c22279b381ab4fe6d423b9912e251e0cb17197b32d279b35d71925886fd793ad

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 16:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aview.html
Size

669B
MD5

564600807066146dc368c6627026b72d
SHA1

4292d27223db0deb65a1f5ae8d640defe5342bec
SHA256

dc4d12525d8287d781533e093fa4206c6be2400b52a8702a62c7ccde18909ade
SHA512

4dff77f1f5e0ba38b3b7d19cd6c01857b7086a0ee52acda2a90c019fdbd5ca7419ef891885b445acf957eb7d0df81fc1b3d618ae3449f135a119af6528f28778

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
852	msedge.exe
852	msedge.exe
1808	identity_helper.exe
1808	identity_helper.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe
852	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 3948	852	msedge.exe	85
PID 852 wrote to memory of 3948	852	msedge.exe	85
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4892	852	msedge.exe	86
PID 852 wrote to memory of 4880	852	msedge.exe	87
PID 852 wrote to memory of 4880	852	msedge.exe	87
PID 852 wrote to memory of 3256	852	msedge.exe	88
PID 852 wrote to memory of 3256	852	msedge.exe	88
PID 852 wrote to memory of 3256	852	msedge.exe	88
PID 852 wrote to memory of 3256	852	msedge.exe	88
PID 852 wrote to memory of 3256	852	msedge.exe	88
PID 852 wrote to memory of 3256	852	msedge.exe	88
PID 852 wrote to memory of 3256	852	msedge.exe	88
PID 852 wrote to memory of 3256	852	msedge.exe	88
PID 852 wrote to memory of 3256	852	msedge.exe	88
PID 852 wrote to memory of 3256	852	msedge.exe	88
PID 852 wrote to memory of 3256	852	msedge.exe	88
PID 852 wrote to memory of 3256	852	msedge.exe	88
PID 852 wrote to memory of 3256	852	msedge.exe	88
PID 852 wrote to memory of 3256	852	msedge.exe	88
PID 852 wrote to memory of 3256	852	msedge.exe	88
PID 852 wrote to memory of 3256	852	msedge.exe	88
PID 852 wrote to memory of 3256	852	msedge.exe	88
PID 852 wrote to memory of 3256	852	msedge.exe	88
PID 852 wrote to memory of 3256	852	msedge.exe	88
PID 852 wrote to memory of 3256	852	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\aview.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9afe246f8,0x7ff9afe24708,0x7ff9afe24718
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,3695653405948346617,1713104867349607568,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,3695653405948346617,1713104867349607568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,3695653405948346617,1713104867349607568,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3695653405948346617,1713104867349607568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3695653405948346617,1713104867349607568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,3695653405948346617,1713104867349607568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,3695653405948346617,1713104867349607568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3695653405948346617,1713104867349607568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3695653405948346617,1713104867349607568,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3695653405948346617,1713104867349607568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2476 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3695653405948346617,1713104867349607568,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,3695653405948346617,1713104867349607568,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b30ae8777fe8a64a1337a27596fe42f8

SHA1
96e06a5e6cb6cddaf7265941356a426ec61cd582

SHA256
feb1ef5cca2ec7136512abf9775d409ce8eadee041ca6e1478467ffa793f40f4

SHA512
96ff3fff5ffd983ef7e2c7b9ff72c01a449c55b173c6d18d7f791f2f38b07dc27168cbdf9283da6a9e830c308352f896b859290e5cd1ce63e7d5d05c780e7f90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ff93f8ea547373f7c80b5cee1127caef

SHA1
21dffffec10ba82472f2fbc7f18fc647edfe534a

SHA256
07f152676f4346f4be4ff6e208c8a299e45ae08c1fcf86ac14fe3ce17cc12825

SHA512
b5f7f233dca54fcc57d7c385c4d69f7a7192ce22cd4ea6a743f1cfd8f12c474d6131d88c0297f1e9a3393ed3012ed39b626bc549fe90558b57c4aab39db41082

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1672bfd6e067ff6e6a51379c41c3acd1

SHA1
20a3c2f55ae2f4b63ee71e2ed479b969b081cb7c

SHA256
a92497aafaeb6b8734c2b91f658348cdb38b9dfc5f25d20d34dac2e9ae3dd6de

SHA512
c86848f1d98d1502e87c7487336cd3341be71026d5df2bcd56d785e6a5fc2cad193104de24717b8428c96ac1b3c730b7204581ca5dca3254b563c1678befcba6

Download Submit