Analysis

  • max time kernel
    145s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/09/2024, 08:46

General

  • Target

    e40ce86ef8d96ad0c8bd2bf5da0d1ddcf5c6fa003008775867f5f95fcc72d7b3.html

  • Size

    100KB

  • MD5

    f591396ae4fbdf8425b492db0ca89527

  • SHA1

    279197e19f92bf51e8bfcb252c68e122eb7d2f27

  • SHA256

    e40ce86ef8d96ad0c8bd2bf5da0d1ddcf5c6fa003008775867f5f95fcc72d7b3

  • SHA512

    1da66045488250588b139e726714c96555d377c059d5a747a0eca22b43993815b63fa0260da54c393f787d522cc385f1e931f355f2d447254dd66a88d8a826ca

  • SSDEEP

    1536:oaGIpBzxieoFSyTKEq/o4pNvdjXfqfwC3/9t:oaGIpBzYepaqw4pzjXf+/9t

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e40ce86ef8d96ad0c8bd2bf5da0d1ddcf5c6fa003008775867f5f95fcc72d7b3.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3748
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb96746f8,0x7ffcb9674708,0x7ffcb9674718
      2⤵
        PID:4664
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,4758003561925103098,8479448456884843678,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
        2⤵
          PID:972
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,4758003561925103098,8479448456884843678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3472
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,4758003561925103098,8479448456884843678,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
          2⤵
            PID:4196
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,4758003561925103098,8479448456884843678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
            2⤵
              PID:4484
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,4758003561925103098,8479448456884843678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
              2⤵
                PID:1640
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,4758003561925103098,8479448456884843678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
                2⤵
                  PID:4456
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,4758003561925103098,8479448456884843678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
                  2⤵
                    PID:2504
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,4758003561925103098,8479448456884843678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
                    2⤵
                      PID:4908
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,4758003561925103098,8479448456884843678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
                      2⤵
                        PID:4348
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,4758003561925103098,8479448456884843678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6968 /prefetch:8
                        2⤵
                          PID:3396
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,4758003561925103098,8479448456884843678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6968 /prefetch:8
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2040
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,4758003561925103098,8479448456884843678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
                          2⤵
                            PID:4560
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,4758003561925103098,8479448456884843678,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
                            2⤵
                              PID:624
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,4758003561925103098,8479448456884843678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2628 /prefetch:1
                              2⤵
                                PID:556
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,4758003561925103098,8479448456884843678,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7160 /prefetch:1
                                2⤵
                                  PID:4412
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,4758003561925103098,8479448456884843678,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5400 /prefetch:2
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2424
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:1332
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:4768

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                    Filesize

                                    152B

                                    MD5

                                    ff63763eedb406987ced076e36ec9acf

                                    SHA1

                                    16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

                                    SHA256

                                    8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

                                    SHA512

                                    ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                    Filesize

                                    152B

                                    MD5

                                    2783c40400a8912a79cfd383da731086

                                    SHA1

                                    001a131fe399c30973089e18358818090ca81789

                                    SHA256

                                    331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

                                    SHA512

                                    b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

                                    Filesize

                                    23KB

                                    MD5

                                    c897f8479da25ec570027594f1b4db24

                                    SHA1

                                    81a3ff06cf35a87e697fc4733966dffc270ad06b

                                    SHA256

                                    7fd05e325904c9c31e435d5c65b9b4ffa11a9116d1df0282d6cd7c87ef6f1dbc

                                    SHA512

                                    b1c1c46810c3bc5c407f7d30a9d74db8242860965d958ffc5bfeed35b1204774843775ae81b8c414ea89322d00d7ab97313965e20cebba588edf13b9b8dcbc10

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

                                    Filesize

                                    45KB

                                    MD5

                                    ede70f717200a59b4cb831635de913a1

                                    SHA1

                                    d4d6e893ac192b5df087e924ab3356852f8a7bc0

                                    SHA256

                                    c63fbcc69de230e4844cf735ccf668eeaf30e42126eeb464da39c2de6b0b0051

                                    SHA512

                                    b621bde28b90ba97c122677989d994cb5e88fd0906366af1a23ad3f9d9f3b7f2bbef95873f29100433d4068fbbf7ab798505e68deefc118097fc5f76dfc4b672

