Analysis

  • max time kernel
    148s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-08-2024 00:40

General

  • Target

    93c2787a64439fa9ffe4946574ecfd2cc524e280c0c80f9a303234dab2c91d6e.html

  • Size

    116KB

  • MD5

    c4158cde4006bdabc91c683587d4377c

  • SHA1

    0e7bdbd2a145cafeff4a26e6b3131df9e83d7c7a

  • SHA256

    93c2787a64439fa9ffe4946574ecfd2cc524e280c0c80f9a303234dab2c91d6e

  • SHA512

    ba42ca4e6624a259d535ce36ac8e0c88e3ecadde7bd4aaff7062749ea6f0bafbe6e8bd7399056959d13a6dec43d2f44e910db027a1a08b8fc2d39e71a76c3bba

  • SSDEEP

    3072:6Lqvj40MZEPjLpUxAfYxslxNcl8CLcXmNRS/1nt0X1nT8CalKw+Q7+cRHqjlyy:6sjXmNR0CalKw+N

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\93c2787a64439fa9ffe4946574ecfd2cc524e280c0c80f9a303234dab2c91d6e.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1240
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc0da46f8,0x7ffcc0da4708,0x7ffcc0da4718
      2⤵
        PID:3556
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,1974790795820730421,12130307231360764262,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
        2⤵
          PID:784
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,1974790795820730421,12130307231360764262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3700
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,1974790795820730421,12130307231360764262,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
          2⤵
            PID:2688
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,1974790795820730421,12130307231360764262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
            2⤵
              PID:2900
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,1974790795820730421,12130307231360764262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
              2⤵
                PID:4948
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,1974790795820730421,12130307231360764262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
                2⤵
                  PID:4324
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,1974790795820730421,12130307231360764262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
                  2⤵
                    PID:4176
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,1974790795820730421,12130307231360764262,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1480
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,1974790795820730421,12130307231360764262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
                    2⤵
                      PID:2976
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,1974790795820730421,12130307231360764262,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
                      2⤵
                        PID:4396
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,1974790795820730421,12130307231360764262,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
                        2⤵
                          PID:3660
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,1974790795820730421,12130307231360764262,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
                          2⤵
                            PID:3944
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,1974790795820730421,12130307231360764262,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3668 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:544
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:3760
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:1048

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              ecf7ca53c80b5245e35839009d12f866

                              SHA1

                              a7af77cf31d410708ebd35a232a80bddfb0615bb

                              SHA256

                              882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

                              SHA512

                              706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              4dd2754d1bea40445984d65abee82b21

                              SHA1

                              4b6a5658bae9a784a370a115fbb4a12e92bd3390

                              SHA256

                              183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

                              SHA512

                              92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              96B

                              MD5

                              b311428d7c0bd460645dcf881f88e055

                              SHA1

                              0033ad40c2ba68705b032079f1cbde2de8d7f225

                              SHA256

                              77d5386176b4bec9e44aa747522b537615f5d4f12c972d9daca71259e32bfc8f

                              SHA512

                              820f1da4624a6239a8cadec472a59e8504bfafff61a708d977ef694c105cfded77e45b17a3807b8af351f30426c47dbb5bb05203c760d5b756698ab42e2a02f2

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              144B

                              MD5

                              a3af8a84d39ec8f0a81a657621c24f55

                              SHA1

                              78097df99db940f301f4a1d92b259cb5cf97ce87

                              SHA256

                              5ca8cd1f7b0e80219fe854a6f7fca563355d1d6d0a1ab79267bc33d1d32a341f

                              SHA512

                              746fd84f3b8e321de31207fdaf4948d50b3fb94383ee262aa2e547c566aceace1a4b1ffbb26e619c8b6ca9164a1a2b4f15e500ff48b7e46c278426e90f96556a

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              670b9b537c004b867291a8034dc3786e

