5f4a8ff823f1dd294e69bc858268378e5890354519f58c0b5a68a905da52ea28

Resubmissions

07/06/2024, 16:42

240607-t7pwsabb811

07/06/2024, 16:20

240607-ts598aba2t1

Analysis

max time kernel
108s
max time network
109s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
07/06/2024, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
landing.html
Size 173KB
Sample240607-ts598aba2t
SHA256 5f4a8ff823f1dd294e69bc858268378e5890354519f58c0b5a68a905da52ea28
MD5 3bd801aacaca0c97f41565903c540fcf
SHA1 1d3c01cf9d8315dd8388bdc6c82dee943fd29715
SHA512 a84f9e56874842d894a30ef75c9a9e4ee48a8ca2c3047aea50d28955f3d825733cc6eda7ed53b83085a2c4a418526d2c7e0633bc4e98ca430064a01f5b56f55a
SSDEEP 3072:jOdeXVvk47hl5C2gr5YG0n2YGF7o7h2YGvYGjNn3Z7hVYGa:I4Vvkohl5C2gr5r0n2rF74h2rvrjNn3Y
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe
1976	msedge.exe
1976	msedge.exe
4968	identity_helper.exe
4968	identity_helper.exe
2732	msedge.exe
2732	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 5060	1976	msedge.exe	76
PID 1976 wrote to memory of 5060	1976	msedge.exe	76
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 224	1976	msedge.exe	77
PID 1976 wrote to memory of 4844	1976	msedge.exe	78
PID 1976 wrote to memory of 4844	1976	msedge.exe	78
PID 1976 wrote to memory of 3144	1976	msedge.exe	79
PID 1976 wrote to memory of 3144	1976	msedge.exe	79
PID 1976 wrote to memory of 3144	1976	msedge.exe	79
PID 1976 wrote to memory of 3144	1976	msedge.exe	79
PID 1976 wrote to memory of 3144	1976	msedge.exe	79
PID 1976 wrote to memory of 3144	1976	msedge.exe	79
PID 1976 wrote to memory of 3144	1976	msedge.exe	79
PID 1976 wrote to memory of 3144	1976	msedge.exe	79
PID 1976 wrote to memory of 3144	1976	msedge.exe	79
PID 1976 wrote to memory of 3144	1976	msedge.exe	79
PID 1976 wrote to memory of 3144	1976	msedge.exe	79
PID 1976 wrote to memory of 3144	1976	msedge.exe	79
PID 1976 wrote to memory of 3144	1976	msedge.exe	79
PID 1976 wrote to memory of 3144	1976	msedge.exe	79
PID 1976 wrote to memory of 3144	1976	msedge.exe	79
PID 1976 wrote to memory of 3144	1976	msedge.exe	79
PID 1976 wrote to memory of 3144	1976	msedge.exe	79
PID 1976 wrote to memory of 3144	1976	msedge.exe	79
PID 1976 wrote to memory of 3144	1976	msedge.exe	79
PID 1976 wrote to memory of 3144	1976	msedge.exe	79

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\landing.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb1bf53cb8,0x7ffb1bf53cc8,0x7ffb1bf53cd8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,1883305071264475346,9721462583651932702,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,1883305071264475346,9721462583651932702,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,1883305071264475346,9721462583651932702,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1883305071264475346,9721462583651932702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1883305071264475346,9721462583651932702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,1883305071264475346,9721462583651932702,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,1883305071264475346,9721462583651932702,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1883305071264475346,9721462583651932702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1883305071264475346,9721462583651932702,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1883305071264475346,9721462583651932702,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,1883305071264475346,9721462583651932702,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:3860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3e6c56356d6509a3fd4b2403555be55e251f4a962379b29735c1203e57230947
MD5 390187670cb1e0eb022f4f7735263e82
SHA1 ea1401ccf6bf54e688a0dc9e6946eae7353b26f1
SHA512 602f64d74096d4fb7a23b23374603246d42b17cc854835e3b2f4d464997b73f289a3b40eb690e3ee707829d4ff886865e982f72155d96be6bc00166f44878062
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 92a96c9309023c8b9e1396ff41f7d9d3ff8a3687972e76b9ebd70b04e3bf223a
MD5 8294f1821fd3419c0a42b389d19ecfc6
SHA1 cd4982751377c2904a1d3c58e801fa013ea27533
SHA512 372d369f7ad1b0e07200d3aa6b2cfce5beafa7a97f63932d4c9b3b01a0e8b7eb39881867f87ded55a9973abea973b2d2c9b6fc4892f81cec644702b9edb1566d
MD5 SHA1 SHA512

Submit Download

7fa07837-764e-450d-9e5b-b7b4e36cd40a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7fa07837-764e-450d-9e5b-b7b4e36cd40a.tmp
Size 5KB
SHA256 a094a79356425ee9985a3a249b259870a0509e805e8ad124e2a096a6ee165d19
MD5 f38e1f003241770016538a36326a520b
SHA1 a40d3e153ac16ffdc57fb19ec28d20970bb3df01
SHA512 7189fbe70e405c2d78618323bdd662af22c822cd8a1091982d90dc6f8ecd5c214bad04988cfa1b84ceddeec8ec60641ace84dac8749fec14561838c5ecca16bf
SSDEEP 96:nqk334UkcwSv0MoiVmdHITJk/80WQyV+VpAiX3wI3:nqk3oUkcv0MAI9O8Le93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 274B
SHA256 e55aa0c02b7c0b56bb26de85dc7a5122cbf29d48976bfb699cc107da1d6cb656
MD5 8920195a2330c0575ad7a17b7e4ad474
SHA1 7a7b4e0abe427638f335285cf166b6acfe4b6be3
SHA512 3b6a5de772486ac7e4247002a1cd768fa7f3d3b81201efebb83157f1c87b95ca31a8ef49185c12724d03c90ee9d0e62c62ce97543f03d907a524325c6a386d48
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 5f3a7172c4630dc63c24972910fe720392d3d776f0136ef2d8341fab721a1a64
MD5 68fcba30eab2d449ae264730456de957
SHA1 ba74fb3878b9b4a57b788eb6d736c58a0153eb8a
SHA512 5d319c541930b680441fcff506e188c6acdc370f263da1d30447f546e300fafffb4aaec2bd1b49cd8c9b71752f76ffb04c44405b2322a1c0d4e4c1b8e570326b
SSDEEP 96:nqk3nS4UkcwSv0MoiVmdHITJk/80WQyV+VuziX3wI3:nqk3tUkcv0MAI9O8LM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 f26e67566a85ca85978b0ca56b01330e6ca44c4556fb4b38b1c8a6282467c0d0
MD5 9cdee8721017c3ee7f3b1f9880ee8250
SHA1 5565739f3b64c8e3b22e8637280b74e9caeea0cf
SHA512 28ec6ef18e553daf64bc82ac326f1d0ebdae092be91b0c2b38be00738caaf942ee397d4144d224f62dc254e496da7aa0bd9487a5d2faade81069f23b8e508236
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG3Odte2RU8J/R2sq7YvmljEW3:M9iIxuERzA83h09RZxASGKRJtq7Yk9rH
MD5 SHA1 SHA512 SSDEEP

Submit Download