74985a68b2a17f4efdd99341959c1ae10105f7eee697098e1fbab776e0ebcac7

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 14:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

118c24e7b2a41f7f58e7b6dfa8813274
SHA1

8b65aa8c48aa915daf73ad5defe215222a9bbdb3
SHA256

14c659832b8bba2fcd9e8efb804071db52ca89bbcd5f146ef3ecb0c3479132e7
SHA512

2aa8a20335ae4e0020a38a90239d21b1ff8b1d935b3e9a2eacdc8f6377cad6f340f6c1a422477210de2d74262aca8643d74a44865f5f2c7e43bec3bdb2c8ec64
SSDEEP

3072:SdEyCESn493+f/yfkMY+BES09JXAnyrZalI+YQ:Sd5M9KsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3076	msedge.exe
3076	msedge.exe
2092	msedge.exe
2092	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2092	msedge.exe
2092	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe
2092	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 3580	2092	msedge.exe	82
PID 2092 wrote to memory of 3580	2092	msedge.exe	82
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3928	2092	msedge.exe	83
PID 2092 wrote to memory of 3076	2092	msedge.exe	84
PID 2092 wrote to memory of 3076	2092	msedge.exe	84
PID 2092 wrote to memory of 2888	2092	msedge.exe	85
PID 2092 wrote to memory of 2888	2092	msedge.exe	85
PID 2092 wrote to memory of 2888	2092	msedge.exe	85
PID 2092 wrote to memory of 2888	2092	msedge.exe	85
PID 2092 wrote to memory of 2888	2092	msedge.exe	85
PID 2092 wrote to memory of 2888	2092	msedge.exe	85
PID 2092 wrote to memory of 2888	2092	msedge.exe	85
PID 2092 wrote to memory of 2888	2092	msedge.exe	85
PID 2092 wrote to memory of 2888	2092	msedge.exe	85
PID 2092 wrote to memory of 2888	2092	msedge.exe	85
PID 2092 wrote to memory of 2888	2092	msedge.exe	85
PID 2092 wrote to memory of 2888	2092	msedge.exe	85
PID 2092 wrote to memory of 2888	2092	msedge.exe	85
PID 2092 wrote to memory of 2888	2092	msedge.exe	85
PID 2092 wrote to memory of 2888	2092	msedge.exe	85
PID 2092 wrote to memory of 2888	2092	msedge.exe	85
PID 2092 wrote to memory of 2888	2092	msedge.exe	85
PID 2092 wrote to memory of 2888	2092	msedge.exe	85
PID 2092 wrote to memory of 2888	2092	msedge.exe	85
PID 2092 wrote to memory of 2888	2092	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc63f746f8,0x7ffc63f74708,0x7ffc63f74718
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,3143015695719062531,11819822662633335340,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,3143015695719062531,11819822662633335340,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,3143015695719062531,11819822662633335340,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3143015695719062531,11819822662633335340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,3143015695719062531,11819822662633335340,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,3143015695719062531,11819822662633335340,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8bd86991-38d5-435b-b29c-f1bb8ea85116.tmp

Filesize
5KB

MD5
90409138b9a7d200fb5a9a52b0590a87

SHA1
ecce5febb63b04078e673a9318fb9ce526838493

SHA256
28b79b8f360c9cc753fa01110e28d72e927d5e920d83a9901b1b0e85880e4db4

SHA512
b6d6f3df37af2ee4df98e996df3118cf7d3dd7506ef013ecca19920f4f255d113833a32031f879ca853e85ea72c236aecac4364c100cff2f2c597da5e68ec25c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
049b3e2ff18d14f3f992879da35631c0

SHA1
9bbeb3c09f737e080fc31cb9620c264340423529

SHA256
ad3980058d6fdc81c622a4b133a36dbd0e900a6f8624403069a7cc0d3d41a1ba

SHA512
196145a72ba96229eb48a7697634a08ebc00a93ff608263b5d49dd312024e930a6a49a0fb7b894b7f2a8acfcff95fb1b6cf0c4b6230ef1d44af800ae663c4aca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
37853ee3f365dcc5c7ab01e9313613d6

SHA1
f4676c7e9baa13cb3f1ebdf0a1f81052d5054357

SHA256
5eb9a1ebe201afb2d3fd7240e9583d4d16d5465a4124d3be98c54f0151a50527

SHA512
8d70874691899b3b28bc1cc9f2fc97b577881a71a32ab87a6a6c2a80471af48f8428d90cf6019eba0749535f251f946c97d6226c730f9698f89040a2dd3e0ad9

Download Submit