c97b3deebc66d2d7d2b09244ecb0e58f2caa75008ec30f8fffb6ae35e7f21adb

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

218KB
MD5

26ab09c95dfcedaea9e0f80f739f9a55
SHA1

c7f0dfa7f692c278812a285312c56050f84e3407
SHA256

e0149b8a8aa9b3ecdb85e92c034527ccbbfe71f866978dab53f9bd311e59a8be
SHA512

01f28d1b9caa43cb8a0fd198c4daa86c65714ca6c1e8ab29bf7c927c1be9eb14f31690fb0a8bc979ca1dd115e4b6889184e009c96cd91068ad33afe7e1f4a131
SSDEEP

3072:SNzalrBIzoyfkMY+BES09JXAnyrZalI+YQ:SNzOrSZsMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
4352	msedge.exe
4352	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe
3504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 4128	4352	msedge.exe	84
PID 4352 wrote to memory of 4128	4352	msedge.exe	84
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 1944	4352	msedge.exe	85
PID 4352 wrote to memory of 4980	4352	msedge.exe	86
PID 4352 wrote to memory of 4980	4352	msedge.exe	86
PID 4352 wrote to memory of 2624	4352	msedge.exe	87
PID 4352 wrote to memory of 2624	4352	msedge.exe	87
PID 4352 wrote to memory of 2624	4352	msedge.exe	87
PID 4352 wrote to memory of 2624	4352	msedge.exe	87
PID 4352 wrote to memory of 2624	4352	msedge.exe	87
PID 4352 wrote to memory of 2624	4352	msedge.exe	87
PID 4352 wrote to memory of 2624	4352	msedge.exe	87
PID 4352 wrote to memory of 2624	4352	msedge.exe	87
PID 4352 wrote to memory of 2624	4352	msedge.exe	87
PID 4352 wrote to memory of 2624	4352	msedge.exe	87
PID 4352 wrote to memory of 2624	4352	msedge.exe	87
PID 4352 wrote to memory of 2624	4352	msedge.exe	87
PID 4352 wrote to memory of 2624	4352	msedge.exe	87
PID 4352 wrote to memory of 2624	4352	msedge.exe	87
PID 4352 wrote to memory of 2624	4352	msedge.exe	87
PID 4352 wrote to memory of 2624	4352	msedge.exe	87
PID 4352 wrote to memory of 2624	4352	msedge.exe	87
PID 4352 wrote to memory of 2624	4352	msedge.exe	87
PID 4352 wrote to memory of 2624	4352	msedge.exe	87
PID 4352 wrote to memory of 2624	4352	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee51046f8,0x7ffee5104708,0x7ffee5104718
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,13883988368464701077,4437918954918010459,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1964,13883988368464701077,4437918954918010459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1964,13883988368464701077,4437918954918010459,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,13883988368464701077,4437918954918010459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,13883988368464701077,4437918954918010459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,13883988368464701077,4437918954918010459,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7006aacd11b992cd29fca21e619e86ea

SHA1
f224b726a114d4c73d7379236739d5fbb8e7f7b7

SHA256
3c434b96841d5a0fa0a04a6b503c3c4d46f1c4e3a1be77853175e5680e182814

SHA512
6de169882c0e01217c4ca01f6ead8e5ebb316a77558e51cd862532dbf9147d9e267f8db667ff6e9fa33164243724f5e437cb882392382f3cae1072dadb762c1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b80cf20d9e8cf6a579981bfaab1bdce2

SHA1
171a886be3a882bd04206295ce7f1db5b8b7035e

SHA256
10d995b136b604440ac4033b2222543975779068a321d7bddf675d0cb2a4c2b1

SHA512
0233b34866be1afd214a1c8a9dcf8328d16246b3a5ef142295333547b4cfdc787c8627439a2ca03c20cb49107f7428d39696143b71f56b7f1f05029b3a14376a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cc4e15207604ae9cc0831d0544b87c2c

SHA1
61a0c3368da6b9fa236ec03700a13a309d4c38b4

SHA256
dd8b07cf55d1a469fa1283ed2359f6af854c595f79c2f79187618a001e8f6bac

SHA512
43fa707dcbce9211f70192a276c6b170f3e76b87d4e0a4efc926aa6e50e6616f28fb619f2811f484dea41d1567ef43f2fec66226f35e6236dffbead8405ff564

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f75ecf16861196f0873534ab5c1f687e

SHA1
52817f4f4a7078a86a186d42a912d10052d42996

SHA256
5073728e63eacb8972865463e5343fe9ef9750f9955f73f64ad19ae737730000

SHA512
af5c79fea6de344544fbac508d2a6ecc8638882c0115ed16022940905e18d34952038038f75bf35b2291527d4f8bd53826a2524c3313ec7d0a93add42c5d50ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
484b643871d7a2dd9f27b173dc1db90d

SHA1
5abc956608fda2e5d1e55e10013e9d9b38f0e304

SHA256
bd39a64dc9f66f08f7cbe42647f4bd8f2600cb53f162773c190487e43ca8f8d4

SHA512
c060b912800aed5f8acc32fd94e91d842235d45d26e43863ed995446e33066e9ea6d0f98b67a59e0203bcbcdd229a57b8ea1eb66dfb6b72e490e4590f655ed9c

Download Submit