Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 04:04
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target sample.html
- Size 220KB
- Sample240613-em99natdpd
- SHA256 d275371e3f8b98a55947676ed2bc04df18892640e54f9a6009358ddcf56e4366
- MD5 29ef9b4c0fea12c5708ffb7bb46c7ae3
- SHA1 c41a7a3760e09ea741edf692de0f6a854e40109c
- SHA512 a7b27ec1161e8ab3b6fe826227cac0a8295323497eef85db59036654a7ba44b3693cbc3c03354744b3684c497602b5a0404960a74bb6cdbb35dd94c54f5769dc
- SSDEEP 3072:SD1owh33kkD4/8kyfkMY+BES09JXAnyrZalI+YQ:SDVnk9GsMYod+X3oI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3188 msedge.exe 3188 msedge.exe 3368 msedge.exe 3368 msedge.exe 4948 msedge.exe 4948 msedge.exe 4948 msedge.exe 4948 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3368 msedge.exe 3368 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe 3368 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3368 wrote to memory of 2516 3368 msedge.exe 82 PID 3368 wrote to memory of 2516 3368 msedge.exe 82 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 4372 3368 msedge.exe 83 PID 3368 wrote to memory of 3188 3368 msedge.exe 84 PID 3368 wrote to memory of 3188 3368 msedge.exe 84 PID 3368 wrote to memory of 4436 3368 msedge.exe 85 PID 3368 wrote to memory of 4436 3368 msedge.exe 85 PID 3368 wrote to memory of 4436 3368 msedge.exe 85 PID 3368 wrote to memory of 4436 3368 msedge.exe 85 PID 3368 wrote to memory of 4436 3368 msedge.exe 85 PID 3368 wrote to memory of 4436 3368 msedge.exe 85 PID 3368 wrote to memory of 4436 3368 msedge.exe 85 PID 3368 wrote to memory of 4436 3368 msedge.exe 85 PID 3368 wrote to memory of 4436 3368 msedge.exe 85 PID 3368 wrote to memory of 4436 3368 msedge.exe 85 PID 3368 wrote to memory of 4436 3368 msedge.exe 85 PID 3368 wrote to memory of 4436 3368 msedge.exe 85 PID 3368 wrote to memory of 4436 3368 msedge.exe 85 PID 3368 wrote to memory of 4436 3368 msedge.exe 85 PID 3368 wrote to memory of 4436 3368 msedge.exe 85 PID 3368 wrote to memory of 4436 3368 msedge.exe 85 PID 3368 wrote to memory of 4436 3368 msedge.exe 85 PID 3368 wrote to memory of 4436 3368 msedge.exe 85 PID 3368 wrote to memory of 4436 3368 msedge.exe 85 PID 3368 wrote to memory of 4436 3368 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbcf1b46f8,0x7ffbcf1b4708,0x7ffbcf1b47182⤵PID:2516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,17079205785744575995,14940462368188045151,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:22⤵PID:4372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,17079205785744575995,14940462368188045151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,17079205785744575995,14940462368188045151,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:82⤵PID:4436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17079205785744575995,14940462368188045151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:2432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,17079205785744575995,14940462368188045151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:12⤵PID:2980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,17079205785744575995,14940462368188045151,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5784 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4948
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3840
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4100
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
- MD5 477462b6ad8eaaf8d38f5e3a4daf17b0
- SHA1 86174e670c44767c08a39cc2a53c09c318326201
- SHA512 a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
- MD5 b704c9ca0493bd4548ac9c69dc4a4f27
- SHA1 a3e5e54e630dabe55ca18a798d9f5681e0620ba7
- SHA512 69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 95768b8afa912abdf6da3f26e4e8dcf9b57997b2062c6f5b9d724e9d2e0e740a
- MD5 21c6a57353633d4ffaa6258c3074932b
- SHA1 c6074e137eef90509ae2263c30864c4ddd3568cf
- SHA512 4618c23f867be753240a1b0170a5f225d6fb4dd7356eacb17a4b3ba5f181224b8eeae79b91ad0a6e2fc1cb8494093ddc5eaf4187651a154ae4317536da970fcf
- SSDEEP 96:nhkVoxm/DnmqK+1YuwpvWMoiVmdeH2Wf4JUWQyV+VDCAiEwb:nhkf6CSuGWMXoJrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 1bae53f7577ae0c715f361a74518f1f4fe3f5ca9ba459520ab44a6ee35dae462
- MD5 28f37cdf9e4274a70a9fbaa869ac9b5c
- SHA1 83cdad8d6a15800c147fa6b686c89e6b320fc4d0
- SHA512 1e04e39dc0d89c051a8fce4d53fff16162ce26b1b8af1df975e20f7387c311877da7e8f307de54070d9d180918f7ccb1bedc0a69047de22693c182aab4659bbf
- SSDEEP 96:nhkVoxm/DQYmqK+1YjwpvWMoiVmdeH2Wf4JUWQyV+VDCziEwb:nhkfICSjGWMXoJro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 bc2e4d7a6d35d6413a89547fa6b0f693e2e78a9e5a874533d358bce4dab028bd
- MD5 0f8059f809b982867cc0eb1080d83a1c
- SHA1 b014fb38062c0b50c6a9b5680320b9684ec2390b
- SHA512 d7a94394aaa3216f23855d037656229f239e437a6a9968150fa50f6e05aae9e9f473d7abab465787bf1a8e2d784a8f0198677e91bafa7e681cd35cc4c07f558d
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup5Hfne2RUC9Q/83z2OMDCRb:A9iIxuERzA83h09RZxY1XT88aOMWRHqI
- MD5 SHA1 SHA512 SSDEEP