Resubmissions
02/06/2024, 04:49
240602-ffx67abe91 1Analysis
-
max time kernel
10s -
max time network
12s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
02/06/2024, 04:49
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win11-20240426-en
General
-
Target
sample.html
-
Size
1KB
-
MD5
34fd336801700846dd3d1a5ecd3e6226
-
SHA1
0f1a6975d855c3fe27f7b141e81583577dac38fd
-
SHA256
74d44a89c07a6b1f8c27f6b1d0907fe8b0c7a1474d27edb515f04a244c78db58
-
SHA512
653371dd11beff1a5107428af8f8c3cf77114f03c252ef2dbe011b6e65b5025e1213aecc218102e07b4ab66c3913f6e2807b750a89b3f1906e83166a87b3e136
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4476 msedge.exe 4476 msedge.exe 4876 msedge.exe 4876 msedge.exe 4008 msedge.exe 4008 msedge.exe 764 identity_helper.exe 764 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4876 wrote to memory of 2736 4876 msedge.exe 77 PID 4876 wrote to memory of 2736 4876 msedge.exe 77 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 5016 4876 msedge.exe 78 PID 4876 wrote to memory of 4476 4876 msedge.exe 79 PID 4876 wrote to memory of 4476 4876 msedge.exe 79 PID 4876 wrote to memory of 2820 4876 msedge.exe 80 PID 4876 wrote to memory of 2820 4876 msedge.exe 80 PID 4876 wrote to memory of 2820 4876 msedge.exe 80 PID 4876 wrote to memory of 2820 4876 msedge.exe 80 PID 4876 wrote to memory of 2820 4876 msedge.exe 80 PID 4876 wrote to memory of 2820 4876 msedge.exe 80 PID 4876 wrote to memory of 2820 4876 msedge.exe 80 PID 4876 wrote to memory of 2820 4876 msedge.exe 80 PID 4876 wrote to memory of 2820 4876 msedge.exe 80 PID 4876 wrote to memory of 2820 4876 msedge.exe 80 PID 4876 wrote to memory of 2820 4876 msedge.exe 80 PID 4876 wrote to memory of 2820 4876 msedge.exe 80 PID 4876 wrote to memory of 2820 4876 msedge.exe 80 PID 4876 wrote to memory of 2820 4876 msedge.exe 80 PID 4876 wrote to memory of 2820 4876 msedge.exe 80 PID 4876 wrote to memory of 2820 4876 msedge.exe 80 PID 4876 wrote to memory of 2820 4876 msedge.exe 80 PID 4876 wrote to memory of 2820 4876 msedge.exe 80 PID 4876 wrote to memory of 2820 4876 msedge.exe 80 PID 4876 wrote to memory of 2820 4876 msedge.exe 80
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff431b3cb8,0x7fff431b3cc8,0x7fff431b3cd82⤵PID:2736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,13004909929928081046,12376165729910405709,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1944 /prefetch:22⤵PID:5016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1932,13004909929928081046,12376165729910405709,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1932,13004909929928081046,12376165729910405709,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:82⤵PID:2820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,13004909929928081046,12376165729910405709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:1528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,13004909929928081046,12376165729910405709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1932,13004909929928081046,12376165729910405709,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1932,13004909929928081046,12376165729910405709,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,13004909929928081046,12376165729910405709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:12⤵PID:5020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,13004909929928081046,12376165729910405709,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:12⤵PID:1616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,13004909929928081046,12376165729910405709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:2104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,13004909929928081046,12376165729910405709,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:12⤵PID:1828
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4640
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1060
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58e1dd984856ef51f4512d3bf2c7aef54
SHA181cb28f2153ec7ae0cbf79c04c1a445efedd125f
SHA25634afac298a256d796d20598df006222ed6900a0dafe0f8507ed3b29bfd2027d7
SHA512d1f8dfc7fdc5d0f185de88a420f2e5b364e77904cab99d2ace154407c4936c510f3c49e27eed4e74dd2fbd850ad129eb585a64127105661d5f8066448e9f201d
-
Filesize
152B
MD5ffa07b9a59daf025c30d00d26391d66f
SHA1382cb374cf0dda03fa67bd55288eeb588b9353da
SHA2567052a8294dd24294974bb11e6f53b7bf36feeb62ce8b5be0c93fbee6bc034afb
SHA51225a29d2a3ba4af0709455a9905a619c9d9375eb4042e959562af8faa087c91afafdb2476599280bbb70960af67d5bd477330f17f7345a7df729aaee997627b3a
-
Filesize
5KB
MD5d2b6771d51782cad48997d93d17d16bf
SHA14229b510e23450a7124dd436a7c2ecf3b768f657
SHA256692987db1a7d50792c1400b6db580eb1f1bceeb91cc17035f464ebbc4cb36c7f
SHA512d2ffc29fe5ead010b92f5fa6e8fc642bd6ba015a23a1c311fd39657390822379c98b7dcb7d9a5d036208ec59ab7d4eb2afc4b6cf381b30b210c70d260f7fd366
-
Filesize
5KB
MD5c02998d079270eec91c772c990469fb6
SHA1fff5269758c86aec5a77ed0f023f984b3599f2b3
SHA256b166e37271c79f898e668497aa0ecbc5a35c13fd0f5b8ab7e5889a2bced77aff
SHA512cab29fbe35f0448f21ae5180380b3179b1416e71c9844be3c278822ffd2e9763fb5c22528acde49235e11c61e2a8f4c0b45b4d834d8be6f3c701c690e3d293e0
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD5b4782fd8bbf92e603a2ee3aa9b565da7
SHA1746114c69affa4a185ee1eb8d51a60a9fcc997aa
SHA256d7d9db54def598a59fb8f92149e4515fb55184f6da6ee6d27dfde95baf7425c1
SHA51240f73a2076afe96a41bba72f7633d351a9ce9a5c3b30227a3ec101917fa5eb5c54e336dd0c9c2f2215a02e6da7f87c38b80aee9a4c9400a50b8db46de1a774e4