a3f77577e0a49969003434d50701fee4dde125c21fc86e0fc67717ce6655fbf6

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2024, 18:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3f77577e0a49969003434d50701fee4dde125c21fc86e0fc67717ce6655fbf6.html
Size

15KB
MD5

d7b2e25cac9429bf145979c0a6f5aebb
SHA1

d2a0533996e4a303ad041371d9002462786d6ce5
SHA256

a3f77577e0a49969003434d50701fee4dde125c21fc86e0fc67717ce6655fbf6
SHA512

1e6d09137d457767879329dbd89af4e239698bd88c670e9f5cc28bd017bd1fe35a76b49684ca9e2b02b449a94842ce92aa17b3103b88164e1bfd9f65cb419d04
SSDEEP

192:vqScTgz+2R7mh9wHQhPLBrWbQoR6ZNadFH:ji2R7BHQhPNrWYSZ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4424	msedge.exe
4424	msedge.exe
3980	msedge.exe
3980	msedge.exe
264	identity_helper.exe
264	identity_helper.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 1632	3980	msedge.exe	83
PID 3980 wrote to memory of 1632	3980	msedge.exe	83
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 1196	3980	msedge.exe	84
PID 3980 wrote to memory of 4424	3980	msedge.exe	85
PID 3980 wrote to memory of 4424	3980	msedge.exe	85
PID 3980 wrote to memory of 704	3980	msedge.exe	86
PID 3980 wrote to memory of 704	3980	msedge.exe	86
PID 3980 wrote to memory of 704	3980	msedge.exe	86
PID 3980 wrote to memory of 704	3980	msedge.exe	86
PID 3980 wrote to memory of 704	3980	msedge.exe	86
PID 3980 wrote to memory of 704	3980	msedge.exe	86
PID 3980 wrote to memory of 704	3980	msedge.exe	86
PID 3980 wrote to memory of 704	3980	msedge.exe	86
PID 3980 wrote to memory of 704	3980	msedge.exe	86
PID 3980 wrote to memory of 704	3980	msedge.exe	86
PID 3980 wrote to memory of 704	3980	msedge.exe	86
PID 3980 wrote to memory of 704	3980	msedge.exe	86
PID 3980 wrote to memory of 704	3980	msedge.exe	86
PID 3980 wrote to memory of 704	3980	msedge.exe	86
PID 3980 wrote to memory of 704	3980	msedge.exe	86
PID 3980 wrote to memory of 704	3980	msedge.exe	86
PID 3980 wrote to memory of 704	3980	msedge.exe	86
PID 3980 wrote to memory of 704	3980	msedge.exe	86
PID 3980 wrote to memory of 704	3980	msedge.exe	86
PID 3980 wrote to memory of 704	3980	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a3f77577e0a49969003434d50701fee4dde125c21fc86e0fc67717ce6655fbf6.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd2db746f8,0x7ffd2db74708,0x7ffd2db74718
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,15641170236009586264,7890655644418567150,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,15641170236009586264,7890655644418567150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,15641170236009586264,7890655644418567150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15641170236009586264,7890655644418567150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15641170236009586264,7890655644418567150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,15641170236009586264,7890655644418567150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,15641170236009586264,7890655644418567150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15641170236009586264,7890655644418567150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15641170236009586264,7890655644418567150,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15641170236009586264,7890655644418567150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15641170236009586264,7890655644418567150,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,15641170236009586264,7890655644418567150,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4872 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
784B

MD5
89f362c5b102d68c7f7965d2fc89021e

SHA1
55807b56f5603d3be12211ec6f478cf21a436814

SHA256
54cc51cd6c2fd6d324b06f78fbd87dc61d2cc6475ba3283df6f53e978e3a6612

SHA512
8d652101f2a642b4ddfe3e869bf14b91e0c4d4ac5409f143ff8dda61a67d956488e3c87b1198c381fbd82c3f7df804d8aa4438082378b404a87a86592f53a10a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
733ecadf1218268b6416dd549fc337df

SHA1
bb39d857b44b95c9df509d8afa44d0b0d613b6aa

SHA256
0cbca851929bd3e3123f5316311a621e32a6cc13ad8b00bba9544567d68dd467

SHA512
20fb58f3ba97c335a6901110bb26e47bae82a603c45362814bc1517d42d036774940b302a85bde944959864027e9a95105a307a6bef53189abc936e518bbb1ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5c6201250f776e033fd2eb2c87107e02

SHA1
8a262822323980524f1b9abf7398aa1f1796c825

SHA256
75584bcd61ef73b7a3109557073d76136d70d41ae6a16bfc8c980194781795a4

SHA512
857980188a04421e25247edb42ec4bd686dbb33427679ce6bfabd0d275d9ce4749d36ae1f6b7aa94e15abf1445091ea838ae4382be6bdc52f5c26fcc5178a4cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b57982f35b689020d2c82ca8c0d8b1b7

SHA1
09b2a5f55316ed777626f652ba3bd529c5cef7ec

SHA256
c5487d23f1f6e42a75b6b5f425895c317aafaa7c2437ae1a4caf5a8b84fd406b

SHA512
2fbeb22d8620e29ed02b719eb3e3085f05c3343365383bcdfccd13aecb84fb515d92a087aec9a47631e7215f3759ca471dd65086dd9ae4b7e5aabe973aba27ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
99a262ec9f6923752c2801ec931da767

SHA1
80ed1d674de2e27c02f69630438964c4a0f6f396

SHA256
11e90040050d26e268089ecdbdd70255311a983242d49fa14f187da5b570cb00

SHA512
b6832a5b376b2eeadeef430537dad59da6c6953f18bcf455d736682ae03668b8281da8474fd0022a4ba7132b48c3eaa50131a3ebda6f3ca1d809cbe4a201e0c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580450.TMP

Filesize
538B

MD5
4cb754f9f14a9bb55a11e0c37b208f26

SHA1
dd758dd7dc91c3648a9a7d944f41e0cb8cc32b67

SHA256
5ef9bb049c421dbcb6c75f54023aed6568ea3db142e7a863c4c06a9456d92fa5

SHA512
615a7ad65bceebdf33eab18072bed5d5389b008a6ab3488e9bb37722791ac059a536efd8a8454aad09a1a36f9056e1236c42c64cbec3d97aa074d73c03203ec0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
de8152b724ed24f45ff2097e92e0ef67

SHA1
a9a2bb3a417abcaafcea60e3427df12696535d06

SHA256
5011921dd1a9a4fcf84fa1c2c6a1a0bd746d0957dc04aeedf2d46aefeb92a87d

SHA512
f9434d354b1405307d8acafd22d9267ad82f22421dbfa1b240fc3a887b153abc6ecdc4b6b7244ab506f3e157d5b34b2cd82cadbe1a957d17f9fb9c8897438823

Download Submit