5c2f5f7a627cb7cd68974015283b6747371f14407ef82234faa7b492d5fdb939

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 21:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

index.htm
Size

21KB
MD5

307e53982dad790173bc33d80be867c9
SHA1

4684557e3906b8968162a13b211548edfbb575d1
SHA256

5b292dc5f201fba7176cdabe3dd1d5321b65a8373e9919986547e37c97c45654
SHA512

a543a3d4d6072fd28c8ffe05cd6c9fafaf96981fdc6827f25d155e7d0c39384e88f8036e7cbc6371a5c3434ca9c38498bd41b733ce51f69b40da79362cf3ae33
SSDEEP

384:pIoXnJWOZrWOvrWOZrWO1rWOZrWORcOuODOumOumOYOhWOJrWO/rWOZrWO4rWOrr:pjXnJdrbrlrBrFrlK1rrrFr8rfr9JZFb

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1464	msedge.exe
1464	msedge.exe
532	msedge.exe
532	msedge.exe
5084	identity_helper.exe
5084	identity_helper.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 228	532	msedge.exe	81
PID 532 wrote to memory of 228	532	msedge.exe	81
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 4852	532	msedge.exe	82
PID 532 wrote to memory of 1464	532	msedge.exe	83
PID 532 wrote to memory of 1464	532	msedge.exe	83
PID 532 wrote to memory of 2092	532	msedge.exe	84
PID 532 wrote to memory of 2092	532	msedge.exe	84
PID 532 wrote to memory of 2092	532	msedge.exe	84
PID 532 wrote to memory of 2092	532	msedge.exe	84
PID 532 wrote to memory of 2092	532	msedge.exe	84
PID 532 wrote to memory of 2092	532	msedge.exe	84
PID 532 wrote to memory of 2092	532	msedge.exe	84
PID 532 wrote to memory of 2092	532	msedge.exe	84
PID 532 wrote to memory of 2092	532	msedge.exe	84
PID 532 wrote to memory of 2092	532	msedge.exe	84
PID 532 wrote to memory of 2092	532	msedge.exe	84
PID 532 wrote to memory of 2092	532	msedge.exe	84
PID 532 wrote to memory of 2092	532	msedge.exe	84
PID 532 wrote to memory of 2092	532	msedge.exe	84
PID 532 wrote to memory of 2092	532	msedge.exe	84
PID 532 wrote to memory of 2092	532	msedge.exe	84
PID 532 wrote to memory of 2092	532	msedge.exe	84
PID 532 wrote to memory of 2092	532	msedge.exe	84
PID 532 wrote to memory of 2092	532	msedge.exe	84
PID 532 wrote to memory of 2092	532	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\index.htm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad02946f8,0x7ffad0294708,0x7ffad0294718
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,1791071592375231751,1947959357331069022,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2248,1791071592375231751,1947959357331069022,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2248,1791071592375231751,1947959357331069022,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,1791071592375231751,1947959357331069022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,1791071592375231751,1947959357331069022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,1791071592375231751,1947959357331069022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,1791071592375231751,1947959357331069022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,1791071592375231751,1947959357331069022,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,1791071592375231751,1947959357331069022,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,1791071592375231751,1947959357331069022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,1791071592375231751,1947959357331069022,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,1791071592375231751,1947959357331069022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,1791071592375231751,1947959357331069022,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,1791071592375231751,1947959357331069022,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
256B

MD5
e21cda9ded8f20362a493dc8e4009283

SHA1
615bb922d256f74161fe72ebe2af152bd8d0f387

SHA256
59130fc017c3eadd1d94d05559b22241e10c6a570d2ce92fd70e16f0da5f6cdf

SHA512
1cae6c81802017d27f4e2605aa106a86e4d55d48106e2c4be036db9d92ba9dd586d394f32acedc0d2ac50b9c1b16be6d8afe8a59abb4b9cb46bf236822d42fa2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1f6bf8baac50f9d499a352bd2f27d893

SHA1
5c79d31ed85e5cdfc7b9ea5bf5b6bd62f903a4c7

SHA256
0ffbb7c79eb2d8c72d3f95fe0093e3686783e326d4177e1cfa6f3a946b53ea76

SHA512
d33c422719127e3a4af7bd3e863737126488b72d12523a0f794cb4515217b3488c2245f6c4eefd49110aed8251304016aef6df94a44ed8fac980571f89c30093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fa044df523f38ab15b39ce710f2f059a

SHA1
c7cf35551901798b554a6f326c2eae96738e5e75

SHA256
93d25b9235ebc081d29536c6c08bdeeb61d16f3c2d2118c263e068da5b2ffce3

SHA512
24f2ce8fde6fed9a4fbc2e436e1ccdac91aea105b21ea31b01775504e991020e38a79f51cd08c74bd9f6bfdc9700d7ed1979dd32860827cf9d46dcf0534a964d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c7bd4300e98c0d0eb3d3d6bb482c2ffa

SHA1
b1ce9c837653bada3e739b162afda651aa530b8f

SHA256
da86048cee4297dd7eaf5c771fe8597d5627615dbdd150371d6b06556bd12273

SHA512
14f76decf878034a0630c7a63054d8ecd4f402a3eb020a761f0f76914da08b241772e41f0f72cab6338c99eea36a1af5d48d3f52e7a275543797343f4c14efa7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d21d684cda4f4c3d42abe5d9b0ef5cc4

SHA1
6ec36d6a5d760508dfd9d5b1a87e4dbc754fc675

SHA256
1ca368b66a0db53071fafca9683e5259a6552e73c45936abb715ec241a5188d1

SHA512
e9a86ae0ed2d749064c204319006c6b1af28a35a59860937270808e89ed50d9bb43b01a7f8a4005aa20fdb9dccead259773137ace884898b737e428ed2b8973c

Download Submit