32f2fa940d4b4fe19aca1e53a24e5aac29c57b7c5ee78588325b87f1b649c864

General

Target

408709785.html
Size

146B
MD5

9fe3cb2b7313dc79bb477bc8fde184a7
SHA1

4d7b3cb41e90618358d0ee066c45c76227a13747
SHA256

32f2fa940d4b4fe19aca1e53a24e5aac29c57b7c5ee78588325b87f1b649c864
SHA512

c54ad4f5292784e50b4830a8210b0d4d4ee08b803f4975c9859e637d483b3af38cb0436ac501dea0c73867b1a2c41b39ef2c27dc3fb20f3f27519b719ea743db

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

1904 msedge.exe
1904 msedge.exe
2688 msedge.exe
2688 msedge.exe
3684 identity_helper.exe
3684 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

2688 msedge.exe
2688 msedge.exe
2688 msedge.exe
2688 msedge.exe
2688 msedge.exe
2688 msedge.exe

pid	process
1904	msedge.exe
1904	msedge.exe
2688	msedge.exe
2688	msedge.exe
3684	identity_helper.exe
3684	identity_helper.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2688 wrote to memory of 2516	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 2516	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 3932	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 1904	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 1904	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 1420	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 1420	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 1420	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 1420	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 1420	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 1420	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 1420	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 1420	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 1420	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 1420	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 1420	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 1420	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 1420	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 1420	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 1420	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 1420	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 1420	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 1420	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 1420	2688	msedge.exe	msedge.exe
PID 2688 wrote to memory of 1420	2688	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\408709785.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa2f8c46f8,0x7ffa2f8c4708,0x7ffa2f8c4718
2⤵
PID:2516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,14267672624173756753,1618299504538156172,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2012 /prefetch:2
2⤵
PID:3932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,14267672624173756753,1618299504538156172,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,14267672624173756753,1618299504538156172,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
2⤵
PID:1420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,14267672624173756753,1618299504538156172,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
2⤵
PID:1560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,14267672624173756753,1618299504538156172,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
2⤵
PID:4784

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,14267672624173756753,1618299504538156172,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
2⤵
PID:1336

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,14267672624173756753,1618299504538156172,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,14267672624173756753,1618299504538156172,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
2⤵
PID:1908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,14267672624173756753,1618299504538156172,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
2⤵
PID:3620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,14267672624173756753,1618299504538156172,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
2⤵
PID:4544

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,14267672624173756753,1618299504538156172,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
2⤵
PID:4864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4864

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

1

T1217

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
92c61a3f168a678e0f8eaf99e119b0b2

SHA1
f941623fc0c34f0b87258d21f10eb17e255b793c

SHA256
8f2d3a129049af79509c06ca33424e3c90fb23629c269c041026512f6541f8b8

SHA512
c989053a5bb73c14e7cac55ca130f2c0d3b471497ddf0d92ab4299db6ab32b2bba4e6f7442fc197514ab6beea938bcd4c3b8379106effce52e108700d50e5923

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
31986b8d14cc942e67b96e6ba46855c6

SHA1
a69e4eafc40dced02eac5a502e3bbe169abb162a

SHA256
6cdffdbac2fe6f6bdfa828fd4c7eb94e95d47c8b2b02c97c444711aeed7415b2

SHA512
a0b6007b20417c57f56562f29da677bb3dd633aa44cc94213914526a84b98fa7d54e6c8d15098a936a9a590556df0d74f3633cd84ae8bea438ef2e820769d9ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
c429556578c72d7a6746e423f1cc69ca

SHA1
4a85f40cd546e96b3ee7afe49dc4d1f11b89b1ef

SHA256
f495f01f9570ba5e8086fabe75e3344ec41a35a46c1ce220fe2edf5535584652

SHA512
dc8932c328992c4164eebca8f5100d11725c6a5b818ff8f49ba862a343c183ae4e41360760a8e564599366a8e8216b9712c4d873d1961a524855652e85c3bd3a

Download Submit
\??\pipe\LOCAL\crashpad_2688_ILITIWTDYCUZSBTQ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads