86cdb25c6ee635063595c4faa811c5e2359f82d49a388e321c59a6eb2fa13502

Analysis

max time kernel
145s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 220KB
Sample240613-rxea7asgqg
SHA256 ffb72e3da579a49222d82aa2a852c6136bec97e9de98ff7962a298b5e469874d
MD5 6f33abea4b43770909dc5f44768ab6ef
SHA1 cf1433ef081169cb27e38677eed9f4df0216b729
SHA512 564deed76b73ada885ef0ae1b049446434e2f2f3e054bdbd1af242d4a4c3366e10243ec3b5d6a1a2bca4e96cef527acc64c6953d6153dd99e0f06591b259a242
SSDEEP 3072:SC5TnG/Zre+dcyfkMY+BES09JXAnyrZalI+YQ:SC5WTDsMYod+X3oI+YQ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5920	msedge.exe
5920	msedge.exe
4532	msedge.exe
4532	msedge.exe
396	identity_helper.exe
396	identity_helper.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 2372	4532	msedge.exe	81
PID 4532 wrote to memory of 2372	4532	msedge.exe	81
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 2556	4532	msedge.exe	82
PID 4532 wrote to memory of 5920	4532	msedge.exe	83
PID 4532 wrote to memory of 5920	4532	msedge.exe	83
PID 4532 wrote to memory of 3900	4532	msedge.exe	84
PID 4532 wrote to memory of 3900	4532	msedge.exe	84
PID 4532 wrote to memory of 3900	4532	msedge.exe	84
PID 4532 wrote to memory of 3900	4532	msedge.exe	84
PID 4532 wrote to memory of 3900	4532	msedge.exe	84
PID 4532 wrote to memory of 3900	4532	msedge.exe	84
PID 4532 wrote to memory of 3900	4532	msedge.exe	84
PID 4532 wrote to memory of 3900	4532	msedge.exe	84
PID 4532 wrote to memory of 3900	4532	msedge.exe	84
PID 4532 wrote to memory of 3900	4532	msedge.exe	84
PID 4532 wrote to memory of 3900	4532	msedge.exe	84
PID 4532 wrote to memory of 3900	4532	msedge.exe	84
PID 4532 wrote to memory of 3900	4532	msedge.exe	84
PID 4532 wrote to memory of 3900	4532	msedge.exe	84
PID 4532 wrote to memory of 3900	4532	msedge.exe	84
PID 4532 wrote to memory of 3900	4532	msedge.exe	84
PID 4532 wrote to memory of 3900	4532	msedge.exe	84
PID 4532 wrote to memory of 3900	4532	msedge.exe	84
PID 4532 wrote to memory of 3900	4532	msedge.exe	84
PID 4532 wrote to memory of 3900	4532	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa127d46f8,0x7ffa127d4708,0x7ffa127d4718
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,2202039511684526072,1774138858381269154,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,2202039511684526072,1774138858381269154,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,2202039511684526072,1774138858381269154,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2202039511684526072,1774138858381269154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2202039511684526072,1774138858381269154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,2202039511684526072,1774138858381269154,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,2202039511684526072,1774138858381269154,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2202039511684526072,1774138858381269154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2202039511684526072,1774138858381269154,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2202039511684526072,1774138858381269154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,2202039511684526072,1774138858381269154,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,2202039511684526072,1774138858381269154,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2424 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 a00ef8c8427e7854a8b273ef25e302a84c73bef44119e30fc9e0b117960d25d1
MD5 43f2c0df01e5367c6ac38effadeed96a
SHA1 325dac0196940bbd3b632616645fd932120b7321
SHA512 1c3466bd0cc1549e48bf7a4b7f665f0978b05fa07c1d136a421f3d746aebf178d7cd470dcbe9d8c4b4f60037d931d994c7c2aaea04bbf49f87340e20d8d3e1c4
SSDEEP 96:nmkI01v1wpvWMoiVmdeHBrzNUWQyV+VDCziEwb:nmk5V1GWMXDro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 0f20572e35fa4e96dd7a7b454f3cf3b6a13e48a37fe16a3ede6c7d7612bf77f6
MD5 4c722fe2a2634005ae36f76045eba1a7
SHA1 b15991901c80541f2bdc90cfc212320c3437bb5c
SHA512 b2294fe35a8058ede7757d64825619453d34a591a4418ec372b5493182eb010034c44a95fcaf7b83f061e5801d6942246dde9b63a08957b8151712812a519d5a
SSDEEP 96:nmkG01v1wpvWMoiVmdeHBrzNUWQyV+VDCAiEwb:nmkfV1GWMXDrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 f5cfa55a64cad91449e481885d42d0516a0df773c486eaba739dae8a3411eb2e
MD5 c474062c3abc5311de0544187ec5b4e8
SHA1 4046e33d367c62530d752751f79c330c5431d44a
SHA512 1054822221b47942c67dcaadd078bea5cb7948790e8cc9d482238e6e1a28e44f8ebc1c7d0c9d16e952c6f21a470a3d5a9bfb5df80de2e47e68178bca43432f32
SSDEEP 96:nmkG01vQwpvWMoiVmdeHBrzNUWQyV+VDCAiEwb:nmkfVQGWMXDrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 917ea607c61925391a222b04f2bdcabb3dade32639e11855eb400b95e12547d2
MD5 339c06fdc5d3a8afaaa918a958d8dd41
SHA1 3ebe17aa3333d438c7329255bbfc8b636f0c99de
SHA512 4f3eec28ffb8680af28d982564204063fbe3b20231627c2cf6d1bf141e33c120ee9473b52b403c718df556ea9194f8d1a41caabad29c66ddd7bc34cd5dd022e8
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupfHpe2RUkMj2j:A9iIxuERzA83h09RZxYfH9+yj
MD5 SHA1 SHA512 SSDEEP

Submit Download