e3082c464b8cdb188c837e3392342acd4c6e977350ddc923a158cca66030177b

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/08/2024, 06:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

117KB
MD5

4668dddadc6292071c8568d80ebf02c3
SHA1

07f2f83494efca5d74f509057e28778904c86d83
SHA256

e3082c464b8cdb188c837e3392342acd4c6e977350ddc923a158cca66030177b
SHA512

7cb70ea8b439066930de15f9dad40d1c61e6481b84ce8c51b23b2a7ee09ff9b47d169853b874783a47c50b641c1cb66d93009b30a5d070f1029e6b3ed4b4c44b
SSDEEP

3072:UWptsFWBDJZrFR9+8KVPUenT7nIP866sgNpXn:UWDsFWBDJZrFR9+9PUenT7nIP8DNln

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3736	msedge.exe
3736	msedge.exe
4396	identity_helper.exe
4396	identity_helper.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 3240	3736	msedge.exe	83
PID 3736 wrote to memory of 3240	3736	msedge.exe	83
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 4856	3736	msedge.exe	84
PID 3736 wrote to memory of 3516	3736	msedge.exe	85
PID 3736 wrote to memory of 3516	3736	msedge.exe	85
PID 3736 wrote to memory of 4092	3736	msedge.exe	86
PID 3736 wrote to memory of 4092	3736	msedge.exe	86
PID 3736 wrote to memory of 4092	3736	msedge.exe	86
PID 3736 wrote to memory of 4092	3736	msedge.exe	86
PID 3736 wrote to memory of 4092	3736	msedge.exe	86
PID 3736 wrote to memory of 4092	3736	msedge.exe	86
PID 3736 wrote to memory of 4092	3736	msedge.exe	86
PID 3736 wrote to memory of 4092	3736	msedge.exe	86
PID 3736 wrote to memory of 4092	3736	msedge.exe	86
PID 3736 wrote to memory of 4092	3736	msedge.exe	86
PID 3736 wrote to memory of 4092	3736	msedge.exe	86
PID 3736 wrote to memory of 4092	3736	msedge.exe	86
PID 3736 wrote to memory of 4092	3736	msedge.exe	86
PID 3736 wrote to memory of 4092	3736	msedge.exe	86
PID 3736 wrote to memory of 4092	3736	msedge.exe	86
PID 3736 wrote to memory of 4092	3736	msedge.exe	86
PID 3736 wrote to memory of 4092	3736	msedge.exe	86
PID 3736 wrote to memory of 4092	3736	msedge.exe	86
PID 3736 wrote to memory of 4092	3736	msedge.exe	86
PID 3736 wrote to memory of 4092	3736	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd76d846f8,0x7ffd76d84708,0x7ffd76d84718
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,17830326258432534843,1605607965433510783,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,17830326258432534843,1605607965433510783,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,17830326258432534843,1605607965433510783,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17830326258432534843,1605607965433510783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17830326258432534843,1605607965433510783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17830326258432534843,1605607965433510783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,17830326258432534843,1605607965433510783,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,17830326258432534843,1605607965433510783,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17830326258432534843,1605607965433510783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17830326258432534843,1605607965433510783,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17830326258432534843,1605607965433510783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,17830326258432534843,1605607965433510783,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,17830326258432534843,1605607965433510783,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1292 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
5baa142bf3c459ba8dd07d320204a128

SHA1
66c6318bb1cb3e860c6fdcd022bb73876a0d6353

SHA256
0a3a0b61421f5ecd32059f5c689806a582d733f4af4265f3e0607e494b73d38e

SHA512
a419508e8b055d15ef6801f8930454769f94492236a9bf53cbb15b216f1086236fad1a6ce603f9d8e86947b4d1904f356451b6fa7fc60f782a79537decb07c70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
720B

MD5
db06452844bf4f1285c1fded0544718e

SHA1
c17003e6dc63b22a6f0375f1ab47459a50b2305d

SHA256
0ea6a194b199c569e1ba86f088d6f2bd151b0ad38336a29477faf470f43740e0

SHA512
d938318adee058821b1f438c57f15f8395f62b231f64289b8ab94bceb3248bec90db7c215b61c154549af4ccb6d40345451011c2c19ea6215338d1213163bbe6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b38baa0237f0273d2b9072b594ce1e1c

SHA1
af342acdeaad6a29d237e16520868f193e69c50a

SHA256
ad8028baa06265b9cad2409ce1d81353c6eec95c2654d82b700bb350c78b0ceb

SHA512
8e02f20852634d1d3ec78b8dab5a3114c2785f80e62b29ef98417751cba9c9354e679df3ec3160da55a2e5719568eb32816190503ae1972fd28bbd5991a66b6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
09db7f3ae324f1c20c3fa69d3f527d73

SHA1
bc1385a39b275094ff2a24f796bfdf5413e39e7d

SHA256
5842a2645366a369c61dcbda887599beba6b5a47d5aa452fc2d730d5d1782284

SHA512
13e7cf88f0010e8272c67be1d5948bc2ec2a7326593f27b4fa4291302e2808d3b6c69a7fb8fa9c978aa9ef37951468b8622b34887eb9ba0c9586d6f7c8264d87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b25723a5076b912f0027f538f9938893

SHA1
0f8ee1445c597228977035bcb2eb38109943d66a

SHA256
08a2a920e88bd86a36fdf8fff01ebf49d86a1e3036c2a16663665598104dec62

SHA512
03e8f1fa236dda87cd6516d4db567652f196c7de4f202f1ddbc87c91382916b06b80194d83295f29f3a0e2052865c3f10dc63df5651e254460ff941078338909

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5846bfec5579dbbd5cd2905447b46943

SHA1
2f2a04faed0872c626198503e131da06dfde3cb5

SHA256
6d476837311e8b123141097eab1fbc10e64975306d856f02fa7416e4b83807fe

SHA512
016c91ac3532495dd78e82e525222a28b01c71c2fb459d345e01c07ed59ed34e75bc4fec64bda3512be32bb030d9e9ebc0469b1700ee8bed5b0cc1f0b7c6e2b8

Download Submit