Analysis
-
max time kernel
145s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27-08-2024 19:00
Static task
static1
Behavioral task
behavioral1
Sample
32f2fa940d4b4fe19aca1e53a24e5aac29c57b7c5ee78588325b87f1b649c864.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
32f2fa940d4b4fe19aca1e53a24e5aac29c57b7c5ee78588325b87f1b649c864.html
Resource
win10v2004-20240802-en
General
-
Target
32f2fa940d4b4fe19aca1e53a24e5aac29c57b7c5ee78588325b87f1b649c864.html
-
Size
146B
-
MD5
9fe3cb2b7313dc79bb477bc8fde184a7
-
SHA1
4d7b3cb41e90618358d0ee066c45c76227a13747
-
SHA256
32f2fa940d4b4fe19aca1e53a24e5aac29c57b7c5ee78588325b87f1b649c864
-
SHA512
c54ad4f5292784e50b4830a8210b0d4d4ee08b803f4975c9859e637d483b3af38cb0436ac501dea0c73867b1a2c41b39ef2c27dc3fb20f3f27519b719ea743db
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 2204 msedge.exe 2204 msedge.exe 2996 msedge.exe 2996 msedge.exe 1300 identity_helper.exe 1300 identity_helper.exe 3552 msedge.exe 3552 msedge.exe 3552 msedge.exe 3552 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 2996 wrote to memory of 1436 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 1436 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 3720 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 2204 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 2204 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 1968 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 1968 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 1968 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 1968 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 1968 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 1968 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 1968 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 1968 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 1968 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 1968 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 1968 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 1968 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 1968 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 1968 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 1968 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 1968 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 1968 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 1968 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 1968 2996 msedge.exe msedge.exe PID 2996 wrote to memory of 1968 2996 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\32f2fa940d4b4fe19aca1e53a24e5aac29c57b7c5ee78588325b87f1b649c864.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9687b46f8,0x7ff9687b4708,0x7ff9687b47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,7409647323400723692,9120524623088207330,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,7409647323400723692,9120524623088207330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,7409647323400723692,9120524623088207330,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7409647323400723692,9120524623088207330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7409647323400723692,9120524623088207330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,7409647323400723692,9120524623088207330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,7409647323400723692,9120524623088207330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7409647323400723692,9120524623088207330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7409647323400723692,9120524623088207330,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7409647323400723692,9120524623088207330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7409647323400723692,9120524623088207330,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,7409647323400723692,9120524623088207330,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5172 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5d7114a6cd851f9bf56cf771c37d664a2
SHA1769c5d04fd83e583f15ab1ef659de8f883ecab8a
SHA256d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e
SHA51233bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5719923124ee00fb57378e0ebcbe894f7
SHA1cc356a7d27b8b27dc33f21bd4990f286ee13a9f9
SHA256aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808
SHA512a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5af74df52a0ba73a6cc11b13ade1d07d0
SHA19dfef51114092340318d2d1060481f3f465d6e7c
SHA256b56501a31181b3cf2f49b4e6aeae5f6a3ca45fb2d1923808e2312d02434ab0b9
SHA512c3a1feae744c9b78551109e31a61ec95a072ec34625eb277ab4dc24560e18005eb8478281db820fd5043ac11e9a97fa6d0362e0b86d02919098b0b1aa251a719
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD52f2b31483830064ac8de99d8ce72bcf0
SHA1e62297a924332cbb4198dca9082d997b65d6d8b0
SHA25698285206aae66d99a4f52fea7fbbec56a8d526349f8c924efd26e038ad0d8888
SHA512e9a751cffbfe48e606896b987a664c838af760f1184a6da0d975b6e7d036a58b3ff4da67bbc0dc01f7cc2c8f4bb92cb91ba3e0495e62f3737ed4af2507cc31b2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5bcfff26fd4cb9a7c938b382e4c0d49eb
SHA154fea61d40d4c0f0222c16da3969b807118b319b
SHA256d4a1e8adc71fee4ce987208c238c47f095ffcf373edad55af76304f7f713c1b6
SHA512f48f564c4cf6a2fe2f79ac5c8ec5f8011bf2181d902cae15027e91634b7d228cb8298e24fec31eb523826e14453fe449cbb329648d6da1abd0b5d01869c6956f
-
\??\pipe\LOCAL\crashpad_2996_ICWFDYXFPSXVFGCOMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e