b6e833da395e5834f1c2fa3a5ae6e30795e4568287491eb7cf687254a16d8a70

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 20:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

218KB
MD5

f9a5898d5f60f69224ddcc5eca00c523
SHA1

e3e61c449ba6f7e1c37e3c258773241fd267e6a6
SHA256

4526aa6b5145e44505649f2e8f6cf3d7e5bfaa37b70f78c77259f500ef7cdcea
SHA512

cae7720213d4170af1f98e77718ff36fdc2d5d862b011564ec3fe9d0ff74995e25df403d27db1b4253dcfac383cfd23c22c6a9957b123ee4e64eadae66234c73
SSDEEP

3072:Ssr+unlX3zoyfkMY+BES09JXAnyrZalI+YQ:Ssr+UlzlsMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe
4792	msedge.exe
4792	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe
4792	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 2756	4792	msedge.exe	82
PID 4792 wrote to memory of 2756	4792	msedge.exe	82
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 3640	4792	msedge.exe	83
PID 4792 wrote to memory of 2384	4792	msedge.exe	84
PID 4792 wrote to memory of 2384	4792	msedge.exe	84
PID 4792 wrote to memory of 1676	4792	msedge.exe	85
PID 4792 wrote to memory of 1676	4792	msedge.exe	85
PID 4792 wrote to memory of 1676	4792	msedge.exe	85
PID 4792 wrote to memory of 1676	4792	msedge.exe	85
PID 4792 wrote to memory of 1676	4792	msedge.exe	85
PID 4792 wrote to memory of 1676	4792	msedge.exe	85
PID 4792 wrote to memory of 1676	4792	msedge.exe	85
PID 4792 wrote to memory of 1676	4792	msedge.exe	85
PID 4792 wrote to memory of 1676	4792	msedge.exe	85
PID 4792 wrote to memory of 1676	4792	msedge.exe	85
PID 4792 wrote to memory of 1676	4792	msedge.exe	85
PID 4792 wrote to memory of 1676	4792	msedge.exe	85
PID 4792 wrote to memory of 1676	4792	msedge.exe	85
PID 4792 wrote to memory of 1676	4792	msedge.exe	85
PID 4792 wrote to memory of 1676	4792	msedge.exe	85
PID 4792 wrote to memory of 1676	4792	msedge.exe	85
PID 4792 wrote to memory of 1676	4792	msedge.exe	85
PID 4792 wrote to memory of 1676	4792	msedge.exe	85
PID 4792 wrote to memory of 1676	4792	msedge.exe	85
PID 4792 wrote to memory of 1676	4792	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa579246f8,0x7ffa57924708,0x7ffa57924718
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,1299228155758281047,9227456874847627753,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,1299228155758281047,9227456874847627753,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,1299228155758281047,9227456874847627753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1299228155758281047,9227456874847627753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1299228155758281047,9227456874847627753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,1299228155758281047,9227456874847627753,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4892 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5b47f2377890947406a71b01d12e71d6

SHA1
e970a2950dd833cc4a169372f55a1d8c9316d914

SHA256
b2574fccc9981ec8597387cce25fec3315d5b7e88047f707ca58b19991b17851

SHA512
3e7773dec6bd5431fd815fd57df74b344cd98f53e2c8a239dae82b06eaee4fc1f72999290cc8a844405e06123d18c7449d7e5912ba69bea850617ce9d4d7be5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d2d64a5a2136a5b46061573cb53694c8

SHA1
01c3dba74c7456c412f377bb91c2f077b4e4cbb4

SHA256
c91427ea36ae343b422dd867903c7f81ac37478a1c5cdf74fd3243b19ed57089

SHA512
efa430d2da7d5b7f94a3045355631b67c0064397d80ae056616dd787779698a947a26871193d626e044b947fbcd90abf058413dc7e6f47a5df0a4feac22b5aa5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a78096d8ee99cb62978ce967c460026a

SHA1
1c241286187289f9b3711a4824de2a5f52b1bcaf

SHA256
89f868f757573d24df7d47b36b3bf965118b19d774b921231e4e9ab5cda0d1cc

SHA512
bbb8e5e10f96dbde0f3f0294be08497079d15d1a1ecfe7110236de1815c35f80eac97ab51d67893431811579f4638459da44b99768b82d6964f289d06f9ddb03

Download Submit