote to memory of 2936	4588	msedge.exe	87
PID 4588 wrote to memory of 2936	4588	msedge.exe	87
PID 4588 wrote to memory of 2936	4588	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a1dd46f8,0x7ff9a1dd4708,0x7ff9a1dd4718
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,13027527347717378751,11398187760618970532,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,13027527347717378751,11398187760618970532,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,13027527347717378751,11398187760618970532,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13027527347717378751,11398187760618970532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13027527347717378751,11398187760618970532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,13027527347717378751,11398187760618970532,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c3ced8061cf9c5c1c428a2a669e09b0c

SHA1
8ed932b39b0d87bf621a8806671b10c24b48a22a

SHA256
804833214b9c70984f8a4112048af42e20ddd14e9e566cbaaea7d818931feeed

SHA512
51e6d777fe7cc55d7affed6449dd26c59317b36f6c3070ed6ad19b547346ac274aee520c08d4b9d6c6014cd1cac2b28299ebbb1baee76bd19b3ca2fee5b8de1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cb61c727f42acc9e7dfdcd5f4ddbd595

SHA1
3f4a9f47249cf667e94b6e04e79ed256630a40a0

SHA256
b337a7f1aaa76c6b7382c02ce1403583e1cbe514cc79480a3ca0eab279d9b9bc

SHA512
b5226d34ccdd2d5aa27c6189e7121227547b0efdf93c7b7269325ab01c804eae3a7682bcf52bac50f2c779338a810050578fd757471cdcd78d8caaeb77653f70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c96345f408473d84b7de52af4654f4b1

SHA1
2b570f6423204f6151c6e4e8d901e5875d6e06cb

SHA256
3bb38a8185e2666de7fb97b6ae9dd655dedd66d056a34fd778ac723cff43aaac

SHA512
102289f30c8345c0596929b772cae0c10ff5a2c67fec0228591dd22f3e69bd15e5d6e4eb77c45a14e7c3f2e380d8d01adc6fc676dab20bb12fc4ee1a29b8c44a

Download Submit