Analysis
-
max time kernel
133s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06-09-2024 20:34
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240802-en
General
-
Target
sample.html
-
Size
41KB
-
MD5
55c50dc18662e02628883a45ac865589
-
SHA1
6fd7d676eb5c564100ef9ea3c55d23832c62b6c1
-
SHA256
d324f793e5ff40cb115f0acfdab92787a82262cb3376c4e67b23383111654ccd
-
SHA512
f10817526188f89a12b49c9bc3a0733df8250e2581c9776934cff5323cedd3a12e0503646681cd085decf6b8fafd70f7639d22337164702e580d6b5cfcd15d3c
-
SSDEEP
768:Sdmh0O6I8kPSljiD3a/Bc3Z8vf89+uvEcUdJ+FkIQ+vz+08L1d/Pj+0lkkXp4+IE:SdmSxIzqlji2Bc3Z8vf89+uvEcUdJ+FI
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 5084 msedge.exe 5084 msedge.exe 3424 msedge.exe 3424 msedge.exe 4840 identity_helper.exe 4840 identity_helper.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe 3636 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe 3424 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3424 wrote to memory of 2420 3424 msedge.exe 83 PID 3424 wrote to memory of 2420 3424 msedge.exe 83 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 3976 3424 msedge.exe 84 PID 3424 wrote to memory of 5084 3424 msedge.exe 85 PID 3424 wrote to memory of 5084 3424 msedge.exe 85 PID 3424 wrote to memory of 436 3424 msedge.exe 86 PID 3424 wrote to memory of 436 3424 msedge.exe 86 PID 3424 wrote to memory of 436 3424 msedge.exe 86 PID 3424 wrote to memory of 436 3424 msedge.exe 86 PID 3424 wrote to memory of 436 3424 msedge.exe 86 PID 3424 wrote to memory of 436 3424 msedge.exe 86 PID 3424 wrote to memory of 436 3424 msedge.exe 86 PID 3424 wrote to memory of 436 3424 msedge.exe 86 PID 3424 wrote to memory of 436 3424 msedge.exe 86 PID 3424 wrote to memory of 436 3424 msedge.exe 86 PID 3424 wrote to memory of 436 3424 msedge.exe 86 PID 3424 wrote to memory of 436 3424 msedge.exe 86 PID 3424 wrote to memory of 436 3424 msedge.exe 86 PID 3424 wrote to memory of 436 3424 msedge.exe 86 PID 3424 wrote to memory of 436 3424 msedge.exe 86 PID 3424 wrote to memory of 436 3424 msedge.exe 86 PID 3424 wrote to memory of 436 3424 msedge.exe 86 PID 3424 wrote to memory of 436 3424 msedge.exe 86 PID 3424 wrote to memory of 436 3424 msedge.exe 86 PID 3424 wrote to memory of 436 3424 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0a3d46f8,0x7ffa0a3d4708,0x7ffa0a3d47182⤵PID:2420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2280,1053442026284722449,4019943874606752775,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2288 /prefetch:22⤵PID:3976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2280,1053442026284722449,4019943874606752775,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2280,1053442026284722449,4019943874606752775,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:82⤵PID:436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,1053442026284722449,4019943874606752775,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:12⤵PID:1944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,1053442026284722449,4019943874606752775,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2280,1053442026284722449,4019943874606752775,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3024 /prefetch:82⤵PID:5024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2280,1053442026284722449,4019943874606752775,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3024 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,1053442026284722449,4019943874606752775,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:12⤵PID:4768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,1053442026284722449,4019943874606752775,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:12⤵PID:1716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,1053442026284722449,4019943874606752775,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:12⤵PID:4284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,1053442026284722449,4019943874606752775,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:12⤵PID:2532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2280,1053442026284722449,4019943874606752775,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4208 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3636
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1960
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3512
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f9664c896e19205022c094d725f820b6
SHA1f8f1baf648df755ba64b412d512446baf88c0184
SHA2567121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e
SHA5123fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae
-
Filesize
152B
MD5847d47008dbea51cb1732d54861ba9c9
SHA1f2099242027dccb88d6f05760b57f7c89d926c0d
SHA25610292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1
SHA512bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f
-
Filesize
5KB
MD518392a51058872cbdbb916e714db7c69
SHA17e8ed5c61cfe0fa60d48cc4981b5acfbbe7abb83
SHA25666ab7d1c911b6942d3f4f58362e0e3c253e73d2bd34e14d3f59380f910f5952f
SHA51213b4b9fdc330f6946f752b843c20e509452b204e0682571bc468f2370a1c1e4efdf974e5a852308e29e9ea05642f26a9296455a017633a02ca5711a81359098f
-
Filesize
6KB
MD5ce2174ef34190bf9e7f4ba48af64f1df
SHA12241fff84f6d40bccddd7dfbed60ebd44c06b818
SHA2565c2d485faff22b3e584da50700e54e70aa6ccf7cfc654929d3ead96d43269e90
SHA5126ee50dc788cabaca17f9e45d73df8b8de6b48b8c85be93f7953062bcc278c249400c01cb3b433fa8f3a715d7657f5d0a05027679ae8935110c88fe0152f898fd
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD50c6c1e60106fb0fedb8731fe82c7b189
SHA1b343084331d023602d0184898a207a2075608ab0
SHA256aad1e2fe97aca5bd2986e212029a59678d19bfc2f80fabafac6f0a2de8f8f49a
SHA512f47f3f703b506b4af483b301b30a1d187f20c5515f836cc2ac4d3e27721b549f0bdac3106c8e8d17ad0c23517bfa149ad1085cfbb4880cddeaaab4d9b498f15c