f7e68ac556112d2dd1f4c033fdf5ce784b85503b37ca371b15ef548547c79c1f

Analysis

max time kernel
112s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-10-2024 21:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f7e68ac556112d2dd1f4c033fdf5ce784b85503b37ca371b15ef548547c79c1fN.html
Size

175KB
MD5

4829f93604a93b18ac0814df446f4040
SHA1

54d48c6c4218bed5c8bc75fb06812440a800e491
SHA256

f7e68ac556112d2dd1f4c033fdf5ce784b85503b37ca371b15ef548547c79c1f
SHA512

dc005093abf3b6ca28663d586a0bfba4e54b6e2857dbb393e6e67d3aa814d1f7b0ec1654fe676676e13c5515d75bf6d50955f024620adc1418c18b553f64681d
SSDEEP

3072:Q6TDLb4oTV/HyRQV24ITDxTDgSQE3IFTDtTDZSATDwTDiOqCf2rTD+TD1fqippTy:Q6THHqZXT9TsSX3IFTxT9SATMTGof8T9

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2876	msedge.exe
2876	msedge.exe
3484	msedge.exe
3484	msedge.exe
4292	identity_helper.exe
4292	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe
3484	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 4044	3484	msedge.exe	83
PID 3484 wrote to memory of 4044	3484	msedge.exe	83
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2052	3484	msedge.exe	85
PID 3484 wrote to memory of 2876	3484	msedge.exe	86
PID 3484 wrote to memory of 2876	3484	msedge.exe	86
PID 3484 wrote to memory of 412	3484	msedge.exe	87
PID 3484 wrote to memory of 412	3484	msedge.exe	87
PID 3484 wrote to memory of 412	3484	msedge.exe	87
PID 3484 wrote to memory of 412	3484	msedge.exe	87
PID 3484 wrote to memory of 412	3484	msedge.exe	87
PID 3484 wrote to memory of 412	3484	msedge.exe	87
PID 3484 wrote to memory of 412	3484	msedge.exe	87
PID 3484 wrote to memory of 412	3484	msedge.exe	87
PID 3484 wrote to memory of 412	3484	msedge.exe	87
PID 3484 wrote to memory of 412	3484	msedge.exe	87
PID 3484 wrote to memory of 412	3484	msedge.exe	87
PID 3484 wrote to memory of 412	3484	msedge.exe	87
PID 3484 wrote to memory of 412	3484	msedge.exe	87
PID 3484 wrote to memory of 412	3484	msedge.exe	87
PID 3484 wrote to memory of 412	3484	msedge.exe	87
PID 3484 wrote to memory of 412	3484	msedge.exe	87
PID 3484 wrote to memory of 412	3484	msedge.exe	87
PID 3484 wrote to memory of 412	3484	msedge.exe	87
PID 3484 wrote to memory of 412	3484	msedge.exe	87
PID 3484 wrote to memory of 412	3484	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f7e68ac556112d2dd1f4c033fdf5ce784b85503b37ca371b15ef548547c79c1fN.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa10d746f8,0x7ffa10d74708,0x7ffa10d74718
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,17443128946451037968,161001717540858718,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,17443128946451037968,161001717540858718,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,17443128946451037968,161001717540858718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1964 /prefetch:8
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17443128946451037968,161001717540858718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17443128946451037968,161001717540858718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17443128946451037968,161001717540858718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,17443128946451037968,161001717540858718,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,17443128946451037968,161001717540858718,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17443128946451037968,161001717540858718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17443128946451037968,161001717540858718,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17443128946451037968,161001717540858718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17443128946451037968,161001717540858718,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:1620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\92483d2c-f653-4bb6-a270-566fa5d014b5.tmp

Filesize
6KB

MD5
5164b5b64c872fe4760fd38481538204

SHA1
b7dfa3b08cac9bd0dea9f74a8ef39b7c8e54fabf

SHA256
c55880101540f46078f25c70bc4b1ee48b10b5eae9f09f9407984500c1fb3d3a

SHA512
75246d5edfe8377a374fc0cbf5a4f0aa7f2124d73c621fbd3f537656f795dd96e7ccd0a93a19b333820e38cef0141a99b9dbc20fa2af2c23d889e60c30e79fdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
6d668c4ef290782b70e20682b7dc6e34

SHA1
42fcec98de9c977ae3b6f068780c5224625f8085

SHA256
3344fd02d8b896177570d4dfb4df51e11493439b3efda88d51bab106183d0e71

SHA512
7d275ca0216f012b0cd65a0df83f74f3904d967a8b23db0ce569b547237732cf945e78155a3168e83bb2f61806093521d4cc484c0a01cb51efc6551cb7792c12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
fa6d51bd265be8e05788c0c911788e47

SHA1
88e33d25508bf4cea504f82eddd75c2ef5da0a14

SHA256
7b824a807c162b31daf693967e38cd7a727169b097f1005a03e39349a5559de2

SHA512
47fd4cc79bec62fa91db2957ae2fdd49b66cd7dab4296234daadf2dcae32af1b24d20ee10fc8c2d4ce1343eb8201e5447f48cee2e709e6759f4034c496e0ecbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2f14d6c000e30dcc722fde7de1a160d6

SHA1
318f7037b011ac60ecf7b10206ef36f8bf421d6f

SHA256
2c2d477b4d8751ca0943dd40b0ddfcc07c61134f51be9d74e24f85fd470d7a9a

SHA512
d6580162dea0222a990b5fc696a0c79b6c465ed2db9736cb0d5eddc75b7d8d42b0ed701e5fc670c1a9b3aadc5157ad7d593da94865be8ab5ca9b9009dfe1b163

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8f624213ec6eaa06b2d095ef3f3588cd

SHA1
4fc58ee4d97a37dc030969385b0429aef7750af9

SHA256
99b0e1273519ca58958a1ae7fae7b5483ba5ac58f8a65cc7187428d4f312fa21

SHA512
1337fd1c7ed5330186a273380092ea876b34596dff20cf9b909ecd1c599367cc45ed9fb2a569085e72bdcef542611d1365de880c4463112ee049c4dbd9a46c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
e66db7315969da2f2436d4a533b47d7e

SHA1
834f77fe95eec8b536b9dd785dd02e43fb65b378

SHA256
07e505635f6350cbc329e8adc6df95be41391e5f9d7484fd62b146f9aa2fcce5

SHA512
bd576bb7097943af54851cbda3c86807d76a440a95497c0aaaa173620e0cb3593e5e576d27b601ad62f638a3a6dc5274532c40d8dba7067158e381bad23dbcaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580105.TMP

Filesize
371B

MD5
cd23927b7a542893ea6eb3579a305db4

SHA1
4c76dc80aa0b61fc9cef613913096b433148a9e2

SHA256
dfcde3aa268a29b7c595c3be27a40843038609f4b0867e90d1b607a434dffc51

SHA512
e78c02e86830e1fc62d56737f26b699c16d045ba98de1a1bde69d9b4c658767865e29c2789c6be44ffc77ff8f508031dc2621f67655071bd4a21da2ccd750150

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bf824cf630e0cbcc43c8528ee24b22eb

SHA1
6894e5cc831be8c0ef99bbe57b451f2207e3646c

SHA256
3837c7bfc073d16757cdae83ff157d0489c79a4fa0a3b9803e6fec03f056e372

SHA512
c3eea6237aeb00cc74e25b75c12dbfa49877156058abd8f45875cee434de947ceb3b8b36cceb5e80100df848eb0c2b3e4745eb749f2f13132ca5e50b24cba797

Download Submit