58b63ef29369897988bd78f8d52941aa5f0088b28eb202883201f3f6afc851ce

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 21:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

218KB
MD5

6b3981569954f6f7fdd3be239227cc8e
SHA1

1722dcccd5895395504bde40cc850c772bf3fe81
SHA256

2a03a8715bb742ff6deeb7a65b7bea8799a54e57588468a84b5308f11775b4b9
SHA512

dc21f2d4a220d0d546d2164874195be33e438d71e44e6fb56de9c231cb0e086c001506694b5158de85931780622579eda7398fc81a06d6eccb45d9907c8e966d
SSDEEP

3072:SuzmG+Jt9YoyfkMY+BES09JXAnyrZalI+YQ:S6m3tClsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2580	msedge.exe
2580	msedge.exe
6040	msedge.exe
6040	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe
3764	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
6040	msedge.exe
6040	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6040 wrote to memory of 4512	6040	msedge.exe	81
PID 6040 wrote to memory of 4512	6040	msedge.exe	81
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 3596	6040	msedge.exe	82
PID 6040 wrote to memory of 2580	6040	msedge.exe	83
PID 6040 wrote to memory of 2580	6040	msedge.exe	83
PID 6040 wrote to memory of 3396	6040	msedge.exe	84
PID 6040 wrote to memory of 3396	6040	msedge.exe	84
PID 6040 wrote to memory of 3396	6040	msedge.exe	84
PID 6040 wrote to memory of 3396	6040	msedge.exe	84
PID 6040 wrote to memory of 3396	6040	msedge.exe	84
PID 6040 wrote to memory of 3396	6040	msedge.exe	84
PID 6040 wrote to memory of 3396	6040	msedge.exe	84
PID 6040 wrote to memory of 3396	6040	msedge.exe	84
PID 6040 wrote to memory of 3396	6040	msedge.exe	84
PID 6040 wrote to memory of 3396	6040	msedge.exe	84
PID 6040 wrote to memory of 3396	6040	msedge.exe	84
PID 6040 wrote to memory of 3396	6040	msedge.exe	84
PID 6040 wrote to memory of 3396	6040	msedge.exe	84
PID 6040 wrote to memory of 3396	6040	msedge.exe	84
PID 6040 wrote to memory of 3396	6040	msedge.exe	84
PID 6040 wrote to memory of 3396	6040	msedge.exe	84
PID 6040 wrote to memory of 3396	6040	msedge.exe	84
PID 6040 wrote to memory of 3396	6040	msedge.exe	84
PID 6040 wrote to memory of 3396	6040	msedge.exe	84
PID 6040 wrote to memory of 3396	6040	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1ec946f8,0x7ffa1ec94708,0x7ffa1ec94718
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,12179864402232632163,14231204327776847741,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,12179864402232632163,14231204327776847741,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,12179864402232632163,14231204327776847741,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12179864402232632163,14231204327776847741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,12179864402232632163,14231204327776847741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,12179864402232632163,14231204327776847741,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4920 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c34a29923d445fc8ae4e35ce481c84b8

SHA1
65a824b04bce73a8c568bbc42a49b685c3fc06c8

SHA256
d8f0f47fa65790eb8996418aa40b69b38f65bd598a3508221e86dc621dfea9f5

SHA512
1fce50debd28a55f968b833aa7e8d3840049f1d8fb2c4fed3bd9a9c73bb1d5f436e0e8c01528c3f8d4679727e54994582fc2ddeefd7e285a04fb52424a8c93c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
97c7de7943529b4551045e7d161d738f

SHA1
a30d872b8042266b19452612b003ca32687e18fe

SHA256
323a7cd4eafde1c9ee2272d2710c3cc0dd43344dff1f980a9f5e318662e5ff3a

SHA512
d7ddc3469ea3021c01014618193ea1a5d59174b7c97ef4a30fb6613994cf6b00795e0fcc0d3da1d2b460d4b7f324dbd30ed16cfd251c475430672a20b52d5b61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a647b5ff156338a5ae7ca72183113824

SHA1
228470cf0dbe3f292e5e336795b636b9266d605a

SHA256
f8aa98485c2628e56020a7840c7c2e306ca5291d8388019a728cd0289785e6da

SHA512
bb7e68766db430b4213ae338e8dd901b5dd48804d9fc26764eead1d77a2219af9f8eea958626e71f63d7826d5c05a60ae287e3a2226a584bd21ef038b72e039b

Download Submit