Analysis
- max time kernel
145s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 15:21
Static task
static1
Behavioral task
behavioral1
Sample
Electronic-Invoice26223657.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Electronic-Invoice26223657.html
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target Electronic-Invoice26223657.html
- Size 6KB
- Sample240603-srfshaaf7y
- SHA256 cf07add204275ce55263203f02e4bd623391cd55d8c1ed442c9e3493004a0c21
- MD5 c1a9275d8650bb9ba37b4461f811c815
- SHA1 160180a0cea2ac922b48bc7948afc5255d490f94
- SHA512 7c18361efed1199300cbc1e1a15e5eed4c7f11864c8a79825805be596bc9b01011ec3f769e32dc01df0cfcb6fb3ca1eb6cf6ab339460a259cf4f82877e01735d
- SSDEEP 192:FgW/BQGuTfLux5PHa68DBPtnnAabBPtnnAyTmdxurmGo+:FfaTqfPHa7VP2UP2ouj+
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3448 msedge.exe 3448 msedge.exe 1488 msedge.exe 1488 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe 1748 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1488 msedge.exe 1488 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1488 wrote to memory of 3616 1488 msedge.exe 82 PID 1488 wrote to memory of 3616 1488 msedge.exe 82 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 4612 1488 msedge.exe 83 PID 1488 wrote to memory of 3448 1488 msedge.exe 84 PID 1488 wrote to memory of 3448 1488 msedge.exe 84 PID 1488 wrote to memory of 4948 1488 msedge.exe 85 PID 1488 wrote to memory of 4948 1488 msedge.exe 85 PID 1488 wrote to memory of 4948 1488 msedge.exe 85 PID 1488 wrote to memory of 4948 1488 msedge.exe 85 PID 1488 wrote to memory of 4948 1488 msedge.exe 85 PID 1488 wrote to memory of 4948 1488 msedge.exe 85 PID 1488 wrote to memory of 4948 1488 msedge.exe 85 PID 1488 wrote to memory of 4948 1488 msedge.exe 85 PID 1488 wrote to memory of 4948 1488 msedge.exe 85 PID 1488 wrote to memory of 4948 1488 msedge.exe 85 PID 1488 wrote to memory of 4948 1488 msedge.exe 85 PID 1488 wrote to memory of 4948 1488 msedge.exe 85 PID 1488 wrote to memory of 4948 1488 msedge.exe 85 PID 1488 wrote to memory of 4948 1488 msedge.exe 85 PID 1488 wrote to memory of 4948 1488 msedge.exe 85 PID 1488 wrote to memory of 4948 1488 msedge.exe 85 PID 1488 wrote to memory of 4948 1488 msedge.exe 85 PID 1488 wrote to memory of 4948 1488 msedge.exe 85 PID 1488 wrote to memory of 4948 1488 msedge.exe 85 PID 1488 wrote to memory of 4948 1488 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Electronic-Invoice26223657.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc4d6946f8,0x7ffc4d694708,0x7ffc4d6947182⤵PID:3616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,10304644072478264888,17784000027717322435,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:22⤵PID:4612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,10304644072478264888,17784000027717322435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,10304644072478264888,17784000027717322435,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:82⤵PID:4948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,10304644072478264888,17784000027717322435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:12⤵PID:1916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,10304644072478264888,17784000027717322435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:12⤵PID:3780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,10304644072478264888,17784000027717322435,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4932 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1748
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4896
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3052
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
- MD5 56641592f6e69f5f5fb06f2319384490
- SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
- SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
- MD5 612a6c4247ef652299b376221c984213
- SHA1 d306f3b16bde39708aa862aee372345feb559750
- SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 de13262ee6849c87024d06bb5c2519393689e7779ac59f4090c55bf07a107694
- MD5 83e9dcb31def5cd3b256fa30fdef8e90
- SHA1 e0163459b9ac94ab0d050f733b9b5baec593d81a
- SHA512 e51b8bc65d2848061f63b27328de1a435eab8febc825c4210214d9e11ebc598b376707ca6e96b08274c07f1fcaf93233063baa34015c103e32663fc5e194ab4e
- SSDEEP 96:nVkfdY1E0n2wpvWMoiVmdeHk4jUWQyV+VDCziEwb:nVkK5n2GWMXtro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 19f34abbdd9cc62ca5b2995ca4f8f9faf3aa03be330f3a3b4da10777dcbb678d
- MD5 2955eb9dc746ef7a7a48ea20d03ceff0
- SHA1 1dc256fe6c26b166ad8c0dd0447c6875f3cd6bf8
- SHA512 9a966faba2d94de4d5d1e7bf5c250f18653c0fabb4c432c911030c2b601a33f0cb93719043fbab3cfb6b3dd0af3564df24bc1a58b281f08a22db406ac6781b97
- SSDEEP 96:nVkWdY1E0n2wpvWMoiVmdeHk4jUWQyV+VDCAiEwb:nVkF5n2GWMXtrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 e44ecd155a76c44505a7508bdfc19cebb1fcc12f7ce75668f13cd322e9e78785
- MD5 0cdcbc0bd31ba0bf8f04f9d9db3ef167
- SHA1 600e5375cf98672400888bb1afdb323280fe2e49
- SHA512 181ba7c7526c9e4cfb1da8b7633bacfd50ebcdd5979fb7c21f1659d4c4bab9defbeaf91d9e1b494dcb1e8fe65505f596b171d1edd910b706cf3cabd2e8499541
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupuoe2RU5yRVn3z2OMDCRHqj:A9iIxuERzA83h09RZxYRBnaOMWRHqlWy
- MD5 SHA1 SHA512 SSDEEP