07adb226a16610543b33f158a1e26a594277b65466ca041c6a93c6c235307cc7

Analysis

max time kernel
112s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2024, 04:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5011e06768137b64f8fe803c01e55810N.html
Size

31KB
MD5

5011e06768137b64f8fe803c01e55810
SHA1

950e72adecbc143b664f2a88a5be160208a81ab9
SHA256

07adb226a16610543b33f158a1e26a594277b65466ca041c6a93c6c235307cc7
SHA512

1d007e50bbd1a0481f7e853168a71622b98a8a547418ae025b2f61683a04ecbfbce7f3defb902bdcf2c54f6361ae3774ad2d1bd22daea994fafaad444b0fdae7
SSDEEP

768:8IRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SN1q6:8IRIOITIwIgIiKZgNDfIwIGI5IVJ7SqU

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3172	msedge.exe
3172	msedge.exe
4704	msedge.exe
4704	msedge.exe
4088	identity_helper.exe
4088	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 224	4704	msedge.exe	84
PID 4704 wrote to memory of 224	4704	msedge.exe	84
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 4968	4704	msedge.exe	85
PID 4704 wrote to memory of 3172	4704	msedge.exe	86
PID 4704 wrote to memory of 3172	4704	msedge.exe	86
PID 4704 wrote to memory of 3256	4704	msedge.exe	87
PID 4704 wrote to memory of 3256	4704	msedge.exe	87
PID 4704 wrote to memory of 3256	4704	msedge.exe	87
PID 4704 wrote to memory of 3256	4704	msedge.exe	87
PID 4704 wrote to memory of 3256	4704	msedge.exe	87
PID 4704 wrote to memory of 3256	4704	msedge.exe	87
PID 4704 wrote to memory of 3256	4704	msedge.exe	87
PID 4704 wrote to memory of 3256	4704	msedge.exe	87
PID 4704 wrote to memory of 3256	4704	msedge.exe	87
PID 4704 wrote to memory of 3256	4704	msedge.exe	87
PID 4704 wrote to memory of 3256	4704	msedge.exe	87
PID 4704 wrote to memory of 3256	4704	msedge.exe	87
PID 4704 wrote to memory of 3256	4704	msedge.exe	87
PID 4704 wrote to memory of 3256	4704	msedge.exe	87
PID 4704 wrote to memory of 3256	4704	msedge.exe	87
PID 4704 wrote to memory of 3256	4704	msedge.exe	87
PID 4704 wrote to memory of 3256	4704	msedge.exe	87
PID 4704 wrote to memory of 3256	4704	msedge.exe	87
PID 4704 wrote to memory of 3256	4704	msedge.exe	87
PID 4704 wrote to memory of 3256	4704	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5011e06768137b64f8fe803c01e55810N.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff91d1546f8,0x7ff91d154708,0x7ff91d154718
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,15283439375497437122,13879307101912068558,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,15283439375497437122,13879307101912068558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,15283439375497437122,13879307101912068558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15283439375497437122,13879307101912068558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15283439375497437122,13879307101912068558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,15283439375497437122,13879307101912068558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,15283439375497437122,13879307101912068558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15283439375497437122,13879307101912068558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15283439375497437122,13879307101912068558,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15283439375497437122,13879307101912068558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15283439375497437122,13879307101912068558,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
584971c8ba88c824fd51a05dddb45a98

SHA1
b7c9489b4427652a9cdd754d1c1b6ac4034be421

SHA256
e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307

SHA512
5dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b28ef7d9f6d74f055cc49876767c886c

SHA1
d6b3267f36c340979f8fc3e012fdd02c468740bf

SHA256
fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37

SHA512
491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
308B

MD5
b065e6363b72fa8928672f7572c1cd51

SHA1
d873bd5f02f0c10e6c9aa5f8a1dfcb7410164560

SHA256
c68439792fc389370825bce6acef2cfe7c7bd42d57afcf3274be9b782e58169a

SHA512
60f0a74264d493c8a4940ce63f1602e56960fdb46388d0325b58143cecc09b1515bf2fe12e2fcb0841ee9fed3601a74a80a3b9fe992c04233e73c7edca811e3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fef8710700be48c1b26b8f2e555afb75

SHA1
1cb7168274db8aa4ace0509ab3cfc614323c881a

SHA256
766c49e3fdd3e30b9de74a85903663dca931a0828d44a7f76339e1e97b529067

SHA512
77c0a928652cabcdd6c57b4340eba4be187613b89562c7af790b837b3dd546d7e97b5f1995e8023342ef5badd91fc621a93c27db76dd3913903c697c20bbba17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b168bbd9b3d0a85d9ee03874eb424168

SHA1
100db0e17543073ca9953e1c6d98fce3cbefdd7a

SHA256
49644aae978d084d8e9eadde2691a5da9207b74b52cf215bd695f12c9a8a4899

SHA512
608258c5f47ec0e23c34e803e26563df6c6c0720547ba886f5f2159260f3de51b34359826fccb6951dbae2d5050125d2277ac86ae21284a099d9f5271ed27efd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
67e35ba02d4f99b2bec07140083e9f74

SHA1
2e39b9b3bfe563c1a59220bddf152b967ed4cb5d

SHA256
dccfdbc02330b119f0e486c9491b3ce179c87d3e1f40476a956aaa0c856f2eb9

SHA512
f841666476a214ba248e31672fff0fd5f4a18852780128885aa82209b3049db36f2f603348da9c6e6a3d59a5b70da1a145a70f752786757926d9830b4856c83f

Download Submit