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    240B

                                    MD5

                                    d9ac41fb743d1c209fca138f61c36451

                                    SHA1

                                    193fd5988fcb197970aebc12d52788137f97c479

                                    SHA256

                                    b931a06f4f003c6e57b19fb678bd2f503c1ddf3c4ef4793e294bf7117be26749

                                    SHA512

                                    58413587fb20ad23f18f3cded11f0b747a69b70c19ce629a06f11698a508d7b33725c635387931a50411ab27653c307be77486162201b7ce7aaab29f02f2824d

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    216B

                                    MD5

                                    94a4345e31735615eeeedb516f407cd7

                                    SHA1

                                    0bccd744a6d92e765755651cfe5ac0e1c6702853

                                    SHA256

                                    4179f5199f7ed31552f911a23c906add6758d61b91f155e8d109b7721904eea1

                                    SHA512

                                    a67401bc3853cabcce61503e0682c0d6531e33dbfb3e214800dfbaf80d7be4780c400f8e1151248a90676b10d033153a272ebbff46d0e189399a0614f3099905

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    2KB

                                    MD5

                                    b196b9de3070964c015c4f37accc92a7

                                    SHA1

                                    3e729053f4912321092ae6b3f4c9c19ea3633acd

                                    SHA256

                                    ea6bd73f2163f5cfef036b4310e4b5dab5a0cd1c73c5f3f1d361876084f9705c

                                    SHA512

                                    2c012761e6de67d6a14232ae7a7a9745bc7ece2cb2fcadf42a3cf5c547d7eff2158d56105c7e821b414932ce8c951da845fb8d24ec56972076010a342073249d

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    2KB

                                    MD5

                                    070fb757d5608b74a233165e87343e86

                                    SHA1

                                    9bb77122d4b8ce3110ee93e94afd16f988635cd7

                                    SHA256

                                    1a33fec0f6e8b08f37c002f4d889d89bcfe66d8d8e76338195f73ef7e6773669

                                    SHA512

                                    0d58a397c4bc82f6f02870cd890025035dc68019d3b58bb4342a850b8ce66963d9bd3b77d1ef80c8ed293b62d794ad0a3c5d7b395667cbe5f40d373845be7bce

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    5KB

                                    MD5

                                    234b4b04bcab46cc2d762da8d26ec937

                                    SHA1

                                    44b54f125e0c8cc3c607ad44611e35d0b73afb0b

                                    SHA256

                                    459c837cf471fe0d8922fd80c951a02d9fdcd096209e9d85661f72bab9d60088

                                    SHA512

                                    fba2718fc3c6b5aebb4140845a36972ef545a4843bfa47beca9dd300f42225456ac175ae4debf7477e12a0e84137e002c12884dc620e4d9a42bec242401dc57b

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    6KB

                                    MD5

                                    976292aa5fda07e8b21399695cb95b75

                                    SHA1

                                    643dbd751ed79afbc0f6ba473606ffae647859fa

                                    SHA256

                                    bebdf1785f3783b3880cee8ca836a47c7470dab91c54358190e704c380a01839

                                    SHA512

                                    8d9c2bfe1f9f733a27a044271cdd6682b86de17a7f2eea7b5a21d974f0687bf23e21d840ae53372494cecd323dde82914b6310497a554fcdc15d08f2445a93f3

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    7KB

                                    MD5

                                    cbe68e315bec4a112ae47e79aea445d0

                                    SHA1

                                    985b783f95c282fa6bebb7b0f30cc638f65ddec9

                                    SHA256

                                    0b51b5a449da3ede82fb6048fd701e33d53fd7941493951241ab7e6bff2a4a0b

                                    SHA512

                                    82a9c99a8cd026dc4a4859482404d0195d04385b39613601208a4408d1683c5584b9dc4c30712a9ffcb23211910749df46c7be325257ba53cb3f1a5eb5aa3703

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                    Filesize

                                    16B

                                    MD5

                                    6752a1d65b201c13b62ea44016eb221f

                                    SHA1

                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                    SHA256

                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                    SHA512

                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                    Filesize

                                    10KB

                                    MD5

                                    d7dc1f1b2f6b8b5acc9ad2f97f2d2a5f

                                    SHA1

                                    8915cad6321a09a3ef4484836d32b9c5ce3f92df

                                    SHA256

                                    1f8b278ffb3a872c2d5e2a894f19fa8bf79342d4fe533e8c76381cad5c3de198

                                    SHA512

                                    394c6c9164060692a3b4034ad43c05b1c1c277d92b5de1183244b5d9367f62302f4061fd97bb5233ae77ea9bb35a2254fd6e671f626292ebd2947edeedadb1bf