022ed15d72a6b16323946b30f567e4e3260adfb748035b029a89d44451ee7fb3

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 22:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

218KB
MD5

6e7e97d03f4dfaf126f3d72b520da7cb
SHA1

dd5e4aaf298e003f968ecde4903495d85af3a1c1
SHA256

77edaee6bfe3e715fd1998d9e8041971cf3db9af7b875c26e7abb36f84614328
SHA512

1467a3f1e9abe9ea1f4fff75f3eafad34546865e5161d9f66bae1a25aefb1e3888b63a1e474982fe9edc2aaa68cf58918aa36fab9c85e3f5d8c172e990fdb14a
SSDEEP

3072:SkzIWNhpDAAvyfkMY+BES09JXAnyrZalI+YQ:Sk0s5n6sMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
3216	msedge.exe
3216	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe
4936	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 3940	3216	msedge.exe	83
PID 3216 wrote to memory of 3940	3216	msedge.exe	83
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 4000	3216	msedge.exe	84
PID 3216 wrote to memory of 3532	3216	msedge.exe	85
PID 3216 wrote to memory of 3532	3216	msedge.exe	85
PID 3216 wrote to memory of 3612	3216	msedge.exe	86
PID 3216 wrote to memory of 3612	3216	msedge.exe	86
PID 3216 wrote to memory of 3612	3216	msedge.exe	86
PID 3216 wrote to memory of 3612	3216	msedge.exe	86
PID 3216 wrote to memory of 3612	3216	msedge.exe	86
PID 3216 wrote to memory of 3612	3216	msedge.exe	86
PID 3216 wrote to memory of 3612	3216	msedge.exe	86
PID 3216 wrote to memory of 3612	3216	msedge.exe	86
PID 3216 wrote to memory of 3612	3216	msedge.exe	86
PID 3216 wrote to memory of 3612	3216	msedge.exe	86
PID 3216 wrote to memory of 3612	3216	msedge.exe	86
PID 3216 wrote to memory of 3612	3216	msedge.exe	86
PID 3216 wrote to memory of 3612	3216	msedge.exe	86
PID 3216 wrote to memory of 3612	3216	msedge.exe	86
PID 3216 wrote to memory of 3612	3216	msedge.exe	86
PID 3216 wrote to memory of 3612	3216	msedge.exe	86
PID 3216 wrote to memory of 3612	3216	msedge.exe	86
PID 3216 wrote to memory of 3612	3216	msedge.exe	86
PID 3216 wrote to memory of 3612	3216	msedge.exe	86
PID 3216 wrote to memory of 3612	3216	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffade9146f8,0x7ffade914708,0x7ffade914718
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,9578530396031546372,16853105040433631418,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,9578530396031546372,16853105040433631418,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,9578530396031546372,16853105040433631418,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9578530396031546372,16853105040433631418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9578530396031546372,16853105040433631418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,9578530396031546372,16853105040433631418,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4948 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
13b091bd70efeff78e5dc297a4c2f67d

SHA1
fc81e904fd7d064e8c7c7178d5b51ba6d852a74c

SHA256
4c1ff95611283a356551c255d62956f4d0d137ade21a756018f12501962bd26a

SHA512
9f31e8d12e4ceefaf7a6ad3e61bad1a7002d6139dbb59343debd34c0729bd85959f220bcc99518abedd5e0b662989e1631bfcfaebab5fc19e04c93a2a26f9e6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f2c6be7b69e92042fecd129ad7cd4b2c

SHA1
308648e9a894f5a54e77ea1f296596b252a784d3

SHA256
8e83a69e2b8d4601958f262c2cbc2eac13d0dc217f4bbf4faddede25083a6504

SHA512
5710082126fec8033a3b7cc228cd9a9e97301a56e4c84d5f805be2fafa2d236bfaf5aa5df9f8321c9df506d614abec0ebcd68dd554aaf1bf08515c617247354d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
581e564b917096fb95af77de7f44c3f3

SHA1
9bd35756d8cfebaaedaea360bf3bfde924307a73

SHA256
fe41f6ce38b54a81988840bdd1ad04bfeb0bc4038dcc408a5edaf6b2ea47d25c

SHA512
73abce29d9513f523e1438370b72b5a879f6260542b804bb9a1e2052883d1b8073da3f767f9abb038cb0dbecc90427a62ec28a462524c69046ab6c1fb322b056

Download Submit