Analysis
-
max time kernel
1696s -
max time network
1684s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
17-06-2024 14:06
Static task
static1
Behavioral task
behavioral1
Sample
authorize-ip.html
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
authorize-ip.html
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
authorize-ip.html
Resource
win11-20240611-en
General
-
Target
authorize-ip.html
-
Size
6KB
-
MD5
ef0f33abf4b4d8337419449d34512572
-
SHA1
9d83c2a8e3bff83d2e6ecdfb3209ed6a5fb88967
-
SHA256
ed8bc694cc441399d50c419f7b4a3f2ca18b59dd980edcd9b4e8e31eb37d95c0
-
SHA512
bdd43508c42a3cdaa7501953c5262b961b22b0a8d24e6ca4eeace05e7186b373d54a3fcf88af090202c8a9abfbb3bc5b3e87c745e7b430ba4afa3a786009f758
-
SSDEEP
96:yUpHJTVOfRr8L96e5hNvtdLXe5GaZffgNm8Monx/IJ:ycHERr8/lu39Ivnx/0
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 4412 msedge.exe 4412 msedge.exe 2188 msedge.exe 2188 msedge.exe 3696 identity_helper.exe 3696 identity_helper.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe 1944 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe 2188 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 2188 wrote to memory of 4892 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 4892 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 2096 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 4412 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 4412 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 1184 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 1184 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 1184 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 1184 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 1184 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 1184 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 1184 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 1184 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 1184 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 1184 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 1184 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 1184 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 1184 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 1184 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 1184 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 1184 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 1184 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 1184 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 1184 2188 msedge.exe msedge.exe PID 2188 wrote to memory of 1184 2188 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\authorize-ip.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb621646f8,0x7ffb62164708,0x7ffb621647182⤵PID:4892
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9060619595431502245,1324877552651616728,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵PID:2096
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,9060619595431502245,1324877552651616728,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4412 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,9060619595431502245,1324877552651616728,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:82⤵PID:1184
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9060619595431502245,1324877552651616728,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:4820
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9060619595431502245,1324877552651616728,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:1236
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,9060619595431502245,1324877552651616728,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:82⤵PID:3680
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,9060619595431502245,1324877552651616728,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3696 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9060619595431502245,1324877552651616728,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:12⤵PID:2300
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9060619595431502245,1324877552651616728,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:12⤵PID:2324
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9060619595431502245,1324877552651616728,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:12⤵PID:2448
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9060619595431502245,1324877552651616728,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:12⤵PID:5004
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9060619595431502245,1324877552651616728,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4756 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1944
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4380
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:884
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5257c0005d0c4d0bb282cb470925e4376
SHA1f9b8efb511ed64292568977c9f2ec255509e8f7d
SHA2568185c36aaacfc71e42f94fad8e198fe7fb2d868398ceabb89261cae94341cb22
SHA5122f3e8f352ed3ef88e8c28650390f93f98c92174d268330b886f3ebd1ba0163999051298ee12a054606b4986005452a241c6864cd292e69492d79c37d500556f4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD54819fbc4513c82d92618f50a379ee232
SHA1ab618827ff269655283bf771fc957c8798ab51ee
SHA25605e479e8ec96b7505e01e5ec757ccfe35cb73cd46b27ff4746dce90d43d9237c
SHA512bc24fb972d04b55505101300e268f91b11e5833f1a18e925b5ded7e758b5e3e08bee1aa8f3a0b65514d6df981d0cbfa8798344db7f2a3675307df8de12ae475b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5f9fbb661ad2b4783959ef2787c594e64
SHA1e7bea9c28f93d11aefb15e9783ca132f459aa9da
SHA256b5d492ce22557a3f6f972f30f58b1f2c18c6ef011669165b49d65dc83a0ff64b
SHA512e19094b03a760869f3de569c2d4fe419638772ea6f50ebdf619c749862f96b989c8890cdd45a275ca553b81fbef56e38edee8f465ce6cd23dc3297b51fa9a9e8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD525255b1c675f07c00a0ca5d0d542e31e
SHA1c1742d12c4ffc4a7c9e9bea381b446614a18c892
SHA2565f5186f35d3572c9b8f96c2502d2d828f06448a04545d688b88855a39e948989
SHA51234160c21b939a59d1511881acc4b352ebfa4bdadad92da43df441d27ac31a463adc6b8f3a1f0f5795b653121ddd1d203af8afbf33d236e92da37f9e9cc21c194
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD595cd1581c30a5c26f698a8210bcab430
SHA15e8e551a47dd682ec51a7d6808fe8e0f2af39e86
SHA256d58162c5ae5e18fc06604c285e024c01686093d70994dc93b4ae9d85b4c3f7b9
SHA512e49403df10177053634c431203a91d26df5dfb23cbbb88847459ecdf4b6107040d0944a3e84ee6bb26cb4e8017a35c8c31b658387cd1b6938ba4cb9f59606ece
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD573a4c63a4a00363f0d1102222f8d1ca5
SHA18d50fad696e9e7fe75c4210f0801dc5f84bd27a5
SHA25640a8f1f09e624a6d66b4693a192e8ed0dbbb9f60f6b52e57475ced3cbe5af9c7
SHA5127f6c8950b991ec8b49f6ff64da634268c2b39c5ca1b48a6415de1ba8e3322f886f9f112aaaf588f7178e37277a0dbd905a8edfa420cd0542cce9a9835ddc17b6
-
\??\pipe\LOCAL\crashpad_2188_LVEFQAEIOJFSSTGZMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e