Analysis
-
max time kernel
1680s -
max time network
1694s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
25/08/2024, 09:35
Static task
static1
Behavioral task
behavioral1
Sample
.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
.html
Resource
win11-20240802-en
General
-
Target
.html
-
Size
1KB
-
MD5
84238dfc8092e5d9c0dac8ef93371a07
-
SHA1
4a3ce8ee11e091dd7923f4d8c6e5b5e41ec7c047
-
SHA256
ea8fac7c65fb589b0d53560f5251f74f9e9b243478dcb6b3ea79b5e36449c8d9
-
SHA512
d06b93c883f8126a04589937a884032df031b05518eed9d433efb6447834df2596aebd500d69b8283e5702d988ed49655ae654c1683c7a4ae58bfa6b92f2b73a
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 128 msedge.exe 128 msedge.exe 5476 msedge.exe 5476 msedge.exe 1928 msedge.exe 1928 msedge.exe 3536 identity_helper.exe 3536 identity_helper.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe 5476 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5476 wrote to memory of 1428 5476 msedge.exe 81 PID 5476 wrote to memory of 1428 5476 msedge.exe 81 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 5704 5476 msedge.exe 82 PID 5476 wrote to memory of 128 5476 msedge.exe 83 PID 5476 wrote to memory of 128 5476 msedge.exe 83 PID 5476 wrote to memory of 5956 5476 msedge.exe 84 PID 5476 wrote to memory of 5956 5476 msedge.exe 84 PID 5476 wrote to memory of 5956 5476 msedge.exe 84 PID 5476 wrote to memory of 5956 5476 msedge.exe 84 PID 5476 wrote to memory of 5956 5476 msedge.exe 84 PID 5476 wrote to memory of 5956 5476 msedge.exe 84 PID 5476 wrote to memory of 5956 5476 msedge.exe 84 PID 5476 wrote to memory of 5956 5476 msedge.exe 84 PID 5476 wrote to memory of 5956 5476 msedge.exe 84 PID 5476 wrote to memory of 5956 5476 msedge.exe 84 PID 5476 wrote to memory of 5956 5476 msedge.exe 84 PID 5476 wrote to memory of 5956 5476 msedge.exe 84 PID 5476 wrote to memory of 5956 5476 msedge.exe 84 PID 5476 wrote to memory of 5956 5476 msedge.exe 84 PID 5476 wrote to memory of 5956 5476 msedge.exe 84 PID 5476 wrote to memory of 5956 5476 msedge.exe 84 PID 5476 wrote to memory of 5956 5476 msedge.exe 84 PID 5476 wrote to memory of 5956 5476 msedge.exe 84 PID 5476 wrote to memory of 5956 5476 msedge.exe 84 PID 5476 wrote to memory of 5956 5476 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5476 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffda48f3cb8,0x7ffda48f3cc8,0x7ffda48f3cd82⤵PID:1428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,9690104419630162534,10482413613700682818,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2024 /prefetch:22⤵PID:5704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,9690104419630162534,10482413613700682818,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,9690104419630162534,10482413613700682818,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:82⤵PID:5956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9690104419630162534,10482413613700682818,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵PID:1452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9690104419630162534,10482413613700682818,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:2856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9690104419630162534,10482413613700682818,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:12⤵PID:5512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9690104419630162534,10482413613700682818,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:12⤵PID:5548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2020,9690104419630162534,10482413613700682818,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3888 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9690104419630162534,10482413613700682818,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:1960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,9690104419630162534,10482413613700682818,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:2136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,9690104419630162534,10482413613700682818,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3972 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,9690104419630162534,10482413613700682818,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5600 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1472
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3184
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1992
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d30a5618854b9da7bcfc03aeb0a594c4
SHA17f37105d7e5b1ecb270726915956c2271116eab7
SHA2563494c446aa3cb038f1d920b26910b7fe1f4286db78cb3f203ad02cb93889c1a8
SHA512efd488fcd1729017a596ddd2950bff07d5a11140cba56ff8e0c62ef62827b35c22857bc4f5f5ea11ccc2e1394c0b3ee8651df62a25e66710f320e7a2cf4d1a77
-
Filesize
152B
MD503a56f81ee69dd9727832df26709a1c9
SHA1ab6754cc9ebd922ef3c37b7e84ff20e250cfde3b
SHA25665d97e83b315d9140f3922b278d08352809f955e2a714fedfaea6283a5300e53
SHA512e9915f11e74c1bcf7f80d1bcdc8175df820af30f223a17c0fe11b6808e5a400550dcbe59b64346b7741c7c77735abefaf2c988753e11d086000522a05a0f7781
-
Filesize
5KB
MD566ed4049ca50dabd1c779dbad60ed149
SHA14da89d24471561417067cac4bda5220b097f2712
SHA256be6bdcde1418c59a4cc55b5496beade245c69f5a5da347faa999cc8d4c365199
SHA512e8349b0b80660fd07ea8427cf11dd2e9983d0086a8dadecc784cc40f2530743eb493e2de13b17e825c722e75ca3d4d789fddd8b962c24d1e91354f4137ad9ff4
-
Filesize
5KB
MD58cfee13174d34a9a1279f0ca5743e5d0
SHA1b2897abab77830095f3fdd25bdfe24423b75d131
SHA2567f7017877eb42fabe6ed351fd64e220a75603c6de86db9adde47ad49ee38c28e
SHA51228f538d98b70fc4abf9f9ade101b28a8000a987c4a10c84f70c813ac2867e330f69da702e5032331ed620b73862ed8b0596b8d348634d3c284ac3d92d4dfc4f9
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD5e074b2eece366de40f1f4c8a4061f278
SHA1f15fb652c6094750a85d94dfe7dd8299ed44f651
SHA256c97bfec601b8d72dd7dfc715a66db76c4607373a4bdf34d6d0ccc3447e1407e2
SHA512d55d67f4440b70405fb46c8e6ca22a4aae9ae7737c1378652e297ce75975d39c974aca46b7af8e16d3e7856687af8f6878660d0ac5974bfc596ec7426ba297eb