d9bded210a496305c2d35f1cba1b7322824046d91620799d32e05296e002aba2

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2024, 15:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d9bded210a496305c2d35f1cba1b7322824046d91620799d32e05296e002aba2.html
Size

312KB
MD5

0bb84eaf0ecce587e9df501dfac2a45c
SHA1

c51c2c58ce1946d19c52c25ad1918fabff9ffa13
SHA256

d9bded210a496305c2d35f1cba1b7322824046d91620799d32e05296e002aba2
SHA512

454135e4e518fabb8816e55fc9db4dd73a90bcb155f5c74c0804e682ceff5346fbf1d26f911b364d54df705da08ba34571b34eb0964b76f84c41a9eed714e858
SSDEEP

3072:MivgAkHnjPIQ6KSEc/AH5PaW+LN7DxRLlzglKHVf+k:7gAkHnjPIQBSEtZPCN7jBHVf+k

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
4916	msedge.exe
4916	msedge.exe
1864	identity_helper.exe
1864	identity_helper.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 3708	4916	msedge.exe	83
PID 4916 wrote to memory of 3708	4916	msedge.exe	83
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 1788	4916	msedge.exe	84
PID 4916 wrote to memory of 4692	4916	msedge.exe	85
PID 4916 wrote to memory of 4692	4916	msedge.exe	85
PID 4916 wrote to memory of 3376	4916	msedge.exe	86
PID 4916 wrote to memory of 3376	4916	msedge.exe	86
PID 4916 wrote to memory of 3376	4916	msedge.exe	86
PID 4916 wrote to memory of 3376	4916	msedge.exe	86
PID 4916 wrote to memory of 3376	4916	msedge.exe	86
PID 4916 wrote to memory of 3376	4916	msedge.exe	86
PID 4916 wrote to memory of 3376	4916	msedge.exe	86
PID 4916 wrote to memory of 3376	4916	msedge.exe	86
PID 4916 wrote to memory of 3376	4916	msedge.exe	86
PID 4916 wrote to memory of 3376	4916	msedge.exe	86
PID 4916 wrote to memory of 3376	4916	msedge.exe	86
PID 4916 wrote to memory of 3376	4916	msedge.exe	86
PID 4916 wrote to memory of 3376	4916	msedge.exe	86
PID 4916 wrote to memory of 3376	4916	msedge.exe	86
PID 4916 wrote to memory of 3376	4916	msedge.exe	86
PID 4916 wrote to memory of 3376	4916	msedge.exe	86
PID 4916 wrote to memory of 3376	4916	msedge.exe	86
PID 4916 wrote to memory of 3376	4916	msedge.exe	86
PID 4916 wrote to memory of 3376	4916	msedge.exe	86
PID 4916 wrote to memory of 3376	4916	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d9bded210a496305c2d35f1cba1b7322824046d91620799d32e05296e002aba2.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb34c46f8,0x7ffcb34c4708,0x7ffcb34c4718
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,10551378768982871363,12184947791914336409,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,10551378768982871363,12184947791914336409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,10551378768982871363,12184947791914336409,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10551378768982871363,12184947791914336409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10551378768982871363,12184947791914336409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,10551378768982871363,12184947791914336409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3772 /prefetch:8
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,10551378768982871363,12184947791914336409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10551378768982871363,12184947791914336409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10551378768982871363,12184947791914336409,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10551378768982871363,12184947791914336409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10551378768982871363,12184947791914336409,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,10551378768982871363,12184947791914336409,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2664 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f0d1dd962d26e108b66c507caea34188

SHA1
e8b9611ba5e4058e151683c36130ea4af37fb9b5

SHA256
0f1f9811def13224b291d8eaeed7bdd6f876866e0191a33e9ca39074972da698

SHA512
5092e6208ac78ff0b2629f41bbc359c73efb23729b8a2fe7012821b256a00a34f344e12a749622c8e7c91984735e82eadd72ce7d1f8744ea47d180f87b7885e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b02e35997927495a912925d25af0394f

SHA1
f63cdf8b732ca0b3582bec0f3824c6813cbfd6c4

SHA256
82b1366366043acc25af553fa8d031a1c945b71887c9ec841387120809a5b700

SHA512
c67ffb20d144739b1e7357960162eeb17d1d69f43ae26caaef835500723e3cc414942fb2c7a0848f72c600ec5ea90f8d3bfee080e9c5203806fd919af0955bba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c833a0fb13521d30169038033240fd60

SHA1
518f922202124ba806a64ed6d6849b2aea18d0ec

SHA256
b24fabba0ecbe912cc64456e28829d875e2e3e7d7acdad9a3f630338da437d23

SHA512
de00ed472324fda369af7e9a7a16330bd50f54a3d591ec8f23b242a73d8a3ee58848490018c0033f9ff3d6d028cef2101a7b30fb476ad7a5839a16f85e85f581

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5bc6d5f8406c782e9e6dca6067e923c3

SHA1
62efd9c18e8325a1669598fccab37b416bc828e6

SHA256
a8f40dd2bdf2e5d0ab7a858a9edfe3e003fcab14cb7257b07d182f71c5a5ed14

SHA512
57cde1ad91f4f580056b271bf2f3c9511dc8373d38658bf5c8c43d401b0fd2ff3fd3e36d4f753b3e1619d0511f2e02225196daa43eae6be9083fef784728d6b8

Download Submit