5f270bde61bda98c881522139e5a051120bfbd987d4d891688dfe8ab816f0935

Analysis

max time kernel
30s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-08-2024 18:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

download.html
Size

2KB
MD5

0ff92da363760dc25a07b28cf9532d22
SHA1

18ef1afeccf83e424e10623526f8156211d3aec4
SHA256

5f270bde61bda98c881522139e5a051120bfbd987d4d891688dfe8ab816f0935
SHA512

0ca528857c4c3966c2a1cb6eba9ad75d91624f408f1e982613d949052fbc26ecba6fe8004533eb52ce6de664afefac4ed64dc6b7b40b9beed6f32ea1851ee50f

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2312	msedge.exe
2312	msedge.exe
60	msedge.exe
60	msedge.exe
4272	identity_helper.exe
4272	identity_helper.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
652	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 60 wrote to memory of 3796	60	msedge.exe	86
PID 60 wrote to memory of 3796	60	msedge.exe	86
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2396	60	msedge.exe	87
PID 60 wrote to memory of 2312	60	msedge.exe	88
PID 60 wrote to memory of 2312	60	msedge.exe	88
PID 60 wrote to memory of 4784	60	msedge.exe	89
PID 60 wrote to memory of 4784	60	msedge.exe	89
PID 60 wrote to memory of 4784	60	msedge.exe	89
PID 60 wrote to memory of 4784	60	msedge.exe	89
PID 60 wrote to memory of 4784	60	msedge.exe	89
PID 60 wrote to memory of 4784	60	msedge.exe	89
PID 60 wrote to memory of 4784	60	msedge.exe	89
PID 60 wrote to memory of 4784	60	msedge.exe	89
PID 60 wrote to memory of 4784	60	msedge.exe	89
PID 60 wrote to memory of 4784	60	msedge.exe	89
PID 60 wrote to memory of 4784	60	msedge.exe	89
PID 60 wrote to memory of 4784	60	msedge.exe	89
PID 60 wrote to memory of 4784	60	msedge.exe	89
PID 60 wrote to memory of 4784	60	msedge.exe	89
PID 60 wrote to memory of 4784	60	msedge.exe	89
PID 60 wrote to memory of 4784	60	msedge.exe	89
PID 60 wrote to memory of 4784	60	msedge.exe	89
PID 60 wrote to memory of 4784	60	msedge.exe	89
PID 60 wrote to memory of 4784	60	msedge.exe	89
PID 60 wrote to memory of 4784	60	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\download.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8b22a46f8,0x7ff8b22a4708,0x7ff8b22a4718
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,8515684569064706281,8902649707975442141,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,8515684569064706281,8902649707975442141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,8515684569064706281,8902649707975442141,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8515684569064706281,8902649707975442141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8515684569064706281,8902649707975442141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8515684569064706281,8902649707975442141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,8515684569064706281,8902649707975442141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,8515684569064706281,8902649707975442141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8515684569064706281,8902649707975442141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8515684569064706281,8902649707975442141,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8515684569064706281,8902649707975442141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8515684569064706281,8902649707975442141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8515684569064706281,8902649707975442141,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
  2⤵
  PID:3984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fe9374a8fed79c455a5bf79cf27e0a69

SHA1
60b28f61d2a146d08bf7898220c3f412fc3aefa3

SHA256
5cbb124579138cb00eff0e429ba099defd8b122da37598d7f4b34710f681cde6

SHA512
f971549c460284a9025d24e7738a621d1c8d9c2ec7ef76e3d8ab1075f9fa83c8652e16bdcfe227a1fe667a77b2a0ad67b9088d482badda28f3ff476e04feb3d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
87405ca62473e5bbbec165feb0c1d45d

SHA1
2fc6be0fa4b18a8310dd1b18537a447a7dfbf04a

SHA256
6e65b5e5855dd6d9b8f3e01c9cce4e53954a09c5e9cabe88bae111a7663ac3c5

SHA512
317373ee2dea919264a8deb0d9751c0cd5c0316cbfa14424ce5320ea974c0cf1f4682d410adb96e00587f599c9c8f16eb33d5ac8a0b3303e36638ebded68d04a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6e9e7fddef9554d4fbf3b284df80eb6d

SHA1
4e5e04fcebe3de517bf553a02b10416f61e0a99f

SHA256
b798528d3ece0fe9bcfaa305a81b7a0ace5f7f7a43553f58d7b4dc93e7fd7be4

SHA512
f411d3033186e13272adcfec2a29776c7104f3e964559d84b67919969bfdb01c5450b2d53f34ea01b0a4c1c4582ab574c68bb3f3adb22b437227f10a0ca3341c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4e282b8545eaef9f986654177a7f8f84

SHA1
08b0ab305011cd2625b66809a6194af4605eda0c

SHA256
472f4a25178ad31b5531f574e4656ee919db459e1081aa2be2cb5b2707f1ebd0

SHA512
3a3754b084f00d745c5533debf1a2a477d3673d7551828c8749733a8a60d2e5bcff81952f84fc880c690efafaf8da054fdf56e66f2f1e6006a84dcd686068ad9

Download Submit