Analysis
-
max time kernel
280s -
max time network
248s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03-09-2024 19:47
Static task
static1
Behavioral task
behavioral1
Sample
5xo6u56prLhh7pbndbRrHc3Y2BxCjOoaziztckSm.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5xo6u56prLhh7pbndbRrHc3Y2BxCjOoaziztckSm.html
Resource
win10v2004-20240802-en
General
-
Target
5xo6u56prLhh7pbndbRrHc3Y2BxCjOoaziztckSm.html
-
Size
146B
-
MD5
9fe3cb2b7313dc79bb477bc8fde184a7
-
SHA1
4d7b3cb41e90618358d0ee066c45c76227a13747
-
SHA256
32f2fa940d4b4fe19aca1e53a24e5aac29c57b7c5ee78588325b87f1b649c864
-
SHA512
c54ad4f5292784e50b4830a8210b0d4d4ee08b803f4975c9859e637d483b3af38cb0436ac501dea0c73867b1a2c41b39ef2c27dc3fb20f3f27519b719ea743db
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 2412 msedge.exe 2412 msedge.exe 4600 msedge.exe 4600 msedge.exe 4068 identity_helper.exe 4068 identity_helper.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe 4600 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4600 wrote to memory of 4168 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 4168 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 892 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 2412 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 2412 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 1608 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 1608 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 1608 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 1608 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 1608 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 1608 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 1608 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 1608 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 1608 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 1608 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 1608 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 1608 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 1608 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 1608 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 1608 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 1608 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 1608 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 1608 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 1608 4600 msedge.exe msedge.exe PID 4600 wrote to memory of 1608 4600 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5xo6u56prLhh7pbndbRrHc3Y2BxCjOoaziztckSm.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd09e646f8,0x7ffd09e64708,0x7ffd09e647182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,18369207941010992436,16529705984560899421,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,18369207941010992436,16529705984560899421,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,18369207941010992436,16529705984560899421,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,18369207941010992436,16529705984560899421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,18369207941010992436,16529705984560899421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,18369207941010992436,16529705984560899421,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,18369207941010992436,16529705984560899421,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,18369207941010992436,16529705984560899421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,18369207941010992436,16529705984560899421,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,18369207941010992436,16529705984560899421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,18369207941010992436,16529705984560899421,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,18369207941010992436,16529705984560899421,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5f9664c896e19205022c094d725f820b6
SHA1f8f1baf648df755ba64b412d512446baf88c0184
SHA2567121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e
SHA5123fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5847d47008dbea51cb1732d54861ba9c9
SHA1f2099242027dccb88d6f05760b57f7c89d926c0d
SHA25610292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1
SHA512bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD57624dfe4ec93f38ea375958087e25f29
SHA18ba041d3f06fd32ce54ab289d6e8f405d2be7001
SHA256a755ffc23f3b2d51458c0809fcfb44499ea6a802a8602678bdb864cd53c41f13
SHA512ed0c4c7f0c62e8295f33fa811802c1197a3b9d6258b76094f9271d7214478ef163c856517f613cb09406302dd15eaa0b346a158c0d665568ec3c378abf094bfd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5598262b9e5b64791480768ff795eb13b
SHA1fcca32f7110707fb35c04577441e926cf75de264
SHA25667300d7f9aa4f724b0705846a8d4c2a178522d1b9a7cecac724e80ebedaa6672
SHA5127ae80e850449748efdba21cba6920eb843493443bed9c52d3a36fc098b3387668311229a9bbf330574ab1dd45e3685c8d9f0ecd55e4d6f787f8312a2ae2e4f56
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD5aa13ebd4ef9dc22e2574f928480ab107
SHA1b3b3023f9ff6b398bdd8ce5c1b1e9f72f47b23b9
SHA25633b1edda6bbda35b680b39119d5115a9d9f9d5b1d88a6746fd65eeea861a3c55
SHA512fcd5c09a97e90e8decb1ab0e5ebb31da1a262f094eac512453874885fed49990fdb5ce88e973a38804cc19c27c044e001d76fa2958206e5d4c87c844a9b2610e
-
\??\pipe\LOCAL\crashpad_4600_BFJWQMYUDFSEUIVPMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e