02e27070c8145163ac1168bd9ced806be067484df6b29d84367ab76969627823

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 11:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

1578d1126448693031534997aa21f187
SHA1

10706de06b2a1ec8caec045e0d72c40d18b0434d
SHA256

837d4fb915d449e3d711ced0f8a898e9bc94a0a2112e8689fc175f7cd5eb9bc2
SHA512

e0cc4270b4e587ea68d990af6d57d3105b5572542f30a32a422ac0a3a2b30473254af2c08bff4a348129d88f7e7be8c3204dcbeb51728e652b352c8b658f8853
SSDEEP

3072:SeGia2i0bQ3diyfkMY+BES09JXAnyrZalI+YQ:SesrnsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
3080	msedge.exe
3080	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3080	msedge.exe
3080	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe
3080	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 660	3080	msedge.exe	83
PID 3080 wrote to memory of 660	3080	msedge.exe	83
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4028	3080	msedge.exe	84
PID 3080 wrote to memory of 4648	3080	msedge.exe	85
PID 3080 wrote to memory of 4648	3080	msedge.exe	85
PID 3080 wrote to memory of 2084	3080	msedge.exe	86
PID 3080 wrote to memory of 2084	3080	msedge.exe	86
PID 3080 wrote to memory of 2084	3080	msedge.exe	86
PID 3080 wrote to memory of 2084	3080	msedge.exe	86
PID 3080 wrote to memory of 2084	3080	msedge.exe	86
PID 3080 wrote to memory of 2084	3080	msedge.exe	86
PID 3080 wrote to memory of 2084	3080	msedge.exe	86
PID 3080 wrote to memory of 2084	3080	msedge.exe	86
PID 3080 wrote to memory of 2084	3080	msedge.exe	86
PID 3080 wrote to memory of 2084	3080	msedge.exe	86
PID 3080 wrote to memory of 2084	3080	msedge.exe	86
PID 3080 wrote to memory of 2084	3080	msedge.exe	86
PID 3080 wrote to memory of 2084	3080	msedge.exe	86
PID 3080 wrote to memory of 2084	3080	msedge.exe	86
PID 3080 wrote to memory of 2084	3080	msedge.exe	86
PID 3080 wrote to memory of 2084	3080	msedge.exe	86
PID 3080 wrote to memory of 2084	3080	msedge.exe	86
PID 3080 wrote to memory of 2084	3080	msedge.exe	86
PID 3080 wrote to memory of 2084	3080	msedge.exe	86
PID 3080 wrote to memory of 2084	3080	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa80746f8,0x7fffa8074708,0x7fffa8074718
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,4575826376220804559,15320905832639371565,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,4575826376220804559,15320905832639371565,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,4575826376220804559,15320905832639371565,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4575826376220804559,15320905832639371565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4575826376220804559,15320905832639371565,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,4575826376220804559,15320905832639371565,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e37e0cb9880816504993ea0a034b2da7

SHA1
39ef8051cf49a038f2d906ea23d83676696bbced

SHA256
58a1d3f61361472e066f1a6853475a983369474390aed07964ad26a23b253102

SHA512
7b306b5b9a76d627992abfda609122a62e4980eb3141294ce264a0e3dfd63d4a758cd7d75f76243cd408e08bfc701536e1b03c1345fbf253bb5399f450fe53e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b9cc5f852c8c2b179960aa674d9f70bd

SHA1
c3de3a199ce346ebb3b244592081fe17ba1f1034

SHA256
253c56e99ac6ec2d41a6ee743566c7094fe699a4779d900935223bc1d4f0eb4d

SHA512
33a85d6d8e6a3cef93ded17e62f9ad79655b7fe20963e74d177058882c9bbd980ce7142d1ced608e83ba6b382ee24bcb3bba038d834773ecf16040142f1f31c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7710028f987eef6b6bc403c6cb81772b

SHA1
28e3a5fde8097eea219167db5b90a9f45e9a2622

SHA256
b00d6b83af5c77ac77c120474ca2b3618683054d1cc8a7ac4508686998be7e3e

SHA512
e033b65e43dece5d86790ebfdc61346be19572544de163130ad248a42c59f64d46544ed69f295631c07ae3d19a5d3dbfee3df97722da71c15991c88ef30fb46d

Download Submit