578a8366ae9f6bcfa8f3717f04dee6609542bb22f26ed9050a4589d630873ab1

Analysis

max time kernel
112s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 18:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

266b7011dbb101056750a25428797780N.html
Size

211KB
MD5

266b7011dbb101056750a25428797780
SHA1

024c522acd1328730fe3e9934b1ecf351a92ff0c
SHA256

578a8366ae9f6bcfa8f3717f04dee6609542bb22f26ed9050a4589d630873ab1
SHA512

bc52e461cb84a2149dac616c58eaa18e54c316cdde4f0da9b963c46fe89f2d5655dbd66cf3f0be1e22cfe34cc567e941b51eeb609bcb2ecf9f48245e585f97f5
SSDEEP

1536:6MjEi6Ki2UVDM21glPOEU/IUUA1QKZnUi9+vew+iveyXMXEbXEuXE7XEMXE1XrXl:D4/WI72

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe
2164	msedge.exe
2164	msedge.exe
3128	identity_helper.exe
3128	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe
2164	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 5088	2164	msedge.exe	88
PID 2164 wrote to memory of 5088	2164	msedge.exe	88
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 3844	2164	msedge.exe	89
PID 2164 wrote to memory of 2432	2164	msedge.exe	90
PID 2164 wrote to memory of 2432	2164	msedge.exe	90
PID 2164 wrote to memory of 4612	2164	msedge.exe	91
PID 2164 wrote to memory of 4612	2164	msedge.exe	91
PID 2164 wrote to memory of 4612	2164	msedge.exe	91
PID 2164 wrote to memory of 4612	2164	msedge.exe	91
PID 2164 wrote to memory of 4612	2164	msedge.exe	91
PID 2164 wrote to memory of 4612	2164	msedge.exe	91
PID 2164 wrote to memory of 4612	2164	msedge.exe	91
PID 2164 wrote to memory of 4612	2164	msedge.exe	91
PID 2164 wrote to memory of 4612	2164	msedge.exe	91
PID 2164 wrote to memory of 4612	2164	msedge.exe	91
PID 2164 wrote to memory of 4612	2164	msedge.exe	91
PID 2164 wrote to memory of 4612	2164	msedge.exe	91
PID 2164 wrote to memory of 4612	2164	msedge.exe	91
PID 2164 wrote to memory of 4612	2164	msedge.exe	91
PID 2164 wrote to memory of 4612	2164	msedge.exe	91
PID 2164 wrote to memory of 4612	2164	msedge.exe	91
PID 2164 wrote to memory of 4612	2164	msedge.exe	91
PID 2164 wrote to memory of 4612	2164	msedge.exe	91
PID 2164 wrote to memory of 4612	2164	msedge.exe	91
PID 2164 wrote to memory of 4612	2164	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\266b7011dbb101056750a25428797780N.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa06a46f8,0x7ffaa06a4708,0x7ffaa06a4718
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,13388288505210971640,11304253408752815510,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,13388288505210971640,11304253408752815510,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,13388288505210971640,11304253408752815510,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13388288505210971640,11304253408752815510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13388288505210971640,11304253408752815510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,13388288505210971640,11304253408752815510,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,13388288505210971640,11304253408752815510,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13388288505210971640,11304253408752815510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13388288505210971640,11304253408752815510,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13388288505210971640,11304253408752815510,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13388288505210971640,11304253408752815510,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:3476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
8589d5b8be6f67e3d50c1b043e258bcf

SHA1
5b05ddd7e4f19e03b44f124dc77b71e242660244

SHA256
3d2533305c87f31d07aa1a38602d8bba811bc11fe8edb06cc0e91000c5a02f19

SHA512
454ab337310e3847973f521848f0a05822b8b1ee973bbf37f29f8caed8ab61932b58c252f81e86f91a3c37138a8b295c81c37cfc0adb92aad8580b0dd8c8a264

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
697B

MD5
b0e6bce25897a1fd8182f4104d8e1a41

SHA1
c63fe3786fe3907d0af13f788c8f9665a5a526ed

SHA256
6fd1e302491e38ee8915acff83e0df34acabd3411bcb39757bc05cd8ee6cda17

SHA512
a0746014fe48e0fe5b52131c6b0a6141df66f8ea590be2c63df4cbaa981f0c51b8f52e5237938d5b0d9a6f211444cc47a3aa390d725afdc096513f84588a3af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0a14a74d9b50395c558132ac4a6f0c9f

SHA1
8840eef4c09efd1ed2da01ee3870aaffcbd1bb83

SHA256
8a82551c9d6d1ca0ed04b8e4e4c11c32446e246e47df6b3eb7c9b3ba95403ea7

SHA512
8fdc50a4f84df7ee01cded24f76a3d9d115e51e0f3104b2a889c3da68270bfe413b995dc24851e6e8054f6fa800afb38a5d87a9ea9c2762028b2fafced09ef1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f133b5191084f6379826ed13562a164b

SHA1
436f97d4206e5068c91d65ee9e6fdcd9819c283e

SHA256
e3f94ac5bd5064f91b0bf3d0787aa4f1198a8d92a5d0ffc78590042753dd6447

SHA512
e7867b345c5a0360f60b0318e4fa00b5d1f50da5b4aa963c7cefd718f6a314abcb19dcf812160c3c3b02f05c172e0cf07cfd57af6eb60b30c48c6ddac888b10c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
598f1f0aa82adfb67813cbbf979aa6be

SHA1
49b9875461f021f513fbfe371fa2187ad189479c

SHA256
1a03e19b1f9874835a5d90bb0f3ba681c2c82de585c5c176393dd362e2dd4328

SHA512
fbca62c5d50e2719a32c0530f2348efd1e8cfe8fd081db9d93a272119775247595534b621b096010112deb21d9568667d11fdaf5c96a8ae2415344f5bd0f200a

Download Submit