853a22fbcdcdff08189f96dcf352d80e7fc7ebcb0b80db7ea5ef92bd7fb22349

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 06:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HTML/5_days.htm
Size

2KB
MD5

88eb76dadfb6feee08f0b0420447e855
SHA1

8ea86f02e72503080db84bc63e6d9f2dcc91571f
SHA256

44d3d520494089d2806c8ea5ca024c650131546955a3aa7cc00c92ad5ce263d3
SHA512

579ce476cf87bd337e505c66f1b79eb8693565f185b310825186134df31f5fc40ac6516833c54877ea909de1fbe1e9344df5698b31fa40a16d54506b6511dfa4

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2056	msedge.exe
2056	msedge.exe
2352	msedge.exe
2352	msedge.exe
3416	identity_helper.exe
3416	identity_helper.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe
2352	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 3980	2352	msedge.exe	85
PID 2352 wrote to memory of 3980	2352	msedge.exe	85
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2260	2352	msedge.exe	86
PID 2352 wrote to memory of 2056	2352	msedge.exe	87
PID 2352 wrote to memory of 2056	2352	msedge.exe	87
PID 2352 wrote to memory of 4520	2352	msedge.exe	88
PID 2352 wrote to memory of 4520	2352	msedge.exe	88
PID 2352 wrote to memory of 4520	2352	msedge.exe	88
PID 2352 wrote to memory of 4520	2352	msedge.exe	88
PID 2352 wrote to memory of 4520	2352	msedge.exe	88
PID 2352 wrote to memory of 4520	2352	msedge.exe	88
PID 2352 wrote to memory of 4520	2352	msedge.exe	88
PID 2352 wrote to memory of 4520	2352	msedge.exe	88
PID 2352 wrote to memory of 4520	2352	msedge.exe	88
PID 2352 wrote to memory of 4520	2352	msedge.exe	88
PID 2352 wrote to memory of 4520	2352	msedge.exe	88
PID 2352 wrote to memory of 4520	2352	msedge.exe	88
PID 2352 wrote to memory of 4520	2352	msedge.exe	88
PID 2352 wrote to memory of 4520	2352	msedge.exe	88
PID 2352 wrote to memory of 4520	2352	msedge.exe	88
PID 2352 wrote to memory of 4520	2352	msedge.exe	88
PID 2352 wrote to memory of 4520	2352	msedge.exe	88
PID 2352 wrote to memory of 4520	2352	msedge.exe	88
PID 2352 wrote to memory of 4520	2352	msedge.exe	88
PID 2352 wrote to memory of 4520	2352	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\HTML\5_days.htm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe5ba46f8,0x7ffbe5ba4708,0x7ffbe5ba4718
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,8894386557664496626,13517457011242610496,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,8894386557664496626,13517457011242610496,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,8894386557664496626,13517457011242610496,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8894386557664496626,13517457011242610496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8894386557664496626,13517457011242610496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,8894386557664496626,13517457011242610496,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,8894386557664496626,13517457011242610496,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8894386557664496626,13517457011242610496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8894386557664496626,13517457011242610496,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8894386557664496626,13517457011242610496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,8894386557664496626,13517457011242610496,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,8894386557664496626,13517457011242610496,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1712 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
709c6f4a32b317f6487b598788b6353d

SHA1
50f44d43be9630018f0bd2acb1528df07cd05b7f

SHA256
353aff71e8cf078c88c836e66d86be266ddbe36496a597b9b5a5a87d21eae83b

SHA512
4f33792eb73a792c88e8e2dc8bef7b00a2af7b1b91f4bab0cd5076dd2cb9abbb752eb7e60a4c6204d15f9bca1562915f2468b94e5f01f79279e1e7469055f0a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ebc024cdb324eb41f33c6ec63d1458d

SHA1
f623e96981ee63c1b6879f682c4364fd5c2265e5

SHA256
23b9bd7316816043f42a80784e7f247f3afebd3dbe370fbc702189a6a0dddb1f

SHA512
6971b6430bc01a36c48bc1e41cf8c4bed65a2890837f7778a896072159940ae739d11834176cc7be6cf6fa0f2ea9e6764c30cd23beadcc88c390e5573bbad097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\46598e06-e4c7-4e18-9558-e35df742858d.tmp

Filesize
5KB

MD5
a71a0a4a6facba7ff004fc958f2512e7

SHA1
49ac34ce16486d6197d64f7cba12d65af9e91fe1

SHA256
da548462115b771f4aacec874878c6b724fb9a605b70fd705c3d07fb25efc390

SHA512
c78d82390ef7d8754aa077e4cacd70385ee5b92a023f908cae150a98dcc9774a75bbb803c811c11a983ade6ef2033c08519a5c156a894ab6537ca30afe111cd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
adeb304ae94aedb99dbd51cf765c4839

SHA1
21a152f675340680ce77bcfc457a38e4c85e2cfb

SHA256
99962d03fe7e37477d758690b61189f46386fb46ea1715127542da24096a22f2

SHA512
ac2a86fc3d6b0fa4de0afdea581172feb00f8712b61ba310356cca8aa05815e01d274b062757be9aa20afa505025e4263a175712a1537cddfde1614c062db523

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
494a861dfe3fb61b7f6e9a8e1f92d179

SHA1
903db9c91a888cdd2a359e921ea2c1a958228aa9

SHA256
46ffd9cec0b1524402f64218ea9584cb751cd61e56eae54ac0ad61c55273c690

SHA512
f97bfb87546ee38f100ef52f6ee6d102d05feb378a940954a1953f5dc301e6ae7a91de2b2176dcac165a61abf867e06e3e31572a378b1abd9ea2768de76e7175

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d271292b-7790-4c9a-aa0b-6d73e9685202.tmp

Filesize
10KB

MD5
141f29549e22355d2a9a6c5220e22b45

SHA1
5978d416d260dc61da244fe246c60cbe7176ab66

SHA256
76733fc1a2e340e8b0b5a8898b26f285b44380ce2b0fd1a3ef81658179efcf1b

SHA512
5071633816efe3dcd67733e46c285b0a707462368d3dd202a0c75e5ad9a56cb87edaba37706e545072a2e2ef7233a761899b552b5b4333f60a983e3a2c91e7d6

Download Submit