Analysis
-
max time kernel
112s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 22:23
Static task
static1
Behavioral task
behavioral1
Sample
f1b7816b760f12ba96fc7060ae0938a89ffb1ecb5b0462d7c3e36f7db660a522N.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
f1b7816b760f12ba96fc7060ae0938a89ffb1ecb5b0462d7c3e36f7db660a522N.html
Resource
win10v2004-20241007-en
General
-
Target
f1b7816b760f12ba96fc7060ae0938a89ffb1ecb5b0462d7c3e36f7db660a522N.html
-
Size
21KB
-
MD5
ec887f8e78d4ac79f842500d3947cc90
-
SHA1
c92d2647ce273079fcb05fff6fab3b04ba51f8dd
-
SHA256
f1b7816b760f12ba96fc7060ae0938a89ffb1ecb5b0462d7c3e36f7db660a522
-
SHA512
946bd6802983c90386b890639ba96d20160e1313d76baf7f4d3586fa1feb8a059dbe3d2aa767c921865920a61a7d6b4c052c69c27332289af7dcc15f12461bda
-
SSDEEP
384:CVRKT4UHqFNmV1qfDe3D8iRnsISB/o4VoxmyE/BGmGEe:CVRIdKFNmV8be3dtsISBD9Gqe
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1280 msedge.exe 1280 msedge.exe 3332 msedge.exe 3332 msedge.exe 3492 identity_helper.exe 3492 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe 3332 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3332 wrote to memory of 1996 3332 msedge.exe 83 PID 3332 wrote to memory of 1996 3332 msedge.exe 83 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 4388 3332 msedge.exe 84 PID 3332 wrote to memory of 1280 3332 msedge.exe 85 PID 3332 wrote to memory of 1280 3332 msedge.exe 85 PID 3332 wrote to memory of 3888 3332 msedge.exe 86 PID 3332 wrote to memory of 3888 3332 msedge.exe 86 PID 3332 wrote to memory of 3888 3332 msedge.exe 86 PID 3332 wrote to memory of 3888 3332 msedge.exe 86 PID 3332 wrote to memory of 3888 3332 msedge.exe 86 PID 3332 wrote to memory of 3888 3332 msedge.exe 86 PID 3332 wrote to memory of 3888 3332 msedge.exe 86 PID 3332 wrote to memory of 3888 3332 msedge.exe 86 PID 3332 wrote to memory of 3888 3332 msedge.exe 86 PID 3332 wrote to memory of 3888 3332 msedge.exe 86 PID 3332 wrote to memory of 3888 3332 msedge.exe 86 PID 3332 wrote to memory of 3888 3332 msedge.exe 86 PID 3332 wrote to memory of 3888 3332 msedge.exe 86 PID 3332 wrote to memory of 3888 3332 msedge.exe 86 PID 3332 wrote to memory of 3888 3332 msedge.exe 86 PID 3332 wrote to memory of 3888 3332 msedge.exe 86 PID 3332 wrote to memory of 3888 3332 msedge.exe 86 PID 3332 wrote to memory of 3888 3332 msedge.exe 86 PID 3332 wrote to memory of 3888 3332 msedge.exe 86 PID 3332 wrote to memory of 3888 3332 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\f1b7816b760f12ba96fc7060ae0938a89ffb1ecb5b0462d7c3e36f7db660a522N.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa333046f8,0x7ffa33304708,0x7ffa333047182⤵PID:1996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,7712196950755207547,5456638718735992959,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵PID:4388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,7712196950755207547,5456638718735992959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,7712196950755207547,5456638718735992959,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:82⤵PID:3888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7712196950755207547,5456638718735992959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:2712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7712196950755207547,5456638718735992959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:2324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,7712196950755207547,5456638718735992959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:82⤵PID:4188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,7712196950755207547,5456638718735992959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7712196950755207547,5456638718735992959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:12⤵PID:4000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7712196950755207547,5456638718735992959,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:12⤵PID:3148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7712196950755207547,5456638718735992959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:12⤵PID:2844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,7712196950755207547,5456638718735992959,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:12⤵PID:2220
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4648
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2000
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5bffcefacce25cd03f3d5c9446ddb903d
SHA18923f84aa86db316d2f5c122fe3874bbe26f3bab
SHA25623e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405
SHA512761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7
-
Filesize
152B
MD5d22073dea53e79d9b824f27ac5e9813e
SHA16d8a7281241248431a1571e6ddc55798b01fa961
SHA25686713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6
SHA51297152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413
-
Filesize
266B
MD5249a4f9661c5a3ebc88e3ab07fe5b83a
SHA1bbeebc2880c58b99a4516e91b2281ce040b2adc7
SHA25690c5ea9e8ea910a422e49a9a89a0ee468042420fde60716ddcb250833b328a63
SHA512a37dcaf79a34ed780007397d1f43710dc95deb6ea7657973c54d481cfbfd21b52f38052ace5f451074ad8c0462f46340f0c6ff878e20a016e57797842d168abb
-
Filesize
5KB
MD529186d4c6d63111ec8b31dcf1640b375
SHA1bbdebf90e55708aaf952204d979283f274a6002e
SHA2566f40ac467051c5ba9904b0864796cd7c61a476b073ca52424a60435ac5282028
SHA51211e109765e7ed0f1ec0018338e83bb198872c8c5acff1b4e7b6dd7edf19c0bb5a352eab22ee1f1d3c4c6e4826c73034eef8f0726ed08075e970725ec73df2d8d
-
Filesize
6KB
MD5ed8a47bfb3bfb5980d73f700ab606994
SHA17066f2042da4009ee587bee6d9916a1a8933a34f
SHA256bdd17d7b4477dd14d479cb45d657cc60daeda808a8d67255d689fa5e10a58587
SHA512c4c4851b7f7b4e274aab6874e14be6cb4336836f84ce0df7c02f25f736be8b1ba6e9ba327680f6d109594e178788b9a9a48324946985874dbdd0b0b63844adbf
-
Filesize
6KB
MD5bbe407b714ac414f76d02353c2e7b2c1
SHA12b993b25819451be5f431d9f27698e6b7ce1424d
SHA256284f41b796a1693c179e342df35fa78514164e2e5d51af54429cab079209def4
SHA512bc5db0a0004a94c07667f0dec270759f005bdfb2542863c870c3cf244432179ed8a765a9653135270e8358256c0df537a5860ee978ed58e7bd23d7fbd5120fd1
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
10KB
MD53e4d2623cb2c2e7559ea9840db980d55
SHA1deb90e885c6e5ba07f53e0930a2adfe955b19d93
SHA2564d16bb8aec086c4274b15f667f3932a741cc4d52d5ad6a7b1545b0b1bb10f155
SHA512d21d074dc8e31389911f29c1490a5fdb90cdfa0de9568debf6a53a57c1d687a4ac63b14fe9e88ba4f28207bca042151543487b41b89637f68feb85ee5de06c26