Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
01/06/2024, 00:59
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240426-en
General
-
Target
sample.html
-
Size
10KB
-
MD5
5441447e04633ab613d4d06720546954
-
SHA1
f3ae9cd4854da1889ac4331afbbefd662aaf9a0c
-
SHA256
c69c759f8d4b49b2e81fa8c45e529d65ec755237f272f6f835064d5a41c60980
-
SHA512
0b3314cb6509817b940857f6fb90ecfe089fab0722531deff7db0088d5e2fa98e1ef2e2e88392924f576dcbf36b64d24769b015be2c0f8bdde5b6e2b803f381a
-
SSDEEP
48:VMKbvPO3bE/yzOCbx/g1MZVVOjeABGbiECEVAJsSNar0ERTTX3eAMbDkBYsg04V+:VJK3YHCliM0jXGmJ4pRTTX3e3bk1CVVs
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4180 msedge.exe 4180 msedge.exe 3652 msedge.exe 3652 msedge.exe 2996 identity_helper.exe 2996 identity_helper.exe 1632 msedge.exe 1632 msedge.exe 1632 msedge.exe 1632 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe 3652 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3652 wrote to memory of 1128 3652 msedge.exe 81 PID 3652 wrote to memory of 1128 3652 msedge.exe 81 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 3976 3652 msedge.exe 82 PID 3652 wrote to memory of 4180 3652 msedge.exe 83 PID 3652 wrote to memory of 4180 3652 msedge.exe 83 PID 3652 wrote to memory of 3116 3652 msedge.exe 84 PID 3652 wrote to memory of 3116 3652 msedge.exe 84 PID 3652 wrote to memory of 3116 3652 msedge.exe 84 PID 3652 wrote to memory of 3116 3652 msedge.exe 84 PID 3652 wrote to memory of 3116 3652 msedge.exe 84 PID 3652 wrote to memory of 3116 3652 msedge.exe 84 PID 3652 wrote to memory of 3116 3652 msedge.exe 84 PID 3652 wrote to memory of 3116 3652 msedge.exe 84 PID 3652 wrote to memory of 3116 3652 msedge.exe 84 PID 3652 wrote to memory of 3116 3652 msedge.exe 84 PID 3652 wrote to memory of 3116 3652 msedge.exe 84 PID 3652 wrote to memory of 3116 3652 msedge.exe 84 PID 3652 wrote to memory of 3116 3652 msedge.exe 84 PID 3652 wrote to memory of 3116 3652 msedge.exe 84 PID 3652 wrote to memory of 3116 3652 msedge.exe 84 PID 3652 wrote to memory of 3116 3652 msedge.exe 84 PID 3652 wrote to memory of 3116 3652 msedge.exe 84 PID 3652 wrote to memory of 3116 3652 msedge.exe 84 PID 3652 wrote to memory of 3116 3652 msedge.exe 84 PID 3652 wrote to memory of 3116 3652 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8537f46f8,0x7ff8537f4708,0x7ff8537f47182⤵PID:1128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,12102608055340389524,11950768930370501294,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵PID:3976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,12102608055340389524,11950768930370501294,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,12102608055340389524,11950768930370501294,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:82⤵PID:3116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12102608055340389524,11950768930370501294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:4252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12102608055340389524,11950768930370501294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:3992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12102608055340389524,11950768930370501294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:12⤵PID:3176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12102608055340389524,11950768930370501294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:12⤵PID:4380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12102608055340389524,11950768930370501294,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:12⤵PID:3064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,12102608055340389524,11950768930370501294,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5596 /prefetch:82⤵PID:808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,12102608055340389524,11950768930370501294,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5596 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12102608055340389524,11950768930370501294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:12⤵PID:4348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,12102608055340389524,11950768930370501294,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:12⤵PID:4468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,12102608055340389524,11950768930370501294,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2264 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1632
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2764
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1608
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
Filesize
152B
MD5ae54e9db2e89f2c54da8cc0bfcbd26bd
SHA1a88af6c673609ecbc51a1a60dfbc8577830d2b5d
SHA2565009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
SHA512e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
-
Filesize
152B
MD5f53207a5ca2ef5c7e976cbb3cb26d870
SHA149a8cc44f53da77bb3dfb36fc7676ed54675db43
SHA25619ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
SHA512be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
-
Filesize
736B
MD51400f57c698b67f7504610361f976996
SHA102a38bf523a32ecdcf6f90051ff7d2a589ad58a4
SHA256e2d1dd812c44e0776a194d683107dae314b91a23f0dba1a46a627e777612f388
SHA5128bdd4813e80b64fcc849550f7057146b0a05f98d65326b2295075f307dd33fb1149f272d6ee87ffbaad901ef6899ab40d37777eb28215f675fcad09148419679
-
Filesize
5KB
MD57fc5d6686566f15afd7336d11d0bb225
SHA1bc46c5e1926b63ad4be7485cb6372e129600471a
SHA256ae87465826d9e93ba2498e125a7853f6da4ebbc4eaa576a028221930089e8029
SHA5128428b57c9c55bc5ef53e7b19233d695758923240f266332af6d08039aea03a1af809c74915d45b8f219842e07c5222eaec3c0bd5fde745b248844763c45de679
-
Filesize
6KB
MD52a6b5611784ffa9f250ce6c5d80f1ea2
SHA1f3ccd29ad705efce36826e6964dc00138e53cc9c
SHA2564ed6348adf5ea02d8be775ca3b8507b81dc348d0433d78a3e2c973bc973327ef
SHA512bf68b891d07ac4ea18e668fad4b5cacf6360a27c84f37a8629d70f45d02cea898c9c902040d7085b5f7b1559eec3b10d715907bf1d08dd463c08c3717371f87d
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5750bbb1a6305c2a31572db8e5a32a294
SHA185f05cbe9b94f7327b67715f60bae1cef4240efa
SHA256f21cd53636c20d6a889b01624c672227d2c6975b5efb263bb2e746bf6844f595
SHA51237dc1dd978951912f0b5a2ab0c1aea36fbed12a454b7bdd0c3f581ea8ca670ea50777dfd350321778c7bf67a1adc16a5071623919424ac13ee48c43e15b62e79