0aef2ee3c04cc425ba34f90d92d704845607a14dfa727958ef4bf7c71152e998

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

213KB
MD5

ac691947086acf3e17a6b52c529287bf
SHA1

093767ebc2b89803320fc4862077d244d496dd34
SHA256

fe600e1235bcc82cee26f8e6ba3ab0fe35a38e5e7d36403364fffcfa66fe12aa
SHA512

f59964e9edba1bf8d7648c570580a1f2660a20f0c5a20a90a320efd4110e031c0fde592feee6e7dc32600bd4f37ddc58da9c8dce9a9c43a3329433556fc5b6a3
SSDEEP

3072:SqsuYE+FtEVvyfkMY+BES09JXAnyrZalI+YQ:SqhH6sMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe
1128	msedge.exe
1128	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 4532	1128	msedge.exe	83
PID 1128 wrote to memory of 4532	1128	msedge.exe	83
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 516	1128	msedge.exe	86
PID 1128 wrote to memory of 4492	1128	msedge.exe	87
PID 1128 wrote to memory of 4492	1128	msedge.exe	87
PID 1128 wrote to memory of 1204	1128	msedge.exe	88
PID 1128 wrote to memory of 1204	1128	msedge.exe	88
PID 1128 wrote to memory of 1204	1128	msedge.exe	88
PID 1128 wrote to memory of 1204	1128	msedge.exe	88
PID 1128 wrote to memory of 1204	1128	msedge.exe	88
PID 1128 wrote to memory of 1204	1128	msedge.exe	88
PID 1128 wrote to memory of 1204	1128	msedge.exe	88
PID 1128 wrote to memory of 1204	1128	msedge.exe	88
PID 1128 wrote to memory of 1204	1128	msedge.exe	88
PID 1128 wrote to memory of 1204	1128	msedge.exe	88
PID 1128 wrote to memory of 1204	1128	msedge.exe	88
PID 1128 wrote to memory of 1204	1128	msedge.exe	88
PID 1128 wrote to memory of 1204	1128	msedge.exe	88
PID 1128 wrote to memory of 1204	1128	msedge.exe	88
PID 1128 wrote to memory of 1204	1128	msedge.exe	88
PID 1128 wrote to memory of 1204	1128	msedge.exe	88
PID 1128 wrote to memory of 1204	1128	msedge.exe	88
PID 1128 wrote to memory of 1204	1128	msedge.exe	88
PID 1128 wrote to memory of 1204	1128	msedge.exe	88
PID 1128 wrote to memory of 1204	1128	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9775846f8,0x7ff977584708,0x7ff977584718
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,10963183144226718366,12985562605330409727,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,10963183144226718366,12985562605330409727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,10963183144226718366,12985562605330409727,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10963183144226718366,12985562605330409727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10963183144226718366,12985562605330409727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,10963183144226718366,12985562605330409727,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4876 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d31e6730e5f01601d0d996d9e736e824

SHA1
2d72471fd449bbb64108261154d68412cc38493b

SHA256
f837d493951a33aaff75d01540a3560ca7a6916bc1b18feff208e3e8ccc422ff

SHA512
cff36c87b8e73e482c205a47c1141b30a973a3081453c3be601eb741063ae20a8930c4d1451a928547ebfcb213834c4bfb1951ddc07c561d4fbe14d17ec5d006

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
784a6f447a9e80c76abbafe4250a196d

SHA1
fecad52fe2910959ba65ae9c1da479b43a9de3bd

SHA256
1e8051a859dec0dfc25528769bc3fcaa975d0efef726564763b44a1e3342b37f

SHA512
6b68ba207cc0dbd9a56476b93c1c58bcfe4109caaee27c92e758f662f8ae932a6d01e96dce86a367ed16e739439cfebdff24b28040c46d1f09d2ebe31f53bf90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
21bdbf935f36cb447f234dbc8ebc1628

SHA1
708cac0f8d561ae5da924efbcf15a6a60f308cec

SHA256
5276b1fe1da05903ba5f392e669a726dbeb952517ff15ee4436a87053bac8e5a

SHA512
95cb7d18b72ed4c5054e8b83e3650e4e8d2da829e906069f258354019034f02f94b4e4801c664a6ac70bb4357a75b54f88fa1d949c51618613c7f7e88e370d39

Download Submit