0beb1a11c7cd913b952fdbe0573d9cb7e8225a4611d4a06792d04e7bc2f11222

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25-07-2024 16:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.html
Size

6KB
MD5

fd739d9d0229cb5ed96765ad9ca5f055
SHA1

008a4457bc80a9ad7e52221f47f17c15f79e469a
SHA256

0beb1a11c7cd913b952fdbe0573d9cb7e8225a4611d4a06792d04e7bc2f11222
SHA512

3be28d45b4d2a3fc8dde4872c0473af8b5165fc19df057ea1f3e106dc0d95693fac236993aecbd2171b5521af60eb0854c35b7ac5da97199fd92f284ab21c764
SSDEEP

192:xlkDk5PCqjSjMRywW913Qp6sJwYQIbya3TIczdgoSfnx:xlggPCqjM17Ibya3TIczdgoSfnx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2412	msedge.exe
2412	msedge.exe
2780	msedge.exe
2780	msedge.exe
3684	identity_helper.exe
3684	identity_helper.exe
5244	msedge.exe
5244	msedge.exe
5244	msedge.exe
5244	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 1396	2780	msedge.exe	84
PID 2780 wrote to memory of 1396	2780	msedge.exe	84
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 4312	2780	msedge.exe	85
PID 2780 wrote to memory of 2412	2780	msedge.exe	86
PID 2780 wrote to memory of 2412	2780	msedge.exe	86
PID 2780 wrote to memory of 2708	2780	msedge.exe	87
PID 2780 wrote to memory of 2708	2780	msedge.exe	87
PID 2780 wrote to memory of 2708	2780	msedge.exe	87
PID 2780 wrote to memory of 2708	2780	msedge.exe	87
PID 2780 wrote to memory of 2708	2780	msedge.exe	87
PID 2780 wrote to memory of 2708	2780	msedge.exe	87
PID 2780 wrote to memory of 2708	2780	msedge.exe	87
PID 2780 wrote to memory of 2708	2780	msedge.exe	87
PID 2780 wrote to memory of 2708	2780	msedge.exe	87
PID 2780 wrote to memory of 2708	2780	msedge.exe	87
PID 2780 wrote to memory of 2708	2780	msedge.exe	87
PID 2780 wrote to memory of 2708	2780	msedge.exe	87
PID 2780 wrote to memory of 2708	2780	msedge.exe	87
PID 2780 wrote to memory of 2708	2780	msedge.exe	87
PID 2780 wrote to memory of 2708	2780	msedge.exe	87
PID 2780 wrote to memory of 2708	2780	msedge.exe	87
PID 2780 wrote to memory of 2708	2780	msedge.exe	87
PID 2780 wrote to memory of 2708	2780	msedge.exe	87
PID 2780 wrote to memory of 2708	2780	msedge.exe	87
PID 2780 wrote to memory of 2708	2780	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb97a646f8,0x7ffb97a64708,0x7ffb97a64718
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,804944590472664390,6329828223228016064,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,804944590472664390,6329828223228016064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,804944590472664390,6329828223228016064,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,804944590472664390,6329828223228016064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,804944590472664390,6329828223228016064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,804944590472664390,6329828223228016064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,804944590472664390,6329828223228016064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4724 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,804944590472664390,6329828223228016064,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,804944590472664390,6329828223228016064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,804944590472664390,6329828223228016064,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,804944590472664390,6329828223228016064,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,804944590472664390,6329828223228016064,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,804944590472664390,6329828223228016064,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2364 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bafce9e4c53a0cb85310891b6b21791b

SHA1
5d70027cc137a7cbb38f5801b15fd97b05e89ee2

SHA256
71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

SHA512
c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a499254d6b5d91f97eb7a86e5f8ca573

SHA1
03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

SHA256
fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

SHA512
d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
ffafa789d09ccb562625377504a5a97a

SHA1
8caf732b74b3707c361e60246512188c5aff2157

SHA256
ad5e0e991148979cdeb827dbe43660e01edf20fa4cd421d9fc7a0b2664c69d29

SHA512
fe59f1c728f0935884b4bcd130dfbe9dd601301b4bed9f2d6bc19eb5643e58334b5e1927b3ba34989e35cfe9a8e3f434f28cc02c8c0fd4e66ae333e654c1e203

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
528B

MD5
524c9acadc8b0b55ee910632c1fc85bd

SHA1
68665dfc276df0a5aaacb0b37b5b12c57f5d2c35

SHA256
049ca1ad9cf155add9751b057a9a0e4980ab7f6f766ceb9c35aacb0565db4f3f

SHA512
3a086ab8721d36b1152bf6f3a917623371db560f222be77c33965828d8ebe7b10156da50bb4d13c20455b23b68217ddcb12bf347cf02b8c187362a63b4f4180b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a7e317a8d69ed3b4520b98c16ad6d3b5

SHA1
88bb7c9f116c2105a73b6339fc504cd227e76467

SHA256
ea663e06106f8a45a6863135f07fe9ecc267ea305a46835f63ad1266e4e3cb88

SHA512
da0da0a854d18acc534ce4f23563bdcc97662269ad58271a591a3864c89ec1a95951c52489c093de667623e7f55dfa8b37cffbc21c7672be7eb47c732f4da0b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
613ce4dd93681e90352fd25c8095b891

SHA1
4c340f9f2d3b3eef5c646603c16cc72b94117742

SHA256
ad70e3c13a2d66704159d435fe2b16df7658addd7c42f0fbbb8a2a8a33feb2ea

SHA512
d1e999067684b1e77dcc8caa48a6eaaab4470673ece8d92adf4f916345442481ff853c63f4e108dacb412e60d873e76e51719d93199d86249f3e162e601f732a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8cad09b38efa4485e56bb58e78fc0c94

SHA1
bafdde4fe315302970f3bfa7dfe9f14b98aef6a5

SHA256
73f1e78df35c736a7af096fb0f6c57610afddefc0ea77934d3ebdd446e9ec0a4

SHA512
5b948c981f94d8399192356669d60236ad0fa25138394110df77f2dc4812a2f7988b3e87378dc6ceaf6650caf57ca5d7ad625d31ec2ebe2f1cd2644bb84402c4

Download Submit