Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 04:42
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240508-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target sample.html
- Size 218KB
- Sample240613-fb6mrsyarr
- SHA256 d3f2e3d4fa452b7a7fcf0b07042fe37799e3fef52d3d06f2401964dfc931a4db
- MD5 7af752a49bb91d57c223336ed5e8ab56
- SHA1 68578d17c0c70e6fc57c545a02761378df393cfa
- SHA512 d7813cb91271741ab0143fadcc3c7978d37423524bcab45ac95243652dab6bced51d9820bd06fc9746ddcbc59f9a657339d5501df6226b88ed4351bc25a29e21
- SSDEEP 3072:SYLD5pf0RryfkMY+BES09JXAnyrZalI+YQ:SYLDnfmOsMYod+X3oI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3088 msedge.exe 3088 msedge.exe 5092 msedge.exe 5092 msedge.exe 4640 msedge.exe 4640 msedge.exe 4640 msedge.exe 4640 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 5092 msedge.exe 5092 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5092 wrote to memory of 2924 5092 msedge.exe 81 PID 5092 wrote to memory of 2924 5092 msedge.exe 81 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 4776 5092 msedge.exe 82 PID 5092 wrote to memory of 3088 5092 msedge.exe 83 PID 5092 wrote to memory of 3088 5092 msedge.exe 83 PID 5092 wrote to memory of 3128 5092 msedge.exe 84 PID 5092 wrote to memory of 3128 5092 msedge.exe 84 PID 5092 wrote to memory of 3128 5092 msedge.exe 84 PID 5092 wrote to memory of 3128 5092 msedge.exe 84 PID 5092 wrote to memory of 3128 5092 msedge.exe 84 PID 5092 wrote to memory of 3128 5092 msedge.exe 84 PID 5092 wrote to memory of 3128 5092 msedge.exe 84 PID 5092 wrote to memory of 3128 5092 msedge.exe 84 PID 5092 wrote to memory of 3128 5092 msedge.exe 84 PID 5092 wrote to memory of 3128 5092 msedge.exe 84 PID 5092 wrote to memory of 3128 5092 msedge.exe 84 PID 5092 wrote to memory of 3128 5092 msedge.exe 84 PID 5092 wrote to memory of 3128 5092 msedge.exe 84 PID 5092 wrote to memory of 3128 5092 msedge.exe 84 PID 5092 wrote to memory of 3128 5092 msedge.exe 84 PID 5092 wrote to memory of 3128 5092 msedge.exe 84 PID 5092 wrote to memory of 3128 5092 msedge.exe 84 PID 5092 wrote to memory of 3128 5092 msedge.exe 84 PID 5092 wrote to memory of 3128 5092 msedge.exe 84 PID 5092 wrote to memory of 3128 5092 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe197b46f8,0x7ffe197b4708,0x7ffe197b47182⤵PID:2924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,3710832095533140,12803134982940836410,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:22⤵PID:4776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,3710832095533140,12803134982940836410,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,3710832095533140,12803134982940836410,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:82⤵PID:3128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,3710832095533140,12803134982940836410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:2172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,3710832095533140,12803134982940836410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:3584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,3710832095533140,12803134982940836410,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3084 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4640
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3520
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1984
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
- MD5 477462b6ad8eaaf8d38f5e3a4daf17b0
- SHA1 86174e670c44767c08a39cc2a53c09c318326201
- SHA512 a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
- MD5 b704c9ca0493bd4548ac9c69dc4a4f27
- SHA1 a3e5e54e630dabe55ca18a798d9f5681e0620ba7
- SHA512 69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 0839ca901f66add4f0191641b49fd1fc607eaf6bcc1327193cb5ecb957f3ca12
- MD5 61400645ec4666d5b3bde32f9a988e22
- SHA1 ad90de3848c19feffddeea781cf14b41a3cb07cf
- SHA512 3dda4a3ebc422fff1fd577bf13bed39dda97d4f43846593178251fe985976da0c0f1745e0e4207f13f27e4346e7ddb1df0d9eaa6dbd4276011e49bf6b69522aa
- SSDEEP 96:nqAk/oxm/Dnmqn1uKwpvWMoiVmdeH2WfG0UWQyV+VDCAiEwb:nqAkB6AoKGWMXW0rV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 97f346b3416002125dd78a5e75c8d03a42b840e6f4dfff579a46a663b4d97afc
- MD5 acd5c8c44990926f9a365872554096c8
- SHA1 16fa4110c91091e1b8d8042358459c48a6257ab9
- SHA512 d5cb06ee89e2c3a2c8ad8491c25f1b1729e9a969f7f29e7ebb20046d8555f0ba6d188b4f5be108a8682577665740d2031a93f4a10c8ff82435d7f53656c54c47
- SSDEEP 96:nqAk/oxm/DQYmqn1uvwpvWMoiVmdeH2WfG0UWQyV+VDCziEwb:nqAkBIAovGWMXW0ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 20e19536b812cb4a83b49db2dfc037e1ca898f9034de2d7961f4f2b4539010bb
- MD5 b3d74f4f840a7459c92e9ab2a77405fa
- SHA1 fa2dba7f8a21d721aeed2d879370b594334feb9a
- SHA512 89b61ba038f2b7d94fa8f60ecbe44c3597f6379f73ea4708ab7ddb685fa208981da8f8558f084b3f2f1f73c3016ed78c4cfb8e29ca95092d6acdf39b9e9de37d
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupaHf+e2RU1h/63z2OMDCRH5:A9iIxuERzA83h09RZxYIYS6aOMWRHqlo
- MD5 SHA1 SHA512 SSDEEP