Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 01:03
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240419-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target sample.html
- Size 220KB
- Sample240614-bev8zsseqk
- SHA256 ad4ad4dae885a3f57013edfcc148481c66d77e93e37f63d14dfb52919a0114f9
- MD5 9549f87ae476515cf8b679b3e7fd400f
- SHA1 787a9bd8b2b876c4dd8eb27c33675ca9a14024b1
- SHA512 cf252d8ad635a316f3d85fd0a73f5bfad3bd9b689ec6ed6358ded299f963a55a5b4ad48cf99ca7a6b328a5b628bbb7160c53fe8e7eec0dc28abc021ab8c07ee2
- SSDEEP 3072:SBDLna+4hUrqZyfkMY+BES09JXAnyrZalI+YQ:SBSQrFsMYod+X3oI+YQ
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2336 msedge.exe 2336 msedge.exe 3440 msedge.exe 3440 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe 4936 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3440 msedge.exe 3440 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3440 wrote to memory of 2796 3440 msedge.exe 84 PID 3440 wrote to memory of 2796 3440 msedge.exe 84 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 840 3440 msedge.exe 85 PID 3440 wrote to memory of 2336 3440 msedge.exe 86 PID 3440 wrote to memory of 2336 3440 msedge.exe 86 PID 3440 wrote to memory of 412 3440 msedge.exe 87 PID 3440 wrote to memory of 412 3440 msedge.exe 87 PID 3440 wrote to memory of 412 3440 msedge.exe 87 PID 3440 wrote to memory of 412 3440 msedge.exe 87 PID 3440 wrote to memory of 412 3440 msedge.exe 87 PID 3440 wrote to memory of 412 3440 msedge.exe 87 PID 3440 wrote to memory of 412 3440 msedge.exe 87 PID 3440 wrote to memory of 412 3440 msedge.exe 87 PID 3440 wrote to memory of 412 3440 msedge.exe 87 PID 3440 wrote to memory of 412 3440 msedge.exe 87 PID 3440 wrote to memory of 412 3440 msedge.exe 87 PID 3440 wrote to memory of 412 3440 msedge.exe 87 PID 3440 wrote to memory of 412 3440 msedge.exe 87 PID 3440 wrote to memory of 412 3440 msedge.exe 87 PID 3440 wrote to memory of 412 3440 msedge.exe 87 PID 3440 wrote to memory of 412 3440 msedge.exe 87 PID 3440 wrote to memory of 412 3440 msedge.exe 87 PID 3440 wrote to memory of 412 3440 msedge.exe 87 PID 3440 wrote to memory of 412 3440 msedge.exe 87 PID 3440 wrote to memory of 412 3440 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac76d46f8,0x7ffac76d4708,0x7ffac76d47182⤵PID:2796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,18080791006964433275,11915107835378805438,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵PID:840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,18080791006964433275,11915107835378805438,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,18080791006964433275,11915107835378805438,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1504 /prefetch:82⤵PID:412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18080791006964433275,11915107835378805438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:2044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18080791006964433275,11915107835378805438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:2108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,18080791006964433275,11915107835378805438,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4872 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4936
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4476
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5084
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
- MD5 477462b6ad8eaaf8d38f5e3a4daf17b0
- SHA1 86174e670c44767c08a39cc2a53c09c318326201
- SHA512 a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
- MD5 b704c9ca0493bd4548ac9c69dc4a4f27
- SHA1 a3e5e54e630dabe55ca18a798d9f5681e0620ba7
- SHA512 69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 746f6bdc3f4861f7043a809c5064e312b6d386b755072a77fc41db579d65efe8
- MD5 01a0d96bd9f9878c32d9135dcc296fa8
- SHA1 7773420f44db4a304bc488eb3da6ea5472dfde48
- SHA512 3394173aa8f6886cae003cc0629cb47f32b70c35669659ab38a92369662822fd8ba494768ca2c54310ea97c5cce71773c9215581f39201d3244172b7bac93723
- SSDEEP 96:nbkVoxm/Dnmqb18tuwpvWMoiVmdeH2WfwUWQyV+VDCAiEwb:nbkf6gOtuGWMXgrV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 326c97942eb14d77550133ce91c43d9f9327b14bb416d86884308d0f2300df99
- MD5 63599a7144c1228b19f58c1e3df04227
- SHA1 4818ceb933049a5f7453c98a4b2621c9feae5d00
- SHA512 adbfb9e425eb50f71fa053d5c4b4fa39811ebd3ffa8f56726ad674d5a2584c9d1b17de8f278d1de2afe0e75b8402b74b4f99a0097cd7086ad5865061244d62c0
- SSDEEP 96:nbkVoxm/DQYmqb18tjwpvWMoiVmdeH2WfwUWQyV+VDCziEwb:nbkfIgOtjGWMXgro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 11KB
- SHA256 32cf6f610df16888f97c8a8a3ffb4ccf1579c0898e571053f1b092d806409020
- MD5 a6ff038446e5b85d42fa415be8b6b7f6
- SHA1 a7b5838ecb808f9af29729613bf52f0ab6812abf
- SHA512 5b70b4f678fe5d41613c5a83264f095463718e4e804d0b13f50f794981d27ba44c1a9ceffbd10f280d030b93bd5c8ee5514fe99db79c75b1941eeb5aa58fce27
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupjHf9e2RUyYQ/D3z2OMDCRE:A9iIxuERzA83h09RZxY7h5DaOMWRHqlh
- MD5 SHA1 SHA512 SSDEEP