0d962a2ff6f576301504f3a730c5fa3cd4a38d53214cae0ace8414fa639957e7

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-06-2024 13:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

218KB
MD5

9e08e104787852d384bc6dbe7e26232b
SHA1

38cceca935b0f6183518b3381b0f4ddbabac5360
SHA256

608d11ff0003d7aad1be763ee3278137cc93f8f5dde96ff922de1e0297a284f8
SHA512

0376bcb0792e80461eba387e844b7964c5e7f4c844e5eac07968684317f7531cf7626d70cf4c055fdf4843e410a385996959e764b77ba565a80a35e76c4dd3c7
SSDEEP

3072:SX3bKndSLjwi/yfkMY+BES09JXAnyrZalI+YQ:SX3bKnsLciKsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3416	msedge.exe
3416	msedge.exe
4032	msedge.exe
4032	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4032	msedge.exe
4032	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 4824	4032	msedge.exe	80
PID 4032 wrote to memory of 4824	4032	msedge.exe	80
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 2432	4032	msedge.exe	81
PID 4032 wrote to memory of 3416	4032	msedge.exe	82
PID 4032 wrote to memory of 3416	4032	msedge.exe	82
PID 4032 wrote to memory of 636	4032	msedge.exe	83
PID 4032 wrote to memory of 636	4032	msedge.exe	83
PID 4032 wrote to memory of 636	4032	msedge.exe	83
PID 4032 wrote to memory of 636	4032	msedge.exe	83
PID 4032 wrote to memory of 636	4032	msedge.exe	83
PID 4032 wrote to memory of 636	4032	msedge.exe	83
PID 4032 wrote to memory of 636	4032	msedge.exe	83
PID 4032 wrote to memory of 636	4032	msedge.exe	83
PID 4032 wrote to memory of 636	4032	msedge.exe	83
PID 4032 wrote to memory of 636	4032	msedge.exe	83
PID 4032 wrote to memory of 636	4032	msedge.exe	83
PID 4032 wrote to memory of 636	4032	msedge.exe	83
PID 4032 wrote to memory of 636	4032	msedge.exe	83
PID 4032 wrote to memory of 636	4032	msedge.exe	83
PID 4032 wrote to memory of 636	4032	msedge.exe	83
PID 4032 wrote to memory of 636	4032	msedge.exe	83
PID 4032 wrote to memory of 636	4032	msedge.exe	83
PID 4032 wrote to memory of 636	4032	msedge.exe	83
PID 4032 wrote to memory of 636	4032	msedge.exe	83
PID 4032 wrote to memory of 636	4032	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff936df46f8,0x7ff936df4708,0x7ff936df4718
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,13366315711622269965,17137406362485384664,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,13366315711622269965,17137406362485384664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,13366315711622269965,17137406362485384664,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13366315711622269965,17137406362485384664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13366315711622269965,17137406362485384664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,13366315711622269965,17137406362485384664,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\03c807f3-4054-4a1c-adb3-51cbad3a8fd4.tmp

Filesize
10KB

MD5
ccfa12715f06992bc04fa88f30fc01c2

SHA1
ab06ce761737821f552c0b4c1b254002b3f82bdc

SHA256
3a1d4bb2087f07317910543888b50eb3e450a2755f2ca5656d7eeb89ed1d305f

SHA512
f63f65739a33cd67156f9c81f88631b81bee43df26b09dbe87adaa062c1a2ca9170ab7b52fe6fdbf6dba80a7d5a1be76fe6b6f9e15bfbb0e526385f1e16c26d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0b7a89e123757852af05331bd4712e67

SHA1
c04b8829d093c91da005293410691fb0695f59de

SHA256
09b8834ef45765a1880bfa1ccd30a7d4b66bf7e2e85e6a06e2ab5a9ef156aa43

SHA512
9f82b33ba92139481dca03c0530e77b3d3a244bbf60f32ea8eb9d7357d3213da01ac0e46912ed5305eccd8770571e0e53c74a1be2d2010ee0cae3468ab223e88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
de8255c31b6d1f5547e9fca91cd66405

SHA1
bdfcabefaa3f838be5eb27c3c8df9afa0f39f2b5

SHA256
269b589ef42ec09db333db68da9374e786d49f5022a98bf1e7865b13bcc0577c

SHA512
1ecd5bd8a888648a79ce6d02bf7bac737cafe5ade86fb7fc4cadb3d2e0c88b70dd5150e023ec534064e25e163e7f54199bf06eebce19180bbcc348328f22c34e

Download Submit