7e18adc9c6d0346d6754f6129050796f813b504c2876dfbb16531a3918cd1743

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 22:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

5fd07065a2fd5d4ca7e8d13ef780123d
SHA1

d3934204ebe43f3ee37f952fd9ed01b075561490
SHA256

f15d4211b88017114cb1abb19e4d44688df55f7791ce9908cf9b0b7572aa1c84
SHA512

c1a0f3b1a13dcdec9acf35013713a62aa85312aef46d044254e012acc843ad2d6a13fd8d42caae8c1ed05ee17b9870a93dbbe5e4da8fa15c43b7faa0816e5b09
SSDEEP

3072:Sh40y4eQn+IpyfkMY+BES09JXAnyrZalI+YQ:ShNhMsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
3532	msedge.exe
3532	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 5072	3532	msedge.exe	82
PID 3532 wrote to memory of 5072	3532	msedge.exe	82
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1760	3532	msedge.exe	83
PID 3532 wrote to memory of 1748	3532	msedge.exe	84
PID 3532 wrote to memory of 1748	3532	msedge.exe	84
PID 3532 wrote to memory of 4408	3532	msedge.exe	85
PID 3532 wrote to memory of 4408	3532	msedge.exe	85
PID 3532 wrote to memory of 4408	3532	msedge.exe	85
PID 3532 wrote to memory of 4408	3532	msedge.exe	85
PID 3532 wrote to memory of 4408	3532	msedge.exe	85
PID 3532 wrote to memory of 4408	3532	msedge.exe	85
PID 3532 wrote to memory of 4408	3532	msedge.exe	85
PID 3532 wrote to memory of 4408	3532	msedge.exe	85
PID 3532 wrote to memory of 4408	3532	msedge.exe	85
PID 3532 wrote to memory of 4408	3532	msedge.exe	85
PID 3532 wrote to memory of 4408	3532	msedge.exe	85
PID 3532 wrote to memory of 4408	3532	msedge.exe	85
PID 3532 wrote to memory of 4408	3532	msedge.exe	85
PID 3532 wrote to memory of 4408	3532	msedge.exe	85
PID 3532 wrote to memory of 4408	3532	msedge.exe	85
PID 3532 wrote to memory of 4408	3532	msedge.exe	85
PID 3532 wrote to memory of 4408	3532	msedge.exe	85
PID 3532 wrote to memory of 4408	3532	msedge.exe	85
PID 3532 wrote to memory of 4408	3532	msedge.exe	85
PID 3532 wrote to memory of 4408	3532	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec2bb46f8,0x7ffec2bb4708,0x7ffec2bb4718
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,6496176345803091942,18140234005201469076,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1976,6496176345803091942,18140234005201469076,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1976,6496176345803091942,18140234005201469076,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,6496176345803091942,18140234005201469076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,6496176345803091942,18140234005201469076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,6496176345803091942,18140234005201469076,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5948 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9121b80bb7d7cccb1082c3ea08015877

SHA1
fb302fd3a244fc6e57259e02a563f9ef85e7bcf4

SHA256
0042d12bcd51fbf6103311ca726c2eed95e19d9839aa46b51b036f047e4d2804

SHA512
930485987c0cb9f1c5717f2ff8c4b02d7ce4db65a8e8b4014f7a166b6772a2643a08c74d776cdbefe26a1d2d4f08df031269c3d5232e6c10f229be52bf9ff9fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6909e3bcc0e9433bd4bcead4650f5672

SHA1
506aade26683d9d20e4c9f603d8563517894af82

SHA256
e2c3a850c83a38fb3be1466b084c4c5f16f9b27328a99aa945fe34920267165b

SHA512
f47bdb3bdfcd3d7a5bbc8319187e97d235d168607a7d17885f47d18e26c815081a02d6197bcc88a347ca709020eff87decc9888c3e7dac92662f031c804be0b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
eb8affd20db66bc15f588689a6db5b07

SHA1
0549ed09d5e8734c3868d3eb315b0c2108caaa57

SHA256
97541f90ffae1c6533f47084f886b5340642ba6658c7d49306ac161a0a946284

SHA512
71ab0ab23f635eea5c878117a95a1e9eae1f65161b786e8300e34583f67c75b21c0759d8b75cf27b006f6cbcd39f84399ffeaf7f639636b6fbedbe3a1affac4e

Download Submit