Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 15:42
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target sample.html
- Size 218KB
- Sample240603-s5e35acd55
- SHA256 201085b3cb11beaa8e5acd8047682f939b8366b8cb290fe48e38d0b3e2283837
- MD5 5e9351d226e1d1145531a885409daca9
- SHA1 67590b4e7ca78ff7222289bf8daee9b43c27b65c
- SHA512 3be00b5b64f521dd3ac7a0a80a3a2070b07b4f4e64122f23d59570136c4eb97483a8d68af2422b17c70f89e8089c334a5cae619b3914ef26ea48adec2418a4c5
- SSDEEP 3072:SJ6c/nqbNMaKyfkMY+BES09JXAnyrZalI+YQ:SMc/qbHvsMYod+X3oI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 5028 msedge.exe 5028 msedge.exe 3032 msedge.exe 3032 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe 896 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3032 msedge.exe 3032 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3032 wrote to memory of 4372 3032 msedge.exe 82 PID 3032 wrote to memory of 4372 3032 msedge.exe 82 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 668 3032 msedge.exe 83 PID 3032 wrote to memory of 5028 3032 msedge.exe 84 PID 3032 wrote to memory of 5028 3032 msedge.exe 84 PID 3032 wrote to memory of 684 3032 msedge.exe 85 PID 3032 wrote to memory of 684 3032 msedge.exe 85 PID 3032 wrote to memory of 684 3032 msedge.exe 85 PID 3032 wrote to memory of 684 3032 msedge.exe 85 PID 3032 wrote to memory of 684 3032 msedge.exe 85 PID 3032 wrote to memory of 684 3032 msedge.exe 85 PID 3032 wrote to memory of 684 3032 msedge.exe 85 PID 3032 wrote to memory of 684 3032 msedge.exe 85 PID 3032 wrote to memory of 684 3032 msedge.exe 85 PID 3032 wrote to memory of 684 3032 msedge.exe 85 PID 3032 wrote to memory of 684 3032 msedge.exe 85 PID 3032 wrote to memory of 684 3032 msedge.exe 85 PID 3032 wrote to memory of 684 3032 msedge.exe 85 PID 3032 wrote to memory of 684 3032 msedge.exe 85 PID 3032 wrote to memory of 684 3032 msedge.exe 85 PID 3032 wrote to memory of 684 3032 msedge.exe 85 PID 3032 wrote to memory of 684 3032 msedge.exe 85 PID 3032 wrote to memory of 684 3032 msedge.exe 85 PID 3032 wrote to memory of 684 3032 msedge.exe 85 PID 3032 wrote to memory of 684 3032 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc074f46f8,0x7ffc074f4708,0x7ffc074f47182⤵PID:4372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,1481574903808048892,16727065557487214540,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:22⤵PID:668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,1481574903808048892,16727065557487214540,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,1481574903808048892,16727065557487214540,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:82⤵PID:684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1481574903808048892,16727065557487214540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:1984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,1481574903808048892,16727065557487214540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:3468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,1481574903808048892,16727065557487214540,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2628 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:896
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2124
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2916
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
- MD5 a8e767fd33edd97d306efb6905f93252
- SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
- SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
- MD5 439b5e04ca18c7fb02cf406e6eb24167
- SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
- SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 cacec6bfa632f2048164dff2f497faad3504a165d86a8bb718fea955546ae105
- MD5 0d5a60c90d375dc8182b8440cc2009a5
- SHA1 0c351eed72d687fb610e1b354a1245b352396175
- SHA512 3c78cbae763c87149e301212e2e8d53b6ab403220a7002cddebabe0f8978dc90b99a1cfba594a88808119af73f86c16a5a56e7bb67b172bc67f1f28b57345e14
- SSDEEP 96:nkkRb91KBwpvWMoiVmdeHBrzgUWQyV+VDCziEwb:nkkvMBGWMXqro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 d35c382034f51bbf00a6ebdcd4c8abfededf1b0fe9511f1796ff1e60f0487011
- MD5 373317817a15a9bd619d87f74e15516c
- SHA1 f470bae20f23bf2a0bbee8758c224e5d994c029a
- SHA512 697d6a9b6e805b6f10fa98b7bd7b1c4467225293e16d7540dd273923cdafa55bf28f720fe78b25611648c4e31578858660d39290c02b34fddeaea53a32dc248f
- SSDEEP 96:nkk8b91KMwpvWMoiVmdeHBrzgUWQyV+VDCAiEwb:nkkwMMGWMXqrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 d4254c382ec5be5c1139622fcd0b41a15bd2b0fcd2c782f35ac31a03b6ba9e71
- MD5 fc93caff58a99e9788cd72f95d487183
- SHA1 ed5bb97513e769cf51682099bcb5f4c4808b18ae
- SHA512 7eecc40280769dd368ba3ff0fd49a45edb3dd1ba8144fdcb8ab6666928a5d704536c837af61360e23dc1a47c30407cf6efe9fab65cd066f1f0e1923115d9b577
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup6HYe2RUSoMj2z3z2OMDCR3:A9iIxuERzA83h09RZxY6HW7zyzaOMWR3
- MD5 SHA1 SHA512 SSDEEP