Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
09-07-2024 06:47
Static task
static1
Behavioral task
behavioral1
Sample
aLZhlBKT.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
aLZhlBKT.html
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
aLZhlBKT.html
Resource
win10v2004-20240704-en
Behavioral task
behavioral4
Sample
aLZhlBKT.html
Resource
win11-20240704-en
General
-
Target
aLZhlBKT.html
-
Size
2KB
-
MD5
f124b5c09d374d0f69d640b89a9ee2c2
-
SHA1
b3eabbdb05e682802b862161cd584468095ba168
-
SHA256
e99ca0fc692290f683b6a3e0ad3812894f539a4a7c8f20998b17b006d1e92dc8
-
SHA512
03477213af313cad9fee791d9bed12ac887fe999b19169024413720289037e2b832f39d99a6de270fe124f4560209a6ea6c5a4a6f415ded5dfaaacbb898732cc
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4448 msedge.exe 4448 msedge.exe 1568 msedge.exe 1568 msedge.exe 4456 identity_helper.exe 4456 identity_helper.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe 1984 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe 1568 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1568 wrote to memory of 1340 1568 msedge.exe 81 PID 1568 wrote to memory of 1340 1568 msedge.exe 81 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4492 1568 msedge.exe 82 PID 1568 wrote to memory of 4448 1568 msedge.exe 83 PID 1568 wrote to memory of 4448 1568 msedge.exe 83 PID 1568 wrote to memory of 4376 1568 msedge.exe 84 PID 1568 wrote to memory of 4376 1568 msedge.exe 84 PID 1568 wrote to memory of 4376 1568 msedge.exe 84 PID 1568 wrote to memory of 4376 1568 msedge.exe 84 PID 1568 wrote to memory of 4376 1568 msedge.exe 84 PID 1568 wrote to memory of 4376 1568 msedge.exe 84 PID 1568 wrote to memory of 4376 1568 msedge.exe 84 PID 1568 wrote to memory of 4376 1568 msedge.exe 84 PID 1568 wrote to memory of 4376 1568 msedge.exe 84 PID 1568 wrote to memory of 4376 1568 msedge.exe 84 PID 1568 wrote to memory of 4376 1568 msedge.exe 84 PID 1568 wrote to memory of 4376 1568 msedge.exe 84 PID 1568 wrote to memory of 4376 1568 msedge.exe 84 PID 1568 wrote to memory of 4376 1568 msedge.exe 84 PID 1568 wrote to memory of 4376 1568 msedge.exe 84 PID 1568 wrote to memory of 4376 1568 msedge.exe 84 PID 1568 wrote to memory of 4376 1568 msedge.exe 84 PID 1568 wrote to memory of 4376 1568 msedge.exe 84 PID 1568 wrote to memory of 4376 1568 msedge.exe 84 PID 1568 wrote to memory of 4376 1568 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\aLZhlBKT.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff87fe646f8,0x7ff87fe64708,0x7ff87fe647182⤵PID:1340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,12158146570225844411,14375521797214242666,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:22⤵PID:4492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,12158146570225844411,14375521797214242666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,12158146570225844411,14375521797214242666,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:82⤵PID:4376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12158146570225844411,14375521797214242666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:2284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12158146570225844411,14375521797214242666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:2756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,12158146570225844411,14375521797214242666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:82⤵PID:3636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,12158146570225844411,14375521797214242666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12158146570225844411,14375521797214242666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:12⤵PID:2828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12158146570225844411,14375521797214242666,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:12⤵PID:4444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12158146570225844411,14375521797214242666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:2580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12158146570225844411,14375521797214242666,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:12⤵PID:4568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,12158146570225844411,14375521797214242666,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4836 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1984
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2848
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3148
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e81c757cdb64c4fd5c91e6ade1a16308
SHA119dc7ff5e8551a2b08874131d962b697bb84ad9b
SHA25682141d451d07bdb68991f33c59129214dd6d3d10158aeb7a1dc81efbc5fb12b3
SHA512ba8de0b3b04fec5a96d361459dde0941b1b70f5be231fdec94806efa3ecf1e8faf8e27b1800fa606dc4a82e29d4cf5109b94109e5ad242ddf9f4671e2acbcfbd
-
Filesize
152B
MD52e57ec8bd99545e47a55d581964d0549
SHA1bd7055ea7df7696298a94dedfc91136e3b530db8
SHA256a50ba35608edc2f3360cc71be0d4b29bba0e3382d1f08f24df5322ce2ad2443c
SHA5126b9b73d983c472149629c842e16e4f7c2f8a0a3bb6dd64837ef647db810ef1beb3a02b15dc1eec2c5de8aee6b3ca195c7d26c432705061c5b0ec7841a5bbf106
-
Filesize
6KB
MD5fae9cd30d3826eb22834ccecab3d8821
SHA1681e6ffc84159d694101540f3de9d010052ebfe3
SHA256ff5973f09a30a1f04ced319624f0d7740b64149d1ecc6bba9fa7f5df24099b83
SHA512c0e96e48cd2bc33731a0d5bc1933e7f57fa6faa146a4a96ed87666bb95d506b3d7d34992f93170d4a75ec57949ad31d03cf41455a6d71a52d8d7f11b645c921e
-
Filesize
6KB
MD590d2f64fd02de15801cef48d4ba24764
SHA1fe4e5b806f3df99f6735e84f3cbf7213d3ea027d
SHA2560393501ebc8dfc45609e57070e12fa53f4d2a65e925264cbd141a849edb26f91
SHA51288d12f9dfb8400d076e2e9d8326e96ea44cf15109b17f8bca7f3744701f036f7412791de706b37561811c24de042b2cb81ba189e5fb474ce956c639cb1032b6c
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5d9a3c27ff6db90f83cb7ccd7bd3ac6f2
SHA14b9ff2b683f136fe7fa271bb7dac093b65e5d9b0
SHA256b4deb963c9d35a590ee5b9b44021d46c063d40e47b51f7503b483407a3242d25
SHA512f8143895da7f593d0e8e629874c1c48dfaa8775f1ced2064643ce81bdd5b72702be167c2e95a83880a3a20de4bd7cbd65414ae3dc0ac5d0eafbaeaae2b55c20d