6127929d2ec21bf1678d52a976dcc6fbccbd7758979cf60d5d0eff6bbf8f79b8

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 15:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

218KB
MD5

467da68ab4c57d9fe56176076471fe35
SHA1

e74d9b0f06a16511f59d95b45339221f387ff8f4
SHA256

ba01d5b61d7cb0833d71df135a1ff1192e6443fb26ad9bbe20c7d5a81ac68fef
SHA512

f3a07a8d9340c7473fce2de3b785996a4cad7ab92b52d4fe9f6fd6d2b712f426606f0a31cb4bb68c6b7add3a3707897df1f5f6c424e1344c6f6a8dcad31f6184
SSDEEP

3072:SznQKjIl6z29a/yfkMY+BES09JXAnyrZalI+YQ:ScKM68aKsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2152	msedge.exe
2152	msedge.exe
4260	msedge.exe
4260	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4260	msedge.exe
4260	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 4144	4260	msedge.exe	82
PID 4260 wrote to memory of 4144	4260	msedge.exe	82
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 1520	4260	msedge.exe	83
PID 4260 wrote to memory of 2152	4260	msedge.exe	84
PID 4260 wrote to memory of 2152	4260	msedge.exe	84
PID 4260 wrote to memory of 3456	4260	msedge.exe	85
PID 4260 wrote to memory of 3456	4260	msedge.exe	85
PID 4260 wrote to memory of 3456	4260	msedge.exe	85
PID 4260 wrote to memory of 3456	4260	msedge.exe	85
PID 4260 wrote to memory of 3456	4260	msedge.exe	85
PID 4260 wrote to memory of 3456	4260	msedge.exe	85
PID 4260 wrote to memory of 3456	4260	msedge.exe	85
PID 4260 wrote to memory of 3456	4260	msedge.exe	85
PID 4260 wrote to memory of 3456	4260	msedge.exe	85
PID 4260 wrote to memory of 3456	4260	msedge.exe	85
PID 4260 wrote to memory of 3456	4260	msedge.exe	85
PID 4260 wrote to memory of 3456	4260	msedge.exe	85
PID 4260 wrote to memory of 3456	4260	msedge.exe	85
PID 4260 wrote to memory of 3456	4260	msedge.exe	85
PID 4260 wrote to memory of 3456	4260	msedge.exe	85
PID 4260 wrote to memory of 3456	4260	msedge.exe	85
PID 4260 wrote to memory of 3456	4260	msedge.exe	85
PID 4260 wrote to memory of 3456	4260	msedge.exe	85
PID 4260 wrote to memory of 3456	4260	msedge.exe	85
PID 4260 wrote to memory of 3456	4260	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa025546f8,0x7ffa02554708,0x7ffa02554718
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,14352263861467857610,6619076383637319870,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,14352263861467857610,6619076383637319870,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,14352263861467857610,6619076383637319870,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14352263861467857610,6619076383637319870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14352263861467857610,6619076383637319870,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,14352263861467857610,6619076383637319870,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c5abc082d9d9307e797b7e89a2f755f4

SHA1
54c442690a8727f1d3453b6452198d3ec4ec13df

SHA256
a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716

SHA512
ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4a74bc775caf3de7fc9cde3c30ce482

SHA1
c6ed3161390e5493f71182a6cb98d51c9063775d

SHA256
dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280

SHA512
55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0a1fbb59f1de1ac7c7b72e02b5b6c17a

SHA1
7c14440dbf39a0e270e8ffa84c817a2ef39fcedc

SHA256
ce8abba5e7beb285fd2cd7784873b15aaa722a38b2785dfe2d52bc03e8d6f81b

SHA512
6d4dd5acb13cd49ba8d42697c96313dab2fdbf19f5713d59e81e6cd874d8ea91dadcdf9da29be3389babe6b4b8018a6c1d16ffe6692b31dc16eec2fad887a551

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
40b6f541b7cbb6fd895065f0fb007215

SHA1
3d3b1089b92fa1a4984542c0bd5d9b227b266d7b

SHA256
2aeb48982f70df054dfa362db8d58b63779785bbccabb0aad5c030031a8d7e9f

SHA512
ed2a93f45bb83e36bcb0f42df285d871b9eb83fe01ae9869a0c1455f2261d88c9f5cd010d9c373ad3a287be7c700955c440adc11562e5cd5dbeb9d949e63c6a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
323e38fc8f1523a848821529dd346c9b

SHA1
ede74f3e263c481e0d3a5d28252ba658ff1f0d4d

SHA256
720440b74c06f05b93342ed2187fb66dfb1eac9d66c23030e427c8a02b829126

SHA512
bb06d1b99db1e2908ab3c791f8d613d2ab822128053134833550059081461d87109bee7f2bc250e955eb80f622a445add285846e9aaed4f2bb1900af36d217be

Download Submit