Analysis
-
max time kernel
145s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 10:40
Static task
static1
Behavioral task
behavioral1
Sample
Electronic Invoice_64549934192-2023 PDF.htm
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Electronic Invoice_64549934192-2023 PDF.htm
Resource
win10v2004-20240508-en
General
-
Target
Electronic Invoice_64549934192-2023 PDF.htm
-
Size
5KB
-
MD5
030a74f31dc75d77f0bd6f96b9f1522a
-
SHA1
eefbd35f9f96895dc2d8f5d271b03f64e7ac5a33
-
SHA256
c37eccd1568ef357e15cf7e2fdff2a73ea903302cb82aac441685f75e6ff2985
-
SHA512
2ea60e918ef68b108a7d303fce94db7bf4c718603849108fd0c123d79aff5eb383f83706f1e19c13cc47f94e4c2061049f1c51c5b1c14e54663024c11c0dc39a
-
SSDEEP
96:hOTdXb+xiTb5NLTbpvNsvvR3B5v+mbBR5KJL6w1q99q++t6BVARWMDqxotQ296Ht:gRL+xiBNLxCxXtL5KJL1qPqztaVARWM6
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4244 msedge.exe 4244 msedge.exe 3860 msedge.exe 3860 msedge.exe 2632 identity_helper.exe 2632 identity_helper.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe 3860 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3860 wrote to memory of 4720 3860 msedge.exe 85 PID 3860 wrote to memory of 4720 3860 msedge.exe 85 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 1836 3860 msedge.exe 86 PID 3860 wrote to memory of 4244 3860 msedge.exe 87 PID 3860 wrote to memory of 4244 3860 msedge.exe 87 PID 3860 wrote to memory of 3656 3860 msedge.exe 88 PID 3860 wrote to memory of 3656 3860 msedge.exe 88 PID 3860 wrote to memory of 3656 3860 msedge.exe 88 PID 3860 wrote to memory of 3656 3860 msedge.exe 88 PID 3860 wrote to memory of 3656 3860 msedge.exe 88 PID 3860 wrote to memory of 3656 3860 msedge.exe 88 PID 3860 wrote to memory of 3656 3860 msedge.exe 88 PID 3860 wrote to memory of 3656 3860 msedge.exe 88 PID 3860 wrote to memory of 3656 3860 msedge.exe 88 PID 3860 wrote to memory of 3656 3860 msedge.exe 88 PID 3860 wrote to memory of 3656 3860 msedge.exe 88 PID 3860 wrote to memory of 3656 3860 msedge.exe 88 PID 3860 wrote to memory of 3656 3860 msedge.exe 88 PID 3860 wrote to memory of 3656 3860 msedge.exe 88 PID 3860 wrote to memory of 3656 3860 msedge.exe 88 PID 3860 wrote to memory of 3656 3860 msedge.exe 88 PID 3860 wrote to memory of 3656 3860 msedge.exe 88 PID 3860 wrote to memory of 3656 3860 msedge.exe 88 PID 3860 wrote to memory of 3656 3860 msedge.exe 88 PID 3860 wrote to memory of 3656 3860 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Electronic Invoice_64549934192-2023 PDF.htm1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe902246f8,0x7ffe90224708,0x7ffe902247182⤵PID:4720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,15085760218726427860,5714634111811159799,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:22⤵PID:1836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,15085760218726427860,5714634111811159799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,15085760218726427860,5714634111811159799,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:82⤵PID:3656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15085760218726427860,5714634111811159799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:2912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15085760218726427860,5714634111811159799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:2588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,15085760218726427860,5714634111811159799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:82⤵PID:1184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,15085760218726427860,5714634111811159799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15085760218726427860,5714634111811159799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:12⤵PID:4784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15085760218726427860,5714634111811159799,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:12⤵PID:2052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15085760218726427860,5714634111811159799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:12⤵PID:1560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15085760218726427860,5714634111811159799,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:12⤵PID:1128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,15085760218726427860,5714634111811159799,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1856 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1112
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4976
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3672
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
Filesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
Filesize
179B
MD5ee0428062819862b5fdadb3a8b8360c3
SHA1db9b16bb02e8eead99568de64482e70b2a740471
SHA2560581cf20f0bc57f343565d682e28b733c51530ea705ce9f431312ec89c2f3274
SHA512ac57e6e9c4c64c59efd7056cf01b51c976c9ec01b906ee296a42231737625ee05b7a4729cf2861e8218d9214e68b6f31bc8802a383fe56bc3c0270dd885395d1
-
Filesize
5KB
MD5aa35c222156e0a37a8fe18c1a3171f99
SHA1b40a9222bbbfdddb0826ff05ced065f71348114d
SHA256af7963cc2f8302b7edfe91a4ad3578d7eb9bc00f278b7452cddf22bb58b10316
SHA5122fde70c721b16cafd6405b6cae000c8e7709990baf3e2c37eb6e1a69f8927f98fa16060f0a86fb7f18b84b14890accf6400b6f5d899ffe28ea0ec4c83b81fe69
-
Filesize
6KB
MD58d4d37bae1793ddbe443d0fa7a6983fd
SHA1eae4ac4723a0b41e466efee22136709ae1d36677
SHA256fd891b9e6b4285625d233350d78776cb9c325c4cfbe5cb2471dfb4e150d63df4
SHA512e951edd70d8072568e3c2001453392584591c8f7cc77ad96c1963f3303ba1f8e6160ec1139b9190a9b5abf4e80e468fcacfffe39caf28f68cd386ff71d101096
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5cfa198e4de6d7220a4e752ca27e21de0
SHA14a4be55e3bb9f91435f5b772b2acf262dfb72a3d
SHA256a90789374cf670d860a3686c3245c7d50f9d081af94ac8e9548bc927eed687ba
SHA512fab313b0c3d43b6924aa088a5ec0e144a074083495f73ddd90d2c9ed81b72e9dbecebc4efaae99a78f99f72dfd648e0ea37e2864a68ce193a62bdb5dae20d3f9