Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 00:03
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target sample.html
- Size 213KB
- Sample240613-ab9frswemc
- SHA256 ea5c33d8caddcf04f65d56468019ca00e610e3f1f6eecbfd65f960e01f3a5f83
- MD5 38c7aed2d1d9acf5957a75a106691072
- SHA1 e8aa1d757de74ecae4a3fa105bd0a1b8e6244360
- SHA512 91304bbc4f90f74f397d04d98affb90303a0902964aaa91e95aeec0bee4e61bf5efd93155a7292fb447244d115c53a2ceb439798e22c9c2469830bb8aa7adee2
- SSDEEP 3072:SoxSJYDsv8aZQeyfkMY+BES09JXAnyrZalI+YQ:Soxa307sMYod+X3oI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1692 msedge.exe 1692 msedge.exe 2448 msedge.exe 2448 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe 1928 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2448 msedge.exe 2448 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2448 wrote to memory of 4320 2448 msedge.exe 81 PID 2448 wrote to memory of 4320 2448 msedge.exe 81 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 2492 2448 msedge.exe 82 PID 2448 wrote to memory of 1692 2448 msedge.exe 83 PID 2448 wrote to memory of 1692 2448 msedge.exe 83 PID 2448 wrote to memory of 3892 2448 msedge.exe 84 PID 2448 wrote to memory of 3892 2448 msedge.exe 84 PID 2448 wrote to memory of 3892 2448 msedge.exe 84 PID 2448 wrote to memory of 3892 2448 msedge.exe 84 PID 2448 wrote to memory of 3892 2448 msedge.exe 84 PID 2448 wrote to memory of 3892 2448 msedge.exe 84 PID 2448 wrote to memory of 3892 2448 msedge.exe 84 PID 2448 wrote to memory of 3892 2448 msedge.exe 84 PID 2448 wrote to memory of 3892 2448 msedge.exe 84 PID 2448 wrote to memory of 3892 2448 msedge.exe 84 PID 2448 wrote to memory of 3892 2448 msedge.exe 84 PID 2448 wrote to memory of 3892 2448 msedge.exe 84 PID 2448 wrote to memory of 3892 2448 msedge.exe 84 PID 2448 wrote to memory of 3892 2448 msedge.exe 84 PID 2448 wrote to memory of 3892 2448 msedge.exe 84 PID 2448 wrote to memory of 3892 2448 msedge.exe 84 PID 2448 wrote to memory of 3892 2448 msedge.exe 84 PID 2448 wrote to memory of 3892 2448 msedge.exe 84 PID 2448 wrote to memory of 3892 2448 msedge.exe 84 PID 2448 wrote to memory of 3892 2448 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb80846f8,0x7ffdb8084708,0x7ffdb80847182⤵PID:4320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,14987088917405790036,17740564002877477009,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:22⤵PID:2492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,14987088917405790036,17740564002877477009,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,14987088917405790036,17740564002877477009,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:82⤵PID:3892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14987088917405790036,17740564002877477009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:32
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14987088917405790036,17740564002877477009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,14987088917405790036,17740564002877477009,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4444 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1928
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4020
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2352
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e
- MD5 db9081c34e133c32d02f593df88f047a
- SHA1 a0da007c14fd0591091924edc44bee90456700c6
- SHA512 12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f
- MD5 3a09f853479af373691d131247040276
- SHA1 1b6f098e04da87e9cf2d3284943ec2144f36ac04
- SHA512 341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 616eca878a24c2532bec52dcb62bec740de3f8f47210c47017b8f18456a2b0bf
- MD5 7176f2223b582e18a93cddb62ef31891
- SHA1 4e51ad900aeb5a80deffdaa8fa402b6b0c4b2238
- SHA512 357cc2383ab8f7f344a2ff9da853ac611429c6308b9ae649a6c549471db476c4c1377162606ae4a9bfb797b5798dc04e3e47b5882b4427df9d70092fd3ba9e58
- SSDEEP 96:n/kVoxm/DQYmqnw1qW/wpvWMoiVmdeHgiJ2UWQyV+VDCziEwb:n/kfI8wQYGWMXJ2ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 93011cfe814ba7c648380b271613844d4379dbb38b9355dd3c51a9315b200e28
- MD5 6cfae4f5eb55ad8eb6a8e2c9471bae93
- SHA1 53daf7748ace16fc4b8464cc377a738255fb1b21
- SHA512 54259ad2a24da9df2cae3710639ae6cab3b63b0daeff09c686903ea00d645fda82c824ac68dac71ba4fc61fed63a879a274b559e0a220f546652b6b771daeb2e
- SSDEEP 96:n/kVoxm/Dnmqnw1q9/wpvWMoiVmdeHgiJ2UWQyV+VDCAiEwb:n/kf68wQ5GWMXJ2rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 afbb600e9b08b59f44dd9383ce8293d56002b9095a144096d2bab8f7529706fd
- MD5 2ccdc385b3f456999ef2174d07366a9f
- SHA1 a45797826abd9ddf877da0b7f6d9412b5d541aa6
- SHA512 8b547aef15c18652ddd912e1507e3f12f9cfae40fef6197df211fffd07d362840c953007b9e828d2d99396d23f37910d5720d9101a2bbb44ee824a4bd9c49906
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup59Ae2RUCAu2ke3z2OMDCRc:A9iIxuERzA83h09RZxY3ewueaOMWRHqn
- MD5 SHA1 SHA512 SSDEEP