97100a8da2146d6a9d4746a850a84d79a3c941cefacb0357f346ed44c653adad

Resubmissions

01-06-2024 21:09

240601-zzxvbafa7v 7

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2024 21:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01-HTML-files-13-examples/May_787116.html
Size

61KB
MD5

deb59791141437efdf0ed373a5b13102
SHA1

8c06b9d9c732fe4aefe37f65dd20e56322385349
SHA256

b83ce1fb93f6e9f4d52deb736d1362e645a6e5a8f8371ee77a21228140f541b0
SHA512

46d947126db3070f4ae2297bbfbe96bc896018f0c1da39d909dc0853e36c90570c65c654bb4f6597cdc5d412e5d5bcc95508b503c16a1e9b0c83ac467c3d733e
SSDEEP

1536:UzxuJKxK7kdK2FlBNt0kLENLOZ3m/ANH5dyM:Uzxu6xdK2F//B04m/ANH3yM

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1132	msedge.exe
1132	msedge.exe
1200	msedge.exe
1200	msedge.exe
1868	identity_helper.exe
1868	identity_helper.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1200 msedge.exe
1200 msedge.exe
1200 msedge.exe
1200 msedge.exe
1200 msedge.exe
1200 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1200 wrote to memory of 3664	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3664	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 3372	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 1132	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 1132	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 1864	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 1864	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 1864	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 1864	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 1864	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 1864	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 1864	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 1864	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 1864	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 1864	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 1864	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 1864	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 1864	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 1864	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 1864	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 1864	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 1864	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 1864	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 1864	1200	msedge.exe	msedge.exe
PID 1200 wrote to memory of 1864	1200	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\01-HTML-files-13-examples\May_787116.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd5e2e46f8,0x7ffd5e2e4708,0x7ffd5e2e4718
2⤵
PID:3664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,7990336242916202370,11313620859690537533,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
2⤵
PID:3372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,7990336242916202370,11313620859690537533,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,7990336242916202370,11313620859690537533,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
2⤵
PID:1864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7990336242916202370,11313620859690537533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
2⤵
PID:396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7990336242916202370,11313620859690537533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
2⤵
PID:1020

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,7990336242916202370,11313620859690537533,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
2⤵
PID:1016

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,7990336242916202370,11313620859690537533,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7990336242916202370,11313620859690537533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
2⤵
PID:4524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7990336242916202370,11313620859690537533,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
2⤵
PID:840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7990336242916202370,11313620859690537533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
2⤵
PID:4680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7990336242916202370,11313620859690537533,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
2⤵
PID:4512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,7990336242916202370,11313620859690537533,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2792 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1336

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
183B

MD5
9e1275231d0007b3a42906cdadb34ea6

SHA1
de552221fd88afa25f6cdeceed2c825d4b40e41e

SHA256
3ac46af51f438f21927049f96db54e3060b81606bc3c1acfae0e125ac5c530e8

SHA512
5db406df1b09a4bc46c299deb653b949ab1dc6701977c5d964d1969333ea620585a5773ab3557ca87d19d18727e040a38285aca132828ff3491bb40a1dbee521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
2e2704b8c5a309946f226d765412767b

SHA1
142a3486a0f70a69efe7a522e290ea34063f2d0c

SHA256
75fa86d64de7b7b0e9a7cd11873879c4a938c8cb8fd0eb80510e16c2a8043c00

SHA512
22eea8ac71f95ac9a28b19f6c3ab03c2e3223e24d1a5fe93811e57c98bad6818b2f9e4a587c40239504a667b765041a5f0e48f3b10130a822373e12c4f0e8ad2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
bb0dd8a42aa81ef1d048b99954fb7bef

SHA1
3ca4bae2d4af480f70f3cb309c9086ac268213c5

SHA256
5637990e2dac14b2327b3bd1eed64b048bf4bccabded573ff925d97b1516795d

SHA512
0985076f9eb09c92def70761ac193784c479d6adc0935e46d2b15834babab6b6b7dce5a9a7db61a82a5c4cb1edd434e823fb44e7dec2670eaa64c0ba732104ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
25e95c102594e79296109c8a39df1234

SHA1
8ffe7e7b5ceea43a48898ff22b5a4e9951380207

SHA256
b5babd0ff1749d3333db6a8674cfe990e2509787aafe796950dabb2ca9a6bffd

SHA512
8b6e6636b870255a1583469a260e22231d5e3d30319da88f37a4fd2cac7ea6e43846f564abb21bbf51ea123d79c736b4be294c23974600a28ccd80b36c2c2b22

Download Submit
\??\pipe\LOCAL\crashpad_1200_LQZLWNNUNNRDRDSS
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit