Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09-06-2024 02:24
Static task
static1
Behavioral task
behavioral1
Sample
XyB1Uc.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
XyB1Uc.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
XyB1Uc.html
Resource
macos-20240410-en
General
-
Target
XyB1Uc.html
-
Size
520B
-
MD5
e94599644c40d64c685a60aeca1c6322
-
SHA1
96d56623f3eb9a3c7120e8487871517b58fda426
-
SHA256
d1be270c73073f46b07eef477ca15e81df050aafa15c225bfbe1b8fdaa107026
-
SHA512
1a2b42a0314507b04fc9990c6a336540df560b73050dd8981ee4c7b9d86aed2e1e37c659b33e5b0ac115f0b6b34cc66e74cc074a9a1f638398a3a04ca0230433
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 4352 msedge.exe 4352 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 4952 identity_helper.exe 4952 identity_helper.exe 1300 msedge.exe 1300 msedge.exe 1300 msedge.exe 1300 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3076 wrote to memory of 224 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 224 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 544 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 4352 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 4352 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 2692 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 2692 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 2692 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 2692 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 2692 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 2692 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 2692 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 2692 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 2692 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 2692 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 2692 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 2692 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 2692 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 2692 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 2692 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 2692 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 2692 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 2692 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 2692 3076 msedge.exe msedge.exe PID 3076 wrote to memory of 2692 3076 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\XyB1Uc.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0f1e46f8,0x7ffa0f1e4708,0x7ffa0f1e47182⤵PID:224
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,17773220332883933842,12810353281397882890,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:22⤵PID:544
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,17773220332883933842,12810353281397882890,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4352 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,17773220332883933842,12810353281397882890,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:82⤵PID:2692
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17773220332883933842,12810353281397882890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:3372
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17773220332883933842,12810353281397882890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:4664
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,17773220332883933842,12810353281397882890,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:82⤵PID:628
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,17773220332883933842,12810353281397882890,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4952 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17773220332883933842,12810353281397882890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:12⤵PID:2060
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17773220332883933842,12810353281397882890,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:12⤵PID:400
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17773220332883933842,12810353281397882890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:5032
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17773220332883933842,12810353281397882890,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:12⤵PID:3160
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,17773220332883933842,12810353281397882890,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1300
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3484
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3464
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD556641592f6e69f5f5fb06f2319384490
SHA16a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA25602d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
-
Filesize
152B
MD5612a6c4247ef652299b376221c984213
SHA1d306f3b16bde39708aa862aee372345feb559750
SHA2569d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA51234a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
-
Filesize
6KB
MD5b48c3d1add3c7e07b11479cd24deeed8
SHA1d8688c670c312025877722da7182932795a11f62
SHA256a0e03a7b1a7e7babf0a683fe13e6f7679bc4be49adec5732011c64903131d24f
SHA512ea64df88e287df6f268dfd6ba59be8d9191647af2ccf91d40557e5fffadb1b514808ba187e9a33411decfc08a5cff8f580432a4365218316129cdb8e07c5308a
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f9600ceb-928e-40c2-a404-bd17c6293240.tmp
Filesize5KB
MD5860ee54be0bcff8c58dbad952fbf9abc
SHA1a81279250910037f77ee7ae5a1d70f0adedc4e1b
SHA256b1d2b629c79c127d0def9ca4d30bae4658d2fdd5157f55eeab00833809ae4332
SHA512a07d412506069acb3c410dd5dbc374ea9bc6f420812f477f475e4d4eb5ec7d7ae6cbff2565b8e1e5c73836f4d52ae6cb2b028e7a569636264312790fdea21127
-
Filesize
11KB
MD52747a2bd1b42cea16b837be961638006
SHA179729091bda39c23ad44559604c3f14024d3f3e7
SHA256927b5aed590a5c23393dad5ea1c79fb0a7b6124141baf2796b8a7a8c7458735d
SHA51280d7bc8c317095848fc25f592fba3544c452e25c018601ce29212d2fd659bf3b9aae0d74c51f20ea31d632a65fb1b433e9dd8ed66df9587143eb63b5390cd92b
-
Filesize
10KB
MD5dc90b1141d63bcce733fae386b2ce730
SHA10a42bcf9e3f679cfe2aa92557a41f641e49709dc
SHA25681804e09206e5f4931ba41fbee76c03c9f17ea8e57c3fbf4322114d93fc60818
SHA5129dfbf1d078ec4e6737fe6f7899e9005f9f9dbfca4dcf07adbd399f3157ec25831022a9e62441ed6cf0ced2b2168ebfd7edb8ed7e9a1fbe68eb2fca9ea5fd398d
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e