ea8fac7c65fb589b0d53560f5251f74f9e9b243478dcb6b3ea79b5e36449c8d9

Resubmissions

19/10/2024, 06:06

241019-gtrf8stbpk 3

19/10/2024, 04:19

241019-exh8xsyfkp 10

Analysis

max time kernel
61s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
19/10/2024, 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

malware.html
Size

1KB
MD5

84238dfc8092e5d9c0dac8ef93371a07
SHA1

4a3ce8ee11e091dd7923f4d8c6e5b5e41ec7c047
SHA256

ea8fac7c65fb589b0d53560f5251f74f9e9b243478dcb6b3ea79b5e36449c8d9
SHA512

d06b93c883f8126a04589937a884032df031b05518eed9d433efb6447834df2596aebd500d69b8283e5702d988ed49655ae654c1683c7a4ae58bfa6b92f2b73a

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1284	msedge.exe
1284	msedge.exe
3264	msedge.exe
3264	msedge.exe
1864	identity_helper.exe
1864	identity_helper.exe
964	msedge.exe
964	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 2652	3264	msedge.exe	79
PID 3264 wrote to memory of 2652	3264	msedge.exe	79
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 4540	3264	msedge.exe	80
PID 3264 wrote to memory of 1284	3264	msedge.exe	81
PID 3264 wrote to memory of 1284	3264	msedge.exe	81
PID 3264 wrote to memory of 3940	3264	msedge.exe	82
PID 3264 wrote to memory of 3940	3264	msedge.exe	82
PID 3264 wrote to memory of 3940	3264	msedge.exe	82
PID 3264 wrote to memory of 3940	3264	msedge.exe	82
PID 3264 wrote to memory of 3940	3264	msedge.exe	82
PID 3264 wrote to memory of 3940	3264	msedge.exe	82
PID 3264 wrote to memory of 3940	3264	msedge.exe	82
PID 3264 wrote to memory of 3940	3264	msedge.exe	82
PID 3264 wrote to memory of 3940	3264	msedge.exe	82
PID 3264 wrote to memory of 3940	3264	msedge.exe	82
PID 3264 wrote to memory of 3940	3264	msedge.exe	82
PID 3264 wrote to memory of 3940	3264	msedge.exe	82
PID 3264 wrote to memory of 3940	3264	msedge.exe	82
PID 3264 wrote to memory of 3940	3264	msedge.exe	82
PID 3264 wrote to memory of 3940	3264	msedge.exe	82
PID 3264 wrote to memory of 3940	3264	msedge.exe	82
PID 3264 wrote to memory of 3940	3264	msedge.exe	82
PID 3264 wrote to memory of 3940	3264	msedge.exe	82
PID 3264 wrote to memory of 3940	3264	msedge.exe	82
PID 3264 wrote to memory of 3940	3264	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\malware.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff918193cb8,0x7ff918193cc8,0x7ff918193cd8
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,11533029778399495744,4882515701266320078,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,11533029778399495744,4882515701266320078,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,11533029778399495744,4882515701266320078,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,11533029778399495744,4882515701266320078,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,11533029778399495744,4882515701266320078,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,11533029778399495744,4882515701266320078,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,11533029778399495744,4882515701266320078,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3796 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,11533029778399495744,4882515701266320078,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,11533029778399495744,4882515701266320078,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,11533029778399495744,4882515701266320078,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3804

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d30a5618854b9da7bcfc03aeb0a594c4

SHA1
7f37105d7e5b1ecb270726915956c2271116eab7

SHA256
3494c446aa3cb038f1d920b26910b7fe1f4286db78cb3f203ad02cb93889c1a8

SHA512
efd488fcd1729017a596ddd2950bff07d5a11140cba56ff8e0c62ef62827b35c22857bc4f5f5ea11ccc2e1394c0b3ee8651df62a25e66710f320e7a2cf4d1a77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
03a56f81ee69dd9727832df26709a1c9

SHA1
ab6754cc9ebd922ef3c37b7e84ff20e250cfde3b

SHA256
65d97e83b315d9140f3922b278d08352809f955e2a714fedfaea6283a5300e53

SHA512
e9915f11e74c1bcf7f80d1bcdc8175df820af30f223a17c0fe11b6808e5a400550dcbe59b64346b7741c7c77735abefaf2c988753e11d086000522a05a0f7781

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
f55c0dd21df809933fe1b68becb9b741

SHA1
7e63d12234cfb4fe6e7b0d73fc4d1c27a1478654

SHA256
fce13a7418ec7b0289c1b419c5224e7fb904291e53262268d96706cc59bcae71

SHA512
41191afa5b2258f608c1d1d8d13f786aabf4576d24cc3a8fa08cae8b18abfbdee5769ba848579f5de2655512e6e845b8e50080f4e7f3d3feb0b27144df6abcdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0cbbe26bba065899bcce2fa83ddc82f5

SHA1
90bdfc5f4378d672fde8fa1c16e3cc37c1d7375c

SHA256
3951c54323654461c2b9f99b72428b85b98b0d0b828e7c746c2a4e16f78162df

SHA512
a2dd0614f6f8362d744e9f6156cc60ed52534c3770905742248734d1c6a53d08a0389c16c6f028cc5d86e5bd9254d95d9aec140a3ad5b3eb48269621e30fc778

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
805d818fdf3df5f589e6f6fc8b015f5d

SHA1
be4168b33836a85b2eaf7dd48bd8a38e59637b62

SHA256
6154b45b48f69722b6d92fae6c0aa171689654f6cafcb4df45ef530009e6f083

SHA512
559163e4beda99eae7f912a5108727d2e3413f21b2e9a2389a9763e6607da3ce4faece947512c9d5868325eb0c1482994764c6d034770b7208248a0d2ab5a982

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
35f9fb1c549fd2f016bc7d02cdca90d6

SHA1
58549a90af467884c03df2927f7eb9713e36534e

SHA256
17b2372f1766e5b02cfc53756fd455b52de6fb5a483f65c43003e275365759e6

SHA512
0359018ec945d3405dbe85ed036748c4e552e8ef3f15a8db668e33b920147f238d6dea67d43aafd3c71979ccdd47d1fe5fd1a480e5a051da3c8c27f7e1c721c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0da9abcfcb4bff8878d85b1d71e4e8c7

SHA1
d42946f6afd2bff9ce1452762da1286498097242

SHA256
9cf3df50e5b7d9ed905397a053d98c8695dad0188ded252bdf3faa94fe81d00a

SHA512
d7b5a75d2f9fc670f19fc8fb22e4b31e44790cf1db89da420719e1ab6b949abac522d6cf3f4a98c903461980478bbdabd359998105ca6bd3c30a4a08b4e48912

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b640383e3394b7db6c6a4920677b4667

SHA1
b4c3ad15ae775093de55578d3eb60b72626eefce

SHA256
626ecdca035388c9c3d763dd1e0270be353dacb068f651e1a8cf36af7cb7f57c

SHA512
db76aea23c052f5d35a7673c83862548bf559523c33e8f420e6f7581f3bda40222ed1e5847f10ee1bebea127e9ce0985dee44a454150d34189bc7f2433a2d0d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c2c3085c4d9ac17cd258fdf46862f8df

SHA1
7c02d33622bd663131918facf280320c36f1a558

SHA256
af1995b7c2b1a02674852d0ea37495f8b94e4e92275689914935b1683aa42d67

SHA512
2be6aabdae887fb3269ec3ab527387ef0c113265cedccc63c3d9ab16398c402dd0993520e04867cc70fef8f05295de98303d452a9d8dc3828ab0aa57e7040894

Download Submit