23c75e988d1579ade684b8fc3e9ebea0f2d62b955d190c974c4a47112681048a

max time kernel
0s
max time network
4s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
01-07-2024 14:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

493KB
MD5

937cffd4aed2741d390f12cdaceedfe6
SHA1

6e4053037c6fb57b01fb8aadd59f1b4bab4413dd
SHA256

23c75e988d1579ade684b8fc3e9ebea0f2d62b955d190c974c4a47112681048a
SHA512

8296f202f1538be8425c725e8be4816e692aaec686c89b525c67d2911c4da968047676f3801bed62f7bd95f54d258d775ef42dfa54d93978981c5a4a4e58d444
SSDEEP

6144:5DoAwoAwKAwtAwoAwtAw5AwBAw+AwMAwpbQ:5EArADAEALA8AUAaAFAJA2bQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

msedge.exemsedge.exe

pid process

4556 msedge.exe
4556 msedge.exe
848 msedge.exe
848 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

848 msedge.exe
848 msedge.exe

pid	process
4556	msedge.exe
4556	msedge.exe
848	msedge.exe
848	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 848 wrote to memory of 4788	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4788	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 1836	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4556	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4556	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4152	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4152	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4152	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4152	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4152	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4152	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4152	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4152	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4152	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4152	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4152	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4152	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4152	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4152	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4152	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4152	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4152	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4152	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4152	848	msedge.exe	msedge.exe
PID 848 wrote to memory of 4152	848	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc11ee3cb8,0x7ffc11ee3cc8,0x7ffc11ee3cd8
2⤵
PID:4788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,4093267312003271692,12086146319241935566,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
2⤵
PID:1836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,4093267312003271692,12086146319241935566,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,4093267312003271692,12086146319241935566,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
2⤵
PID:4152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4093267312003271692,12086146319241935566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
2⤵
PID:1036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,4093267312003271692,12086146319241935566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
2⤵
PID:4892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2660

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
2dfecbb576ee9795c5284da8a2a3c7f5

SHA1
f1f0a6a97850aca2b4ab267a017564af02f24948

SHA256
dca6901942fa748fc01339192c0738a06847d8497c9c61298f1e5df1f8352fb0

SHA512
d664cc261113427810dd0b2d32763ddd08611a528fe6b285782d6b8ac03304b72a90fe7f3f7142e825ab8d948d5c9cf52f420546f3796b2ac23f3d00f3c17389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
6486ee9e961a437dadb68ff1544d18a8

SHA1
05f4daccca0bc1ce73fe71ad2325ba5dadd3df25

SHA256
9a98b4686c9e90672a548c873943b3027fb111f7992263111d912318429f5834

SHA512
ee3659f68a46f37f340f98b85a7aa289e700c5ced2a4f0104673bb5f18cc82d1e9b838ec0278407213c6ed2073998e7aad78a7a39390b7e460c8e26dfa91d0e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
9146573532f17fba87ea81678ff6c5a9

SHA1
d8d73b9815ced46a28a70b9a03ca656567013ae4

SHA256
3b112ca710c11f93f0498c3ab3c40a714ed19d692903fa2db05912da9331cc8c

SHA512
9cd1530b36c57f3bdbbd9353a3fb9ca470c430b2e2d5a07b519dc133e67d56994f53501997ea47f22c74bb59d17adfa870f4eabbf7f599e3c3dd64bf269ffd2a

Download Submit
\??\pipe\LOCAL\crashpad_848_FOLKQIJAQIZWXXBZ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit