0e1f1bbc7bd4393109e4c6fdd13fc422d207587dbc6ced83d30dcc9f92c2b497

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2024 23:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

heylone-template/index.html
Size

30KB
MD5

8ce7a8b76ebee2c303aa9530c9eca69c
SHA1

f3273402670bc5b46be5e0e66e223527329355dd
SHA256

39364e4b3483543684b5610a4945fbfa38525ab305128cf3a7d295adb9358e4c
SHA512

b2f03759799b9b254a7c9b1ea3085d0a0c7300996c2ab2ded403244d13a4618b0d4f9739e1d870189f97b4ba56fcac815d0407355a5e52f7230bfd35078c8cf0
SSDEEP

384:rjt67SJZtwsDThS/mZDctLzz0hEUUlzeRwIc:rJ67SJZtwqhS/mZDwLzz0hEUieRwF

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1700	msedge.exe
1700	msedge.exe
2996	msedge.exe
2996	msedge.exe
1600	identity_helper.exe
1600	identity_helper.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe
2996	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 3704	2996	msedge.exe	84
PID 2996 wrote to memory of 3704	2996	msedge.exe	84
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 5004	2996	msedge.exe	85
PID 2996 wrote to memory of 1700	2996	msedge.exe	86
PID 2996 wrote to memory of 1700	2996	msedge.exe	86
PID 2996 wrote to memory of 4420	2996	msedge.exe	87
PID 2996 wrote to memory of 4420	2996	msedge.exe	87
PID 2996 wrote to memory of 4420	2996	msedge.exe	87
PID 2996 wrote to memory of 4420	2996	msedge.exe	87
PID 2996 wrote to memory of 4420	2996	msedge.exe	87
PID 2996 wrote to memory of 4420	2996	msedge.exe	87
PID 2996 wrote to memory of 4420	2996	msedge.exe	87
PID 2996 wrote to memory of 4420	2996	msedge.exe	87
PID 2996 wrote to memory of 4420	2996	msedge.exe	87
PID 2996 wrote to memory of 4420	2996	msedge.exe	87
PID 2996 wrote to memory of 4420	2996	msedge.exe	87
PID 2996 wrote to memory of 4420	2996	msedge.exe	87
PID 2996 wrote to memory of 4420	2996	msedge.exe	87
PID 2996 wrote to memory of 4420	2996	msedge.exe	87
PID 2996 wrote to memory of 4420	2996	msedge.exe	87
PID 2996 wrote to memory of 4420	2996	msedge.exe	87
PID 2996 wrote to memory of 4420	2996	msedge.exe	87
PID 2996 wrote to memory of 4420	2996	msedge.exe	87
PID 2996 wrote to memory of 4420	2996	msedge.exe	87
PID 2996 wrote to memory of 4420	2996	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\heylone-template\index.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe13046f8,0x7fffe1304708,0x7fffe1304718
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,73815437193716168,5345929822872846245,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,73815437193716168,5345929822872846245,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,73815437193716168,5345929822872846245,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,73815437193716168,5345929822872846245,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,73815437193716168,5345929822872846245,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,73815437193716168,5345929822872846245,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,73815437193716168,5345929822872846245,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,73815437193716168,5345929822872846245,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,73815437193716168,5345929822872846245,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,73815437193716168,5345929822872846245,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,73815437193716168,5345929822872846245,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,73815437193716168,5345929822872846245,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2968 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,73815437193716168,5345929822872846245,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3104 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
56e82b7e47a17f3a27dfb854fac68be4

SHA1
dc7822e19dd3176193016ce64e187dab89306e43

SHA256
165ea8877c17cad02d3d83848d9c2712da1ebc2298c626d58deec83130fbdb5c

SHA512
c2a88e59266ccece392858fc97c9656e22121aa96943b5cf175e1c0cfcc6101d6b4cd8e572944887e8cbc3259c1054f0ce1a2fc5b5a4cfcba75451618df8d0ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4ab59a88a6f0bd5da23b40e42200fe32

SHA1
0d272b5def1161ec769db312d24306488a72e516

SHA256
69f44f39f0a3897371ca5b932f621eaf1c8f3456b4aad6a1ad3eb15dab4dc6b6

SHA512
bf6df46b0b7548f93a68dee2d404e14e7329edd22c88609530692317c7fe6a05a41d71c9ccf6f58c721f245bc7d1dd4164ff2b18af30d138238a37414c63dc52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
750e514e49d42bfbda7ee8fd0bf629ef

SHA1
2b5c6c3ea7a6f47e31028a44fe0195738435c240

SHA256
26382aed516004f306d1fcb2f08f1dc198749c26131b55459a2ab1ca710ad6e1

SHA512
4dcb1b5d8f6a81eca12877b7daf47e7fa7dd23fb2c70172132db68bc48ca4c6f5fb0cedde9f6c2645db3988c25ba73121fd1e80f1bb2b3a1c353fcd7a106964b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7541b7f1b31285d81c0a4910671f169f

SHA1
cfb06d538f7cd3bec2d05a3aaa72930478d59a79

SHA256
a028eb4e2815f802aa3638668a3f13c6e3e82c792f5d4043cbbb553beeaba842

SHA512
cfa678076173f1378964c43e687645110726ad84259b7800071e410034038a8fe2d1cd0ab22ad79939d6615145ffb3af1111856055e84628ce811e73d67caa6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cae4150bd5f248a84c6d529eb97cccfd

SHA1
1bf6965779d29ca2dccedd887223934f9c15d13b

SHA256
c541fd404ddfae36c64c653ec626e31273b364ddb0de61d7537166a4ead58dd3

SHA512
a56200297f9458748f6ec80cef74bf66ac3c7a87d7da69cb6721fbb710b592fd922dad15c1c598f7e5d6ea38b76396acae539e3abf584f2739766cf01103ced4

Download Submit