dc6152f15c81b95a76fa13d14aacb338eb188187dbdc7d9f25b316c8c8a44ecd

Analysis

max time kernel
108s
max time network
110s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
08/06/2024, 20:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

17KB
MD5

bfcd7ce9f28aa63790ae44ae856b9df2
SHA1

1fe4d155a2bddcd2d4d52366a6a6b05e0fb02d8e
SHA256

dc6152f15c81b95a76fa13d14aacb338eb188187dbdc7d9f25b316c8c8a44ecd
SHA512

00d458ad7dd5dd4de0312cabda2d5ef77f07ef2a7ef6c5a0e7584f591904f5e97b7f2d17062411a872e9ea86b6152428b8d79c8d36fd3e35c2eaa12375776698
SSDEEP

384:iW4N81j5WimpQy0nscOrw8jmLfk/CPHf0kKQrLSZuwMAMVMBMtMZMFMnTMjC3Wm3:iKg9JKMh9GmrD

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe
4852	msedge.exe
4852	msedge.exe
2228	identity_helper.exe
2228	identity_helper.exe
4756	msedge.exe
4756	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 2392	4852	msedge.exe	76
PID 4852 wrote to memory of 2392	4852	msedge.exe	76
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1408	4852	msedge.exe	77
PID 4852 wrote to memory of 1400	4852	msedge.exe	78
PID 4852 wrote to memory of 1400	4852	msedge.exe	78
PID 4852 wrote to memory of 5040	4852	msedge.exe	79
PID 4852 wrote to memory of 5040	4852	msedge.exe	79
PID 4852 wrote to memory of 5040	4852	msedge.exe	79
PID 4852 wrote to memory of 5040	4852	msedge.exe	79
PID 4852 wrote to memory of 5040	4852	msedge.exe	79
PID 4852 wrote to memory of 5040	4852	msedge.exe	79
PID 4852 wrote to memory of 5040	4852	msedge.exe	79
PID 4852 wrote to memory of 5040	4852	msedge.exe	79
PID 4852 wrote to memory of 5040	4852	msedge.exe	79
PID 4852 wrote to memory of 5040	4852	msedge.exe	79
PID 4852 wrote to memory of 5040	4852	msedge.exe	79
PID 4852 wrote to memory of 5040	4852	msedge.exe	79
PID 4852 wrote to memory of 5040	4852	msedge.exe	79
PID 4852 wrote to memory of 5040	4852	msedge.exe	79
PID 4852 wrote to memory of 5040	4852	msedge.exe	79
PID 4852 wrote to memory of 5040	4852	msedge.exe	79
PID 4852 wrote to memory of 5040	4852	msedge.exe	79
PID 4852 wrote to memory of 5040	4852	msedge.exe	79
PID 4852 wrote to memory of 5040	4852	msedge.exe	79
PID 4852 wrote to memory of 5040	4852	msedge.exe	79

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe9e363cb8,0x7ffe9e363cc8,0x7ffe9e363cd8
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,8160069007901233264,15822262269795633086,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,8160069007901233264,15822262269795633086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,8160069007901233264,15822262269795633086,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8160069007901233264,15822262269795633086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8160069007901233264,15822262269795633086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,8160069007901233264,15822262269795633086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,8160069007901233264,15822262269795633086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8160069007901233264,15822262269795633086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8160069007901233264,15822262269795633086,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8160069007901233264,15822262269795633086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,8160069007901233264,15822262269795633086,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1e4ed4a50489e7fc6c3ce17686a7cd94

SHA1
eac4e98e46efc880605a23a632e68e2c778613e7

SHA256
fc9e8224722cb738d8b32420c05006de87161e1d28bc729b451759096f436c1a

SHA512
5c4e637ac4da37ba133cb1fba8fa2ff3e24fc4ca15433a94868f2b6e0259705634072e5563da5f7cf1fd783fa8fa0c584c00f319f486565315e87cdea8ed1c28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8ff8bdd04a2da5ef5d4b6a687da23156

SHA1
247873c114f3cc780c3adb0f844fc0bb2b440b6d

SHA256
09b7b20bfec9608a6d737ef3fa03f95dcbeaca0f25953503a321acac82a5e5ae

SHA512
5633ad84b5a003cd151c4c24b67c1e5de965fdb206b433ca759d9c62a4785383507cbd5aca92089f6e0a50a518c6014bf09a0972b4311464aa6a26f76648345e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
00a455d9d155394bfb4b52258c97c5e5

SHA1
2761d0c955353e1982a588a3df78f2744cfaa9df

SHA256
45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

SHA512
9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b9c07424f86e8e000b4f70a50e5d6e0b

SHA1
8a6dd77fe66a7350cce5bab2154c2085441b4e2a

SHA256
57ce2f806230e0273daeba6b69fae93fe04625d2c269dc059fba306559c98134

SHA512
24eb99894455da3a2efc7391e68e55c5a3dcf50fd2b5a34a85e18e06976226610e06d87718f1ecce7b50a407e758608863052f6af09ad7a376b12935cd28190b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
36fbe236121ff30706ff71ff0a84a48d

SHA1
4d9747ec4ba7feeffb8b03cb9f97a8f71bf260d7

SHA256
7898c14fc5ac2a35097a18807174e188c8e7efe75d56b5cb6336842e6230a3ad

SHA512
ddb7444c5c0a64046a339c7fec4c62567c888c858062d2622960d1f0c35765b5e82397774408f55903df60aec4572694d6e87e5a88c8d913dd08f113134482a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
030ed5b776869449eb4614b43294668a

SHA1
074282c90481c0dd0bff549b538cfdc59885b641

SHA256
2a75b64c4543b5cda5246b22a41dfe37e1aafd96f81a0826ab57bfbcd753b979

SHA512
051ade7a0c8efc07ae197530b300535c5408455700cbc82d488f29164cae8bc22dcdc76ccea0ba0711de38c738d13286d2a25a9071b90f724bafbcd81e79d155

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
157deeb5a0d1d7951519b9846fe72197

SHA1
b592fb66ecbe6297518e9cfdd0e7816b9a8a4517

SHA256
5cbddc3c7d62a4b97784a4a836bfc80b5faa7a0b445500e9d38dfa4761de3455

SHA512
cdcbd49aa4bad70c45e78f47b0982ebdea0db0414eee23e3996eb59b024090df5a001431f8a82c181f076f945f0c18db3c505d18b60884c869b4e4d05e6805db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
77714b3c8653b8e08594e4d2246f83e2

SHA1
aaeeef5992fafe345c205c5bfce791175892ff07

SHA256
eaaa1895c116b4b9f63abf135ce3f17ed1d62726f9ea817ce82839d2ab941523

SHA512
9f70acde93383b2ef0bc12037557fc56114512f370d624bee0d1415805dd5800aef1b480cb76a36b32a86f14da29a83adfdae176fdb0c96c68f0670ef59513c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6baa1838a086884065266a92dc2fb71b

SHA1
3810ef3456ef8894f6849f8b9615dee4039fb85f

SHA256
079ff2eb5329007a473dd598d0585cbc1946a3481b998ad061021e23b183b26c

SHA512
d3947b06ee55f21d4565ff171944cadafda672e0b87b7c8b9eb6a1278640c608d8c024e85f7f9b164849604b4f2af1d7419967bc2b80ad5be43fd70abe75892e

Download Submit