a9403acf14bd3a39fc26ced3d3d843edd2c0ef6675d53289236c0f320d260469

Analysis

max time kernel
100s
max time network
102s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
13-06-2024 04:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Hi02D.html
Size

51KB
MD5

2978f60d67edd81f633f3522b6b6dbba
SHA1

8dce45241785599a01db00eae86d61afbb7fffc7
SHA256

a9403acf14bd3a39fc26ced3d3d843edd2c0ef6675d53289236c0f320d260469
SHA512

6aabedf678a750c55b4e95bb660119180f650deae152d5db10797ba432508dc5140fa4fc43f5f0976d9ffcc51d6169e0fafc6db92e646ed37bb66900872a4577
SSDEEP

768:CFlbLLZnOEpW1U+pvnC052larLeRrtg+IzB2GCMM7dd823v5lbMCItS3wQ0o5Sbg:CFyrLujI5LgItS3wQRsb2UDzu+RA

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4276	msedge.exe
4276	msedge.exe
3608	msedge.exe
3608	msedge.exe
4484	msedge.exe
4484	msedge.exe
3532	identity_helper.exe
3532	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe
3608	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 3740	3608	msedge.exe	79
PID 3608 wrote to memory of 3740	3608	msedge.exe	79
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 2840	3608	msedge.exe	80
PID 3608 wrote to memory of 4276	3608	msedge.exe	81
PID 3608 wrote to memory of 4276	3608	msedge.exe	81
PID 3608 wrote to memory of 3004	3608	msedge.exe	82
PID 3608 wrote to memory of 3004	3608	msedge.exe	82
PID 3608 wrote to memory of 3004	3608	msedge.exe	82
PID 3608 wrote to memory of 3004	3608	msedge.exe	82
PID 3608 wrote to memory of 3004	3608	msedge.exe	82
PID 3608 wrote to memory of 3004	3608	msedge.exe	82
PID 3608 wrote to memory of 3004	3608	msedge.exe	82
PID 3608 wrote to memory of 3004	3608	msedge.exe	82
PID 3608 wrote to memory of 3004	3608	msedge.exe	82
PID 3608 wrote to memory of 3004	3608	msedge.exe	82
PID 3608 wrote to memory of 3004	3608	msedge.exe	82
PID 3608 wrote to memory of 3004	3608	msedge.exe	82
PID 3608 wrote to memory of 3004	3608	msedge.exe	82
PID 3608 wrote to memory of 3004	3608	msedge.exe	82
PID 3608 wrote to memory of 3004	3608	msedge.exe	82
PID 3608 wrote to memory of 3004	3608	msedge.exe	82
PID 3608 wrote to memory of 3004	3608	msedge.exe	82
PID 3608 wrote to memory of 3004	3608	msedge.exe	82
PID 3608 wrote to memory of 3004	3608	msedge.exe	82
PID 3608 wrote to memory of 3004	3608	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Hi02D.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe9d1f3cb8,0x7ffe9d1f3cc8,0x7ffe9d1f3cd8
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,15666621426331134827,17389947472890164188,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1964,15666621426331134827,17389947472890164188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1964,15666621426331134827,17389947472890164188,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,15666621426331134827,17389947472890164188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3132 /prefetch:1
  2⤵
  PID:328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,15666621426331134827,17389947472890164188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,15666621426331134827,17389947472890164188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1964,15666621426331134827,17389947472890164188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3920 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,15666621426331134827,17389947472890164188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,15666621426331134827,17389947472890164188,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,15666621426331134827,17389947472890164188,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,15666621426331134827,17389947472890164188,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,15666621426331134827,17389947472890164188,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:4520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6f738fcca0370135adb459fac0d129b9

SHA1
5af8b563ee883e0b27c1c312dc42245135f7d116

SHA256
1d37a186c9be361a782dd6e45fe98b1f74215a26990af945a2b8b9aa4587ec63

SHA512
8749675cdd8f667ff7ca0a0f04d5d9cad9121fd02ed786e66bcd3c1278d8eb9ce5995d3e38669612bdc4dccae83a2d1b10312db32d5097ef843512244f6f769a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
68de3df9998ac29e64228cf1c32c9649

SHA1
be17a7ab177bef0f03c9d7bd2f25277d86e8fcee

SHA256
96825c1e60e4a87dc5dbae78b97104e6968275fa1602c69053d0192cae143f43

SHA512
1658b0bc504a8a5c57c496477cd800a893d751f03d632ef50aff9327cd33ad0e4e4f27bcb85b20bd22bef2ca65600b7d92e2a1f18fd3d08ad6391983de77beaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
b74e79bbd18e4ed3ac39517f9e3b7ed2

SHA1
d2ba361cc03d13843ab341494f38c45c95d94743

SHA256
a1fb3b8fa2e43160c00da41eea11b3abf6785ad0d3a7b88a7ac35e5800918ef2

SHA512
9a3f50095f712a64ff534d5e63b8b684db8481d136b1cb731794275a76cd9a83eb8c2e5db2e3ba128c0b89eba72a1e30c1337b10faf39d0988be07942830bd07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
8272ce6d72b2fb535c0c9ba60e7c0259

SHA1
ac79f2402ce397a21cb72083aa656751a1d80d9a

SHA256
e894a5fd8e6a2b1b1161815b8c85392a2eaca6b5338515cad7002be99c488a83

SHA512
9cead67d0d56a6a59a282bb8a52bce5cf16d331b4dc8358791c274fbfa1b122a3a32da42ec78d9b28c2f87d75c6d081033ebf0b8979badbdef0e523403abcc06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
327e405d3590a5f9d2adc48e026be621

SHA1
dec7f715fd6fcfc1b2b7be3b6dd573a288dd55fe

SHA256
3eecf5026e000b098b7e9e192ab8bbcd7fa3d51148a0a32d4f8dfe2aacb83789

SHA512
8720fb63343fb5e4e9c9df18d70500e0c9860e25b23d9b131ade60e9b75bc85568ddb73d5ac74b646eba4c6879d3aa2e6b5aa5c9b80bae404a6586601086d87f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8f822bc929daa573eb23a2cb31ffb4bf

SHA1
893aeebf77b6b2aebd35c515d8415fe0673b2cd4

SHA256
1773329c4693bfdc686dedf55abe2e9cf5cc452333fa8e94034a5fe68b19e213

SHA512
a33faafe28efe9cad760f072caddb072418e2df5608eccf235ed9d578bb76433964a0550ef476ae315ec1ced2f4090c1fa7f8f32f239fd1d7530b7d7df1336ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
817161ee17356e8dc65d286a219c1104

SHA1
d1ec21457f6672a6f7a942802c236c5ec3d56dfb

SHA256
5df55177dd42e3bf7ec0f9098a8575bb1f04f7ac8fcc4d90425e9c98d8a470aa

SHA512
cf2bf2b5d94a54e5bc0d2aa5049d87260a4d69a6b5b63aa78b3c7ed54db8c5a436d0b0f7c0c20738ef998b979e661a32a4f903d5141dc093dfbb1c9929e5a45a

Download Submit