Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2024, 01:41
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target sample.html
- Size 220KB
- Sample240602-b37lxsfb55
- SHA256 250b6a14b66c9b2b3ba3d3169349d9579a28a9a6d60ccc78d167d32b41451b4d
- MD5 d5d83b39e1024ee9b59db8f01b1c1af5
- SHA1 ae7eaddf0e9c179fe2bcdbcbce03631a606d6fc9
- SHA512 1341fd6ebfc6c7b3713f193bcd2e1bdacaf755d52ad267cc7d725e480344bcd9e406cd0758e0717263a2fb8cd7362bcf168788e158fb574c53deb08d38aad24d
- SSDEEP 3072:SFX2QiQxfF6+L76yyX7yyfkMY+BES09JXAnyrZalI+YQ:SA+f0+W3jsMYod+X3oI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4836 msedge.exe 4836 msedge.exe 940 msedge.exe 940 msedge.exe 2992 msedge.exe 2992 msedge.exe 2992 msedge.exe 2992 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 940 msedge.exe 940 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe 940 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 940 wrote to memory of 1956 940 msedge.exe 81 PID 940 wrote to memory of 1956 940 msedge.exe 81 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4332 940 msedge.exe 82 PID 940 wrote to memory of 4836 940 msedge.exe 83 PID 940 wrote to memory of 4836 940 msedge.exe 83 PID 940 wrote to memory of 4328 940 msedge.exe 84 PID 940 wrote to memory of 4328 940 msedge.exe 84 PID 940 wrote to memory of 4328 940 msedge.exe 84 PID 940 wrote to memory of 4328 940 msedge.exe 84 PID 940 wrote to memory of 4328 940 msedge.exe 84 PID 940 wrote to memory of 4328 940 msedge.exe 84 PID 940 wrote to memory of 4328 940 msedge.exe 84 PID 940 wrote to memory of 4328 940 msedge.exe 84 PID 940 wrote to memory of 4328 940 msedge.exe 84 PID 940 wrote to memory of 4328 940 msedge.exe 84 PID 940 wrote to memory of 4328 940 msedge.exe 84 PID 940 wrote to memory of 4328 940 msedge.exe 84 PID 940 wrote to memory of 4328 940 msedge.exe 84 PID 940 wrote to memory of 4328 940 msedge.exe 84 PID 940 wrote to memory of 4328 940 msedge.exe 84 PID 940 wrote to memory of 4328 940 msedge.exe 84 PID 940 wrote to memory of 4328 940 msedge.exe 84 PID 940 wrote to memory of 4328 940 msedge.exe 84 PID 940 wrote to memory of 4328 940 msedge.exe 84 PID 940 wrote to memory of 4328 940 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd3fa246f8,0x7ffd3fa24708,0x7ffd3fa247182⤵PID:1956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,3735769647843816331,17365276542371443901,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵PID:4332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,3735769647843816331,17365276542371443901,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,3735769647843816331,17365276542371443901,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:82⤵PID:4328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3735769647843816331,17365276542371443901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:4800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3735769647843816331,17365276542371443901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:4016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,3735769647843816331,17365276542371443901,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1676 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2992
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3736
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4988
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
- MD5 ae54e9db2e89f2c54da8cc0bfcbd26bd
- SHA1 a88af6c673609ecbc51a1a60dfbc8577830d2b5d
- SHA512 e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
- MD5 f53207a5ca2ef5c7e976cbb3cb26d870
- SHA1 49a8cc44f53da77bb3dfb36fc7676ed54675db43
- SHA512 be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 213e989a2969c9607023936ea8334999997bc7d8fe5c45e2f6cac750b92e9fa7
- MD5 0b4a78d15a3a4dfa0fc4183b9c1a072f
- SHA1 c794aba3bf96e3b0311ab540f6aad991755491be
- SHA512 fd21e90910c90f3991e96e1a1e9087ea8d666f06d663e7fe2519101217b0d7a471d0fa7e5b4f4d2b5afc4cc69516959cbf120ef5ab37fb5544167c8d5bf432f4
- SSDEEP 96:nLkFiY1m4e8wpvWMoiVmdeHpw8EEAwUWQyV+VDCAiEwb:nLkv84e8GWMXpwTwrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 6fdd775af593a6f129f32d82830c0c569336b8db3591b0ba3264a8bb072bf4a4
- MD5 bed3bfa9bc25aefe5087ac439fb5792e
- SHA1 caa3e5a75d2120d6703abffd706c864274787ef3
- SHA512 f9bea7ec153baea8193b8cfbe577ca380a4bc3888fb36b9c0a59dda0a20f00dcde1e2f98123e614877527f832a007be437420b18b1bb999ba3b919bf31899153
- SSDEEP 96:nLkOiY1mLe8wpvWMoiVmdeHpw8EEAwUWQyV+VDCziEwb:nLkS8Le8GWMXpwTwro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 10KB
- SHA256 f56546d75adfe0d2b5c21d27498708c20c92152636d7bb43c70945f4a171ca0b
- MD5 d16562223f7983efa1178b813b1ea40c
- SHA1 747f31c3563af6b9a99f0471ab20882dbb4be153
- SHA512 27ae3f6e5c6501044bbfbae6133edf71678cf13acde37c86debfdafb2a10fdb0aecc178f96fa5f2017e12ea48dff77a70a00fe2006e8f9dc79bde43c92e78a87
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup+M8e2RU1J+k83z2OMDCRHz:A9iIxuERzA83h09RZxYI28aOMWRHqlWZ
- MD5 SHA1 SHA512 SSDEEP