                              SHA1

                              4784bd6934d0d30a1514479af4e3fe0e3818732f

                              SHA256

                              18ab35883d94447266173146282866e7bc9e2346eb8772a960e4b93528d2cdef

                              SHA512

                              4225bb4c1f993fe95e33cbcb115ac9ed333337113eb0b1cb064f1d10ee4585482ed3aace5c9d10855e2cd1f0cc858116961a4ab80eea1369de7529a6bf429c78

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              36356f28a66b7f71fd8106cbb0c59159

                              SHA1

                              4c42ccaed92767c34085e8a0e718f345d31238ce

                              SHA256

                              65fe28df4f29bf967fa3e377e2d583a4971d2201af11acc20186f10571fbb87f

                              SHA512

                              d8dfbc1a4d3932455d5ef592595b3d61c0b248793d20ad48209a1b900cfef03f131032008540d3b0c62b458baa63b3793876edc2cdb242fd49de3d19ce85c7ac

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              5KB

                              MD5

                              32081ec1421134f1faa8d6db65202d47

                              SHA1

                              07e736d14d6275ca416db42eddc5ae0d840390b7

                              SHA256

                              9fa699eb421ac7333035bd51799544c27fbf183e3e79f8f350dcfc2888391890

                              SHA512

                              f2255cebbb9fd427a7b61fddde528dcdae0ff7c90548be741218b4e14749df9c6463c3d04989f04daa6d9e95016bd1b71272a706465f9a7aeebdf4a9ef6455d1

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              7KB

                              MD5

                              5fe7ab669a3f22a1571ec6eed17405af

                              SHA1

                              82eebccd21ec82d435ce227502cfa0dc8cd75c9d

                              SHA256

                              d4767cef76e3fd7a1cacf326ba8a9d7d0a5332e3e00d298f780fe6bc3964c625

                              SHA512

                              9e1ee30356fe15a611a28a5b2bfc812ccd5bed66476c13dcfa610c5e8a1dd3fe85f2a18742534b3bc186585403ee1595f7e08922d9a68237f174f6beb0efba38

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              f2c2381662a7c9bb5e9f4d772bcb862e

                              SHA1

                              4d7ab3a099d2923ea44b76b579555fc623f9a0c9

                              SHA256

                              7ab54e6883a4b13c9c03b6c19a2554a26555065827167e4fc74b13d5248ec3c6

                              SHA512

                              c63e85df44ada304db6bf104a68c21b6adef7137898172bfbdd00062eef344aefd67c0a937309c98acc68116f236713666e30f499a68b7874b1191c2cf62038d

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              7KB

                              MD5

                              d2e4fb52244da06f10cc13436cb5dabd

                              SHA1

                              201716442a282cda42470a10aba9fbdb123705f4

                              SHA256

                              265ae2a58c2ef58d3ea83cf10ec81566ed006d96d7fc8a76c517f328acc61d7c

                              SHA512

                              955741415ac333b7f014c6aefc583f152bb7494b842c8553efb398da979e9cbebeab0be25cd0d678a334ccfe2c5e7405fb24b239f6374569ce370db535c694b9

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              6752a1d65b201c13b62ea44016eb221f

                              SHA1

                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                              SHA256

                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                              SHA512

                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                              Filesize

                              10KB

                              MD5

                              acbc519ba01d07ceda2fa928eb0dc112

                              SHA1

                              04786dffea0fb29315b9b08e48f7bf4440db8a35

                              SHA256

                              e6449de74f652379afc870498b4d4fcd0d312b91a8be0500384dd551646c02f7

                              SHA512

                              9c94533f4859a464919ddddcfe1bef4e0c1e7e4589287986ac6200baac84fd9786f5c433e60a2266d735c473ebcc976cb052cd3cf60d89b41b6b2a6d4d618de3

                            • \??\pipe\LOCAL\crashpad_1240_QBPCXZVQPEGXLGLK

                              MD5

                              d41d8cd98f00b204e9800998ecf8427e

                              SHA1

                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                              SHA256

                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                              SHA512

                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e