df141f539584ad60d116267fe10b75c608c79ce710b4f86bff771074d854bbe3

Analysis

max time kernel
600s
max time network
589s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3sxgl.html
Size

108KB
MD5

84b635086bcce05a47d84ddcd6baf677
SHA1

4007aa15538e624bd78e97c25b6af1fba23d56fa
SHA256

df141f539584ad60d116267fe10b75c608c79ce710b4f86bff771074d854bbe3
SHA512

a0a458032c85eca9502caaffc2cc898f922c667583c7e5950aa7e58d69b540d83a3df54a1a988218cf211ce76d382cbac12d9d9a2184ba57032e60cf5f837b46
SSDEEP

3072:6hdhFO5touycwuxwjLsUfdSlle2DvPsIHxi2ZXwxxBJy:kdhk5twc7xwjLsUcKG

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2672	msedge.exe
2672	msedge.exe
4392	msedge.exe
4392	msedge.exe
4764	identity_helper.exe
4764	identity_helper.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 688	4392	msedge.exe	84
PID 4392 wrote to memory of 688	4392	msedge.exe	84
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 3356	4392	msedge.exe	85
PID 4392 wrote to memory of 2672	4392	msedge.exe	86
PID 4392 wrote to memory of 2672	4392	msedge.exe	86
PID 4392 wrote to memory of 1412	4392	msedge.exe	87
PID 4392 wrote to memory of 1412	4392	msedge.exe	87
PID 4392 wrote to memory of 1412	4392	msedge.exe	87
PID 4392 wrote to memory of 1412	4392	msedge.exe	87
PID 4392 wrote to memory of 1412	4392	msedge.exe	87
PID 4392 wrote to memory of 1412	4392	msedge.exe	87
PID 4392 wrote to memory of 1412	4392	msedge.exe	87
PID 4392 wrote to memory of 1412	4392	msedge.exe	87
PID 4392 wrote to memory of 1412	4392	msedge.exe	87
PID 4392 wrote to memory of 1412	4392	msedge.exe	87
PID 4392 wrote to memory of 1412	4392	msedge.exe	87
PID 4392 wrote to memory of 1412	4392	msedge.exe	87
PID 4392 wrote to memory of 1412	4392	msedge.exe	87
PID 4392 wrote to memory of 1412	4392	msedge.exe	87
PID 4392 wrote to memory of 1412	4392	msedge.exe	87
PID 4392 wrote to memory of 1412	4392	msedge.exe	87
PID 4392 wrote to memory of 1412	4392	msedge.exe	87
PID 4392 wrote to memory of 1412	4392	msedge.exe	87
PID 4392 wrote to memory of 1412	4392	msedge.exe	87
PID 4392 wrote to memory of 1412	4392	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3sxgl.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcbc3746f8,0x7ffcbc374708,0x7ffcbc374718
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,17990594725279271830,3208909970411810045,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,17990594725279271830,3208909970411810045,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,17990594725279271830,3208909970411810045,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17990594725279271830,3208909970411810045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17990594725279271830,3208909970411810045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17990594725279271830,3208909970411810045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,17990594725279271830,3208909970411810045,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,17990594725279271830,3208909970411810045,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17990594725279271830,3208909970411810045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1324 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17990594725279271830,3208909970411810045,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17990594725279271830,3208909970411810045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,17990594725279271830,3208909970411810045,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,17990594725279271830,3208909970411810045,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4904 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
584971c8ba88c824fd51a05dddb45a98

SHA1
b7c9489b4427652a9cdd754d1c1b6ac4034be421

SHA256
e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307

SHA512
5dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b28ef7d9f6d74f055cc49876767c886c

SHA1
d6b3267f36c340979f8fc3e012fdd02c468740bf

SHA256
fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37

SHA512
491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
71a20eb963e83bc4e76ba94d80b76120

SHA1
2687e9b969adf9784270c71774d576d0bf7432a5

SHA256
97cbdc0fd7a97962c16d4e737666ba8713afc90edf8d3da6a8837597d0e25093

SHA512
483043e513be048882dff2b7e3084346042b438adff9b4a6b2da1b9301c39944a65b138bda123908d62e484e81449ec35ba7ecfa02b5610a8fb78850d11c8cd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
366e4db2e6a810630bd6a541b438f7da

SHA1
593367b0ebf322007242b641ee2463a6e935ee32

SHA256
1b685a0acde8ead6949fec61a07b46974cce0780c4316199244f6eb66e04b310

SHA512
fba87d68418c66232639e4dff4e02a7505093008e41a7b4e6a5fa44e371d8b364611d86419aaf257f84540afa53f271a6545ee0d95180a6f98a93b1c0b8ac539

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8c6feee99e14e3b17de594183b98d36c

SHA1
e8f1548d1c510af612651ab3f23e33870730b8a7

SHA256
8274b6a7d35cddd4c8303a42990598eca0f9cceac49770baae982f3a40326882

SHA512
d0f6994e42ba93a29712e0188a7099d500a9a85f8d53d1696640c2f0e17410edf5b3f87c0bc4043922e0848ae61e22314cce5acc8f362e5e5b5ee301142e12fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e94c5c76a6069c328c947f6d62dba74a

SHA1
3d606adc2c217c11d6753fdccf35d62f79e8ebcd

SHA256
f09f548b4f0f64e45005e89d528d8628b9355e3cb070e57b9bb7faad9e689a3b

SHA512
e8c233989dac75532b0276cb4fd92dde5d8d45a7793c951bc315f9e7fa7c671ed94281e96762e042b40d19b29bab3df01bf14b96a2e44278f10a19e77ada91ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
60c30e7a632937ba003bc2274bc9dcc6

SHA1
bf9c15140140141bc832d7a0942dd1da1db4f7ad

SHA256
bd6c09e4e04ef9ee63684b64c65cf09987ee451778fa2351967fc4c53a5f933e

SHA512
acdd04b93eb454686cd6754da67ac4d13376c4b1920aa9e6796fbc6fc8f3f040efc3a3bcf51004ca577a530192d6b9f30ef48996e813c4242ddbacd95ea0fe0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
248dbee0c86a2a4690112e3c5997b437

SHA1
511dc3510f8087b0381e247f4ef4900be6144e6c

SHA256
bf43d52ba34d5e1f5241f59e836c69f99426f23f8bdc97fa624e41cd52659811

SHA512
ca1a352d5501778ff3221e4c57bb31428336d2d3a2a6592c58a9b902601c79309ca84e5a62b32bef9990fe87525ea3e8a026d138b5894f794dc2c18c4860b404

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
114d0035adba602741abc7857d278c3d

SHA1
4ad8eadcd33e579bc656890a3ec29416e1240ae2

SHA256
cda476b9d4ff67e733d8cbf2cde343dd7bbac894c9ef7c4ecf20ed23572b7c5b

SHA512
824625e1da59f8085033a453f6d62aef94649bbabe47ced9496e5cbddec7152eda83fca2191dc5a9f2ae0ddfb26aca88130971f1e40d7e66b889a047f4e8693f

Download Submit