Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 23:19
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240611-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target sample.html
- Size 220KB
- Sample240612-3ay8mavcqa
- SHA256 6af0553710c9979012fe8f843edf6df6ea20b31679ff1ad98fbed1a5012a4823
- MD5 c914404724bd50d2dce63b36884e4a98
- SHA1 f3c113b427b56a3cf8fc1f28146d5f8194fdee70
- SHA512 f2f4b823b708c5a8ac51f8e8d02e547074e76398bd2f3f7ed99d0ffb6a885cecd4884ee11d623311cad2fabe5242334aa0856557d268ed426917de5498d7f746
- SSDEEP 3072:Splk8MYpCBj1iyfkMY+BES09JXAnyrZalI+YQ:Sps1jJsMYod+X3oI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1216 msedge.exe 1216 msedge.exe 4628 msedge.exe 4628 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe 1512 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4628 msedge.exe 4628 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe 4628 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4628 wrote to memory of 2368 4628 msedge.exe 81 PID 4628 wrote to memory of 2368 4628 msedge.exe 81 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 3120 4628 msedge.exe 83 PID 4628 wrote to memory of 1216 4628 msedge.exe 84 PID 4628 wrote to memory of 1216 4628 msedge.exe 84 PID 4628 wrote to memory of 3208 4628 msedge.exe 85 PID 4628 wrote to memory of 3208 4628 msedge.exe 85 PID 4628 wrote to memory of 3208 4628 msedge.exe 85 PID 4628 wrote to memory of 3208 4628 msedge.exe 85 PID 4628 wrote to memory of 3208 4628 msedge.exe 85 PID 4628 wrote to memory of 3208 4628 msedge.exe 85 PID 4628 wrote to memory of 3208 4628 msedge.exe 85 PID 4628 wrote to memory of 3208 4628 msedge.exe 85 PID 4628 wrote to memory of 3208 4628 msedge.exe 85 PID 4628 wrote to memory of 3208 4628 msedge.exe 85 PID 4628 wrote to memory of 3208 4628 msedge.exe 85 PID 4628 wrote to memory of 3208 4628 msedge.exe 85 PID 4628 wrote to memory of 3208 4628 msedge.exe 85 PID 4628 wrote to memory of 3208 4628 msedge.exe 85 PID 4628 wrote to memory of 3208 4628 msedge.exe 85 PID 4628 wrote to memory of 3208 4628 msedge.exe 85 PID 4628 wrote to memory of 3208 4628 msedge.exe 85 PID 4628 wrote to memory of 3208 4628 msedge.exe 85 PID 4628 wrote to memory of 3208 4628 msedge.exe 85 PID 4628 wrote to memory of 3208 4628 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff6fcb46f8,0x7fff6fcb4708,0x7fff6fcb47182⤵PID:2368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,16951685846253827385,18180007957868122878,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:22⤵PID:3120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,16951685846253827385,18180007957868122878,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,16951685846253827385,18180007957868122878,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:82⤵PID:3208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16951685846253827385,18180007957868122878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:3448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16951685846253827385,18180007957868122878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:4164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,16951685846253827385,18180007957868122878,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1512
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5116
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5076
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
- MD5 dabfafd78687947a9de64dd5b776d25f
- SHA1 16084c74980dbad713f9d332091985808b436dea
- SHA512 dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
- MD5 c39b3aa574c0c938c80eb263bb450311
- SHA1 f4d11275b63f4f906be7a55ec6ca050c62c18c88
- SHA512 eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 b862eaa8600d74e76271f56e60208d22ba5612d74de7e8d24056124df1d1fb93
- MD5 e19b0541a582b86f2c0f3d5fd20739b6
- SHA1 df7705080bc0fbddb293945acfd90a7441fc2c0f
- SHA512 81ad5643af6c6f046155606f945197b3565513b3a248380b96b52700629145760d2e146309372282a57081550e6ed7d94f7c425cc393d54c33e4afed339aaf90
- SSDEEP 96:nbk/tM1ezmwpvWMoiVmdeH1DY+UWQyV+VDCAiEwb:nbky4zmGWMXW+rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 08afb7bd228c5b12f9ccb2f0daf93af9c9c7e30aa90e98583e5f41c4781f48fb
- MD5 6c1aefb7c92ccdd26b949ccef95f9d23
- SHA1 70d427451c50263894486b2d161c01f9eefe27a4
- SHA512 2140c0cb675a5568437d0e8f532523f689b7aad78c421eab660005d8ebf8a74b8064267c8bf9cbcf72d154e1f8e6a5188e4f26ea92f39ab9da6e92c76689e5fa
- SSDEEP 96:nbk/RM1eCmwpvWMoiVmdeH1DY+UWQyV+VDCziEwb:nbku4CmGWMXW+ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 59e614a05bbaa44741f020c93f5c48ed9a7742aad6eca776c0ba4b6618183be2
- MD5 be1e991f901099bdc794c34e5a143f12
- SHA1 0eb762f5d739c7f6c808dd119aa06433797f90e5
- SHA512 d8ae71b846d682a662bf18eeae34bd0f7cce4f69227ed9919804aef536ad9421ee06caddf151f935fbbeded4a7487a587c5a4e95b34b764dc54aa269a903649f
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup5hBe2RUehSRse3z2OMDCRc:A9iIxuERzA83h09RZxYPV1gGeaOMWRH8
- MD5 SHA1 SHA512 SSDEEP