6a5dc8737ec31955aff66e9bc3907a81f0316cc0822036dc4ed95bc3e582c9e4

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 10:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

220KB
MD5

b7478962f9afda655be7ad0b73cf9a44
SHA1

04cc85e242a9017c169a0aaa74b0e9a33e88efb1
SHA256

e6ae4964c7ea9d89e4bcec313d314d7385c75fdea482859fbff5c4860c568dc7
SHA512

2161d67a511ce091ac9a14e6b000f7784749412f12448a565b66239bdf99e89b742b12a2648a34bf9704e51712d0fca188e26a71fefe4087f5551725c8049019
SSDEEP

3072:SCe7GOZrlna+qyfkMY+BES09JXAnyrZalI+YQ:SCqBwAsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
4680	msedge.exe
4680	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 528	4680	msedge.exe	81
PID 4680 wrote to memory of 528	4680	msedge.exe	81
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 332	4680	msedge.exe	82
PID 4680 wrote to memory of 5100	4680	msedge.exe	83
PID 4680 wrote to memory of 5100	4680	msedge.exe	83
PID 4680 wrote to memory of 1416	4680	msedge.exe	84
PID 4680 wrote to memory of 1416	4680	msedge.exe	84
PID 4680 wrote to memory of 1416	4680	msedge.exe	84
PID 4680 wrote to memory of 1416	4680	msedge.exe	84
PID 4680 wrote to memory of 1416	4680	msedge.exe	84
PID 4680 wrote to memory of 1416	4680	msedge.exe	84
PID 4680 wrote to memory of 1416	4680	msedge.exe	84
PID 4680 wrote to memory of 1416	4680	msedge.exe	84
PID 4680 wrote to memory of 1416	4680	msedge.exe	84
PID 4680 wrote to memory of 1416	4680	msedge.exe	84
PID 4680 wrote to memory of 1416	4680	msedge.exe	84
PID 4680 wrote to memory of 1416	4680	msedge.exe	84
PID 4680 wrote to memory of 1416	4680	msedge.exe	84
PID 4680 wrote to memory of 1416	4680	msedge.exe	84
PID 4680 wrote to memory of 1416	4680	msedge.exe	84
PID 4680 wrote to memory of 1416	4680	msedge.exe	84
PID 4680 wrote to memory of 1416	4680	msedge.exe	84
PID 4680 wrote to memory of 1416	4680	msedge.exe	84
PID 4680 wrote to memory of 1416	4680	msedge.exe	84
PID 4680 wrote to memory of 1416	4680	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5cae46f8,0x7ffa5cae4708,0x7ffa5cae4718
  2⤵
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,5472478958011558654,4947934224357944099,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,5472478958011558654,4947934224357944099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,5472478958011558654,4947934224357944099,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5472478958011558654,4947934224357944099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5472478958011558654,4947934224357944099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,5472478958011558654,4947934224357944099,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3708 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\45ca05fd-e0a8-4cdc-ab90-9b476f561126.tmp

Filesize
11KB

MD5
87a27cbdf5377861ccd2b192e2c2660c

SHA1
2bee5736c09e138df96584e5bb60b3ac3fd6f562

SHA256
f2799fc220da8d6cf7d6e1bb57f7189bccebf541604f0017fa924266de710e3f

SHA512
5c20564fc31112db8b576e10b1da1044bf57d1c3591a8df46ff2785f8c2545802e504870b2bec1010686e0a59b759c090953ac8f5ef71d1c111740e7cbd356d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dabfafd78687947a9de64dd5b776d25f

SHA1
16084c74980dbad713f9d332091985808b436dea

SHA256
c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

SHA512
dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c39b3aa574c0c938c80eb263bb450311

SHA1
f4d11275b63f4f906be7a55ec6ca050c62c18c88

SHA256
66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

SHA512
eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
02e8cc95170181b8a663ff20f618ded3

SHA1
d701a1e1983edd5a8a6628d3fdb42a9c19a875e0

SHA256
8fe1e03bda5d938476a91eea3f025b8eb9689f2d87f2343dcd410ebdedb57741

SHA512
cdbcdc71a85d952be3683b67174c248632da4d80d99fdd202da550aa043c871ff8dfbcf5152f4780cffbc319603a3f9bd3283e729b922d92c18ec12597927de7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0d1ee36696acabbf64bdce3086f0471c

SHA1
82ec4390ca04be4ee5a3813aca673e98c68eb811

SHA256
e2573506c6e3c0f7be2ffdbb806f0edb1721c46c05eae839c62f3464d5de7a52

SHA512
e018f62bb051009c7c94cbfab81815669c7ca72943d71d743341bff52a6c479f3af66ec143d47b4cba77f8ccd1128fa9c690f6226233bf7458c513a40369e7a6

Download Submit