0e1f1bbc7bd4393109e4c6fdd13fc422d207587dbc6ced83d30dcc9f92c2b497

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2024 23:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

heylone-template/blog.html
Size

11KB
MD5

527b473e96d116409453a06f112e138a
SHA1

a8a2480c7288e43f4a53ab9568bddeeff0d93f0b
SHA256

f73291ad3ef56b82c3c4a1902765145bc74e0761002ca2bf623c956c632caf38
SHA512

a0e12db1445f30898da4d220e68008aa9fd129b645b303fe3218d968ccd31232db4deeb501021e7fd2340fa522dd93484362afe1d70037b5a96be0c415329cfa
SSDEEP

192:TB7LJ7xcWqrTPZUFFLcTUcTszZ6cTUcTszLcTUcTszwakcTUcTsz9z+T6UXeRwIc:17lts1eFjfyeRwIc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
920	msedge.exe
920	msedge.exe
64	msedge.exe
64	msedge.exe
3180	identity_helper.exe
3180	identity_helper.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe
688	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 64 wrote to memory of 3816	64	msedge.exe	86
PID 64 wrote to memory of 3816	64	msedge.exe	86
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 4048	64	msedge.exe	87
PID 64 wrote to memory of 920	64	msedge.exe	88
PID 64 wrote to memory of 920	64	msedge.exe	88
PID 64 wrote to memory of 3132	64	msedge.exe	89
PID 64 wrote to memory of 3132	64	msedge.exe	89
PID 64 wrote to memory of 3132	64	msedge.exe	89
PID 64 wrote to memory of 3132	64	msedge.exe	89
PID 64 wrote to memory of 3132	64	msedge.exe	89
PID 64 wrote to memory of 3132	64	msedge.exe	89
PID 64 wrote to memory of 3132	64	msedge.exe	89
PID 64 wrote to memory of 3132	64	msedge.exe	89
PID 64 wrote to memory of 3132	64	msedge.exe	89
PID 64 wrote to memory of 3132	64	msedge.exe	89
PID 64 wrote to memory of 3132	64	msedge.exe	89
PID 64 wrote to memory of 3132	64	msedge.exe	89
PID 64 wrote to memory of 3132	64	msedge.exe	89
PID 64 wrote to memory of 3132	64	msedge.exe	89
PID 64 wrote to memory of 3132	64	msedge.exe	89
PID 64 wrote to memory of 3132	64	msedge.exe	89
PID 64 wrote to memory of 3132	64	msedge.exe	89
PID 64 wrote to memory of 3132	64	msedge.exe	89
PID 64 wrote to memory of 3132	64	msedge.exe	89
PID 64 wrote to memory of 3132	64	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\heylone-template\blog.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbbc7e46f8,0x7ffbbc7e4708,0x7ffbbc7e4718
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,14697930907701449302,16838368004275019941,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,14697930907701449302,16838368004275019941,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,14697930907701449302,16838368004275019941,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14697930907701449302,16838368004275019941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14697930907701449302,16838368004275019941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14697930907701449302,16838368004275019941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14697930907701449302,16838368004275019941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14697930907701449302,16838368004275019941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,14697930907701449302,16838368004275019941,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,14697930907701449302,16838368004275019941,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14697930907701449302,16838368004275019941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14697930907701449302,16838368004275019941,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14697930907701449302,16838368004275019941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14697930907701449302,16838368004275019941,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,14697930907701449302,16838368004275019941,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3212 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6ed7d3c8-f9a4-4983-b9aa-ae71fcaef6ba.tmp

Filesize
6KB

MD5
6d63188cec19b0f7ec6951a392271c84

SHA1
aa851c40d032fe4c68ef38cfc052b305bc9bb6c6

SHA256
ae43fdd9eb4b46575c7fee755b972ff7011ce51fc7661137f51515e7d2d6d4dd

SHA512
07728ed6587018d8fe297710b7781ce90053988346c5c953c2dd23a38d42570185a4ffa94fa19832bc0e233364ccb9cc1952b6128b975218d29eed30041d4bba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
4abb8bb7bcc5a2cd3655d772e269022a

SHA1
9e98b359ef578c750e65b0ed0113da1798563a6a

SHA256
32ad1ff8d8dd79baf20450db740899746b22d99cffccb20e7cd647285ea9d18c

SHA512
76e54a6d976571fcf9b8feaaf3ebc5721a03b7b6d56ee61022d7acca383383da00e5c8bbf04478c10a6688c7b2dc63d47f67cdac1064566d04a89846ed473374

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
407B

MD5
11303968caa7fa93a3a40cc4316c5e2a

SHA1
cd0e706eb1274ad7a0d17546b0c7cd24a0cb2c53

SHA256
7de37213ee4a233d8ec02d32ad0d4d51fbb691b3b6a3ebfda90d6f7cceebc40e

SHA512
3f6e6d7920504e57bce4a401b6b4b4d24b147d6d21d4a4d4b83b818059f619ee6542fce122713e8f5446111553e53b37457eb143c846bfcead93b19d040e7d42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7dae95da8705e5ff1cd385106417754c

SHA1
fa01215b6f0df37caec5877c8801f861a6648929

SHA256
2547898ec9e998a964d555824016127a5012703532720d277050c2f6fee8870a

SHA512
41570edc433532e3d798979ec14aece10fae9550120149e19e9f7affbf9fc3ff32d23884587fe98854c5c1ba05c44c2b5ffd1fd006cd0076d2c3767ae84af052

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e8ba6725f2dd364948c3cf9ff9c5ab19

SHA1
a67d54b90d835524df5dfae0aa7c45b94ba5b1f1

SHA256
96f509a78583fafaf56e6a77e0ec17e50782f27a848ee0757f56ab73b53d9530

SHA512
833a0935923cba08e870bf9577c9bfba938789cfe6721f45f765b7c8634ba9bf7825c0f341fcd2a6c71070cdc394bdd42ac017fc58cd0ab1007f4232ff03600e

Download Submit