bc372255b9408d0741e584dcbd84d18947263a3c86f7b7170e314cfc07b75157

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 06:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 32KB
Sample241009-g5b6pasamf
SHA256 a8d69f19639647e77aeff9ceedbad547fd6d30563ac104755bf43d964e58949d
MD5 f2e9156396b1683707a63c59392f53c1
SHA1 27f05ec0e209c545a4b768a0bc137ad4a1c74ee5
SHA512 e8a5f9c08d5d1aa14a13956ac8de151d09994676e21922d2d5e3611e5706544df80aca550fdc812a138023ed95036a66e5b68e53749a86a06ab4f1c630ba04fa
SSDEEP 768:7zaqrd/YXb3PnVhHmK1GqPT9W05Dhq4BMena1i66JAI68gOIYSkqnG+eMS1Zfb2e:7tQGAFEgc9LG5p7r8/xE64
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2148	msedge.exe
2148	msedge.exe
2880	msedge.exe
2880	msedge.exe
2244	identity_helper.exe
2244	identity_helper.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2204	2880	msedge.exe	83
PID 2880 wrote to memory of 2204	2880	msedge.exe	83
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 1836	2880	msedge.exe	84
PID 2880 wrote to memory of 2148	2880	msedge.exe	85
PID 2880 wrote to memory of 2148	2880	msedge.exe	85
PID 2880 wrote to memory of 1872	2880	msedge.exe	86
PID 2880 wrote to memory of 1872	2880	msedge.exe	86
PID 2880 wrote to memory of 1872	2880	msedge.exe	86
PID 2880 wrote to memory of 1872	2880	msedge.exe	86
PID 2880 wrote to memory of 1872	2880	msedge.exe	86
PID 2880 wrote to memory of 1872	2880	msedge.exe	86
PID 2880 wrote to memory of 1872	2880	msedge.exe	86
PID 2880 wrote to memory of 1872	2880	msedge.exe	86
PID 2880 wrote to memory of 1872	2880	msedge.exe	86
PID 2880 wrote to memory of 1872	2880	msedge.exe	86
PID 2880 wrote to memory of 1872	2880	msedge.exe	86
PID 2880 wrote to memory of 1872	2880	msedge.exe	86
PID 2880 wrote to memory of 1872	2880	msedge.exe	86
PID 2880 wrote to memory of 1872	2880	msedge.exe	86
PID 2880 wrote to memory of 1872	2880	msedge.exe	86
PID 2880 wrote to memory of 1872	2880	msedge.exe	86
PID 2880 wrote to memory of 1872	2880	msedge.exe	86
PID 2880 wrote to memory of 1872	2880	msedge.exe	86
PID 2880 wrote to memory of 1872	2880	msedge.exe	86
PID 2880 wrote to memory of 1872	2880	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff409f46f8,0x7fff409f4708,0x7fff409f4718
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,4526469677676020253,6292886173082691259,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,4526469677676020253,6292886173082691259,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,4526469677676020253,6292886173082691259,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4526469677676020253,6292886173082691259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4526469677676020253,6292886173082691259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4526469677676020253,6292886173082691259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4526469677676020253,6292886173082691259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4526469677676020253,6292886173082691259,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,4526469677676020253,6292886173082691259,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4196 /prefetch:8
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,4526469677676020253,6292886173082691259,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4526469677676020253,6292886173082691259,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4526469677676020253,6292886173082691259,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,4526469677676020253,6292886173082691259,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8
MD5 99afa4934d1e3c56bbce114b356e8a99
SHA1 3f0e7a1a28d9d9c06b6663df5d83a65c84d52581
SHA512 76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9
MD5 443a627d539ca4eab732bad0cbe7332b
SHA1 86b18b906a1acd2a22f4b2c78ac3564c394a9569
SHA512 923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1b362fb1a6f080ac2cdc2a8a35f54508703781571a04be7aae30254b31038872
MD5 629c00d80e226c50f39c1feba1b22c00
SHA1 2a5e86509b07b7f89600084a541c9b6e40f6a018
SHA512 bf4cb9f23bc0fd06e26d6427bb24bb40daf140d0eb4fe8bfcb30534e923a6b58587288b32df726e2007594b8368d6d0aa43b0dddfe62b157063fb50811a7558b
SSDEEP 96:nrkM51nD9WI/wpvWMoiVmdeHtuEX+UWQyV+VDCAiEwb:nrkwtD9T/GWMX1+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 872ded9e376a04727efc0b19680489c6b7dbad7f53a510657d0f480a26214b97
MD5 8ed9db898f10a40e60ec6f7d00198032
SHA1 c4d6c22c2720e0b712dba9947ed1ad173d856507
SHA512 5976221d97be6914fdb9a109c51da9fc42f4715d1e30be32c89f201552a07879973c9b657794edbe1e5add37c2b5d2b0a905c0148b4b36561791529f4e2a5b8e
SSDEEP 96:nrkZ51nD9WI/wpvWMoiVmdeHtuEX+UWQyV+VDCziEwb:nrkXtD9T/GWMX1+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 a306da7238b57921a1c0bd135749aefea579a658c35480c07097d2c0aa8c7166
MD5 1e8d9e557d4e3ffe802be7dda03fad0e
SHA1 fe98ef12276c7266430f8eb625c01d7f943f78d9
SHA512 4aa58e5de3c8c926e1507498e1e7a43bed4b5f2b4768d3ab917cba91c726a47cf9cf86b8ca000299be801a9fd5209a2d557321c54507e91b36367c45b322b000
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupT+e2RUQoby6+B1ESuRu:A9iIxuERzA83h09RZxY8kSbEdRu
MD5 SHA1 SHA512 SSDEEP

Submit Download