957c4185da5894c6746b3225a5137e42a1130f4c20ba58148c0f0ee258875019

Analysis

max time kernel
145s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2024 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

email-html-2.html
Size

7KB
MD5

626ec1ffe13be5c4969562d84c49d86e
SHA1

143005c5504ddbde91524e895d8e7fa5454f2cd0
SHA256

80105f4f0f1a2da3b761c6c4b2ce88b8099a53a1b7549d049642862a288c4a6b
SHA512

1e9197dfa33668fb6f4acae4e80292f36f683e2f6ddf7a0395d72510edd851b681811424e0ccbacc8d1f7cb80b246d90d6596796af1a75ae286a1fea967efbb0
SSDEEP

192:3fj8jiZKdxRhRqDGuCTt5sKhlj9t995awCKOCI4JsbJNSyI0gaC5WmWoND+zDfg6:r8jm6xRhRuGuCTt5Vh59t995v1OCI4JS

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3196	msedge.exe
3196	msedge.exe
2540	msedge.exe
2540	msedge.exe
2368	identity_helper.exe
2368	identity_helper.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe
2540	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2480	2540	msedge.exe	83
PID 2540 wrote to memory of 2480	2540	msedge.exe	83
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 2260	2540	msedge.exe	84
PID 2540 wrote to memory of 3196	2540	msedge.exe	85
PID 2540 wrote to memory of 3196	2540	msedge.exe	85
PID 2540 wrote to memory of 528	2540	msedge.exe	86
PID 2540 wrote to memory of 528	2540	msedge.exe	86
PID 2540 wrote to memory of 528	2540	msedge.exe	86
PID 2540 wrote to memory of 528	2540	msedge.exe	86
PID 2540 wrote to memory of 528	2540	msedge.exe	86
PID 2540 wrote to memory of 528	2540	msedge.exe	86
PID 2540 wrote to memory of 528	2540	msedge.exe	86
PID 2540 wrote to memory of 528	2540	msedge.exe	86
PID 2540 wrote to memory of 528	2540	msedge.exe	86
PID 2540 wrote to memory of 528	2540	msedge.exe	86
PID 2540 wrote to memory of 528	2540	msedge.exe	86
PID 2540 wrote to memory of 528	2540	msedge.exe	86
PID 2540 wrote to memory of 528	2540	msedge.exe	86
PID 2540 wrote to memory of 528	2540	msedge.exe	86
PID 2540 wrote to memory of 528	2540	msedge.exe	86
PID 2540 wrote to memory of 528	2540	msedge.exe	86
PID 2540 wrote to memory of 528	2540	msedge.exe	86
PID 2540 wrote to memory of 528	2540	msedge.exe	86
PID 2540 wrote to memory of 528	2540	msedge.exe	86
PID 2540 wrote to memory of 528	2540	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7fff631e46f8,0x7fff631e4708,0x7fff631e4718
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,11674452058799288370,18045960064549125640,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,11674452058799288370,18045960064549125640,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,11674452058799288370,18045960064549125640,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11674452058799288370,18045960064549125640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11674452058799288370,18045960064549125640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,11674452058799288370,18045960064549125640,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4644 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,11674452058799288370,18045960064549125640,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4644 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11674452058799288370,18045960064549125640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11674452058799288370,18045960064549125640,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11674452058799288370,18045960064549125640,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11674452058799288370,18045960064549125640,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,11674452058799288370,18045960064549125640,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5476 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
21c9374a7778e73af45522f9926a7e21

SHA1
a73e8a5930e3fb2a9ea09a9b6694d55e281ffd59

SHA256
fb628e8b7e9aaaab2ca132f1002cd6cd4108b95793435df4e20d3cdd9b45ba14

SHA512
98ee4c69aa0c98f3053958869935666bd21878696b2a4fd22b3dc5cb3741242ba356686e39f19e8b00517420ffe5d93fa716efa7b34850836c844f961b5c7422

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
29c86ca9910090652068162cd53006c7

SHA1
7b4842b24834b84a6a2cb59515a9b1c2626d14b6

SHA256
ded666f14ba384ce0b45e924244e969e8926f4d732406bb688c5e5555252385b

SHA512
ebb292deec532d4692ab26ce03ab4b5a62e946b36adbfaa1a82550bf895ea56d342f2e7b9906b9dd8b2b0fb5243cd094f805e0794dc1adae7445a478f63dddfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
823047a6617add4eab6eb6909b74db4f

SHA1
c9acafe49eea29b622d4f40001da3ecbd9d1246e

SHA256
347d9194f86196adea136918344def7407dd102ba71c32e67efb8a3fb952b216

SHA512
8b34fe9e793c2645fb42fc2a958fa6e3757f0f921e437e5220050ab06171cc8e35be9d9680e7028d10f5178e19b1ad88ee16ac42e7031614ef56685312418b5f

Download Submit