5e38943f03dc7069d59d6c57c2e590bfe8225b5ba82525ebf55a46a7c6498891

Analysis

max time kernel
149s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-09-2024 13:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1fd9ecf21a1532d7fbde1fa66553c487b02b4d6ce93e3f6bdd9656593ebc8a3.html
Size

21KB
MD5

7f68be45ffd871415c647173937c4241
SHA1

4d0a23d511ff7be5fa17a846ec84866e2bb24fd3
SHA256

b1fd9ecf21a1532d7fbde1fa66553c487b02b4d6ce93e3f6bdd9656593ebc8a3
SHA512

a54f1aa53fab3fdfd5922eb4116652c4e326f8b53d7555fa41c0eee67b890a345809b82914a2353fcaa337a6c20e099db512faabcab8ae5d5daff27202b16b17
SSDEEP

384:SMgs+48qlW9P0TZ0n/BoHEQjIA9n+x5uWY6loodHyQ/SrlDSWjIbA:Sq+enyZUzV+TuWY6XdP/UjIbA

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3836	msedge.exe
3836	msedge.exe
3720	msedge.exe
3720	msedge.exe
2452	identity_helper.exe
2452	identity_helper.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 2000	3720	msedge.exe	84
PID 3720 wrote to memory of 2000	3720	msedge.exe	84
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3760	3720	msedge.exe	85
PID 3720 wrote to memory of 3836	3720	msedge.exe	86
PID 3720 wrote to memory of 3836	3720	msedge.exe	86
PID 3720 wrote to memory of 3232	3720	msedge.exe	87
PID 3720 wrote to memory of 3232	3720	msedge.exe	87
PID 3720 wrote to memory of 3232	3720	msedge.exe	87
PID 3720 wrote to memory of 3232	3720	msedge.exe	87
PID 3720 wrote to memory of 3232	3720	msedge.exe	87
PID 3720 wrote to memory of 3232	3720	msedge.exe	87
PID 3720 wrote to memory of 3232	3720	msedge.exe	87
PID 3720 wrote to memory of 3232	3720	msedge.exe	87
PID 3720 wrote to memory of 3232	3720	msedge.exe	87
PID 3720 wrote to memory of 3232	3720	msedge.exe	87
PID 3720 wrote to memory of 3232	3720	msedge.exe	87
PID 3720 wrote to memory of 3232	3720	msedge.exe	87
PID 3720 wrote to memory of 3232	3720	msedge.exe	87
PID 3720 wrote to memory of 3232	3720	msedge.exe	87
PID 3720 wrote to memory of 3232	3720	msedge.exe	87
PID 3720 wrote to memory of 3232	3720	msedge.exe	87
PID 3720 wrote to memory of 3232	3720	msedge.exe	87
PID 3720 wrote to memory of 3232	3720	msedge.exe	87
PID 3720 wrote to memory of 3232	3720	msedge.exe	87
PID 3720 wrote to memory of 3232	3720	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b1fd9ecf21a1532d7fbde1fa66553c487b02b4d6ce93e3f6bdd9656593ebc8a3.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff99b4946f8,0x7ff99b494708,0x7ff99b494718
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,9362465121004586879,10691749927317354603,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,9362465121004586879,10691749927317354603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,9362465121004586879,10691749927317354603,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9362465121004586879,10691749927317354603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9362465121004586879,10691749927317354603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,9362465121004586879,10691749927317354603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,9362465121004586879,10691749927317354603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9362465121004586879,10691749927317354603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9362465121004586879,10691749927317354603,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9362465121004586879,10691749927317354603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9362465121004586879,10691749927317354603,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,9362465121004586879,10691749927317354603,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5988 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e25b2c6a3c6edc1a01a5e946d7ee50d8

SHA1
30b02e80f6aacdfb925de9de7a05eba7763b66be

SHA256
0530a22d165dec0d68cb4b7797ee63c196e727711bec28b30ebf86092d0aa02f

SHA512
8beaa8d0bee5591f44de6a6354001d79a0f737d98ce7ce0e9ea0efbaabbdd308de141dfe0758e2ae60a7d7b291d960ccd7682971b2674c9b08f653db6fa5ef89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
130c34bcd7c0c19360aa9507066ad9c2

SHA1
2394b09e9a02bf825fa460a342843006668700d6

SHA256
ac74ebc5f641209f5cc7d28bf835cfcd72343986400fe8da9f6addbde2ec4863

SHA512
05d3ffcf5d406645c1e0d43607342085288344fccb837b267f396dcba6ef4ffc2f1ad79efaf6eff37a02a90d91e561e2d59bba4ca5b85d60141808759160b481

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
39089c15dc3d01396247590a8625278d

SHA1
46ad0e34886494661bbffcfa0b0765f9736c0d39

SHA256
555f1c3d4562300c318bb0d06213b148a77fa422500ffc458638c9d735573ab9

SHA512
b899be5fdd8060bbe91cc31cc9cf51a4920f700100488fbfc442e8e48ada8bd412e9c390ef427b5cdfac555e1b0d9d40e734083c9b3781c1972875eda72f92ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
27f9b6550aee5a1236d6b7ee2bd41330

SHA1
77567c90c576355adec5406f737464a2345a9951

SHA256
3f83708b438005e0425b6e275cc53e1e63a1fd07d1f5f6a3c46a23786addb313

SHA512
389ca312455c51473f4b175933f8dce30c7c1e254251be8684210c73edcb353894ec0ee450800844dbe71f9d5181bb202adc7806c8bd7009b73726899aa1b1d8

Download Submit