6bcbf2a6e83db87f4b61c38868a20b1b6292393ffa9b01dcad43f886ceeee311

Analysis

max time kernel
47s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 22:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 24KB
Sample241109-2xam4sthjd
SHA256 6bcbf2a6e83db87f4b61c38868a20b1b6292393ffa9b01dcad43f886ceeee311
MD5 3b21e2dcbfb28c2763ff578eb9b7900d
SHA1 72a12999f26e8dc82e16a2ed0242f5a387c58ff2
SHA512 d5032a1d92f3d53c94a1d1539230540afe79d60fda67b3865b9c90c97538ddf8a66cdaa15ddc3846a92266d8b5b77125de8087e831acc39258afb3fe8996660d
SSDEEP 384:fxBdjCBZdKMdKbdK64uzspXv/LX1IzOCeK:JqBZ/I6f/T1oeK
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
3804	msedge.exe
3804	msedge.exe
2148	identity_helper.exe
2148	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3804	msedge.exe
3804	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3804 wrote to memory of 2912	3804	msedge.exe	83
PID 3804 wrote to memory of 2912	3804	msedge.exe	83
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1504	3804	msedge.exe	84
PID 3804 wrote to memory of 1648	3804	msedge.exe	85
PID 3804 wrote to memory of 1648	3804	msedge.exe	85
PID 3804 wrote to memory of 3356	3804	msedge.exe	86
PID 3804 wrote to memory of 3356	3804	msedge.exe	86
PID 3804 wrote to memory of 3356	3804	msedge.exe	86
PID 3804 wrote to memory of 3356	3804	msedge.exe	86
PID 3804 wrote to memory of 3356	3804	msedge.exe	86
PID 3804 wrote to memory of 3356	3804	msedge.exe	86
PID 3804 wrote to memory of 3356	3804	msedge.exe	86
PID 3804 wrote to memory of 3356	3804	msedge.exe	86
PID 3804 wrote to memory of 3356	3804	msedge.exe	86
PID 3804 wrote to memory of 3356	3804	msedge.exe	86
PID 3804 wrote to memory of 3356	3804	msedge.exe	86
PID 3804 wrote to memory of 3356	3804	msedge.exe	86
PID 3804 wrote to memory of 3356	3804	msedge.exe	86
PID 3804 wrote to memory of 3356	3804	msedge.exe	86
PID 3804 wrote to memory of 3356	3804	msedge.exe	86
PID 3804 wrote to memory of 3356	3804	msedge.exe	86
PID 3804 wrote to memory of 3356	3804	msedge.exe	86
PID 3804 wrote to memory of 3356	3804	msedge.exe	86
PID 3804 wrote to memory of 3356	3804	msedge.exe	86
PID 3804 wrote to memory of 3356	3804	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffcc11d46f8,0x7ffcc11d4708,0x7ffcc11d4718
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,12338719848062752463,4498963115553977913,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,12338719848062752463,4498963115553977913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,12338719848062752463,4498963115553977913,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12338719848062752463,4498963115553977913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12338719848062752463,4498963115553977913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,12338719848062752463,4498963115553977913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,12338719848062752463,4498963115553977913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151
MD5 0a9dc42e4013fc47438e96d24beb8eff
SHA1 806ab26d7eae031a58484188a7eb1adab06457fc
SHA512 868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
MD5 61cef8e38cd95bf003f5fdd1dc37dae1
SHA1 11f2f79ecb349344c143eea9a0fed41891a3467f
SHA512 6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 186B
SHA256 5c758fedd51f8e100571438f0d21511c95488aa8bc5ac4b751ed5f349f86e047
MD5 1ba807dff113f64ceb3a4b8eb06b430b
SHA1 d3b5191e37fb2662eca40cd87f4e9caeb3893993
SHA512 dcdaa5e579874521d82820fe236fd25c8916738534335f7fba02a426199a756e1b2b9e5274af7809ce48adc3f86793544bf9ef8e175270274c884823404d1f23
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 b9f90fa7357fcdd878eef072f0d8d599a3b85932ada513c5fc9e0a3de0569aa8
MD5 88879697cfc942f7bc4b35b7ed8b7263
SHA1 442e01b34e5a412250fc3f088d9e32a6114092ee
SHA512 5a76b3ba7abd831d3125fb84a64a8bcf9fb7bf381e8e587e518245badaf3cad0a1c45576692aad76f775dbbd3a4bc9dd03e20aa4a176f8d9a0bbda0c7591d029
SSDEEP 96:nOkA9IG12yVwwpvWMoiVmdeH7CkgUWQyV+VDCziEwb:nOkdGIyVwGWMX2ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 aa2f26dc08059165fc37acdca17f36066dc794de864de8826dd46bfbbdd32db9
MD5 4e9cff3bdd5cceaafe088f90e057b2b2
SHA1 41c0d506a9861f21eba25e7370fa32b1659206bb
SHA512 a6e91b0ee9bee57f3923eaf0798e5028b7b048df0f1f4f2a7fcd6ff5a72fde9c24225d306a0ef1b79a0934b4ea90550a872d031bbff147025442b40c169bacbc
SSDEEP 96:nOk29IG12yowwpvWMoiVmdeH7CkHUWQyVxmuHVD7AiEwb:nOk7GIyowGWMXprxmc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 17203a2b031807445948ffa8f7f9e5e88335350b480483ac199ba9ee083c5be6
MD5 93e62bf44ba18e2560ac3cbd793ec81b
SHA1 c939a1f3032bf1760cd60312074c524b3f154667
SHA512 12a65e0ed1db712c18b04e7fbb55bbb90d6af787ad7d2740ed0a2384a9fc86b0ced9acd74408e942e669ea1e47148e5451983733bd53e1cce7e82771b9a1e620
SSDEEP 96:nOky9IG12yVwwpvWMoiVmdeH7CkgUWQyV+VDCAiEwb:nOknGIyVwGWMX2rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9a15ad85ca67693bce7e78d46dad16798f04d4a73684378d5ff588424edef0c4
MD5 b5f0397d7aa8253138ea03248bec5eaf
SHA1 3a19947cdc6bc54783c4584fe04521f03126220a
SHA512 ab84fb298406a1056b2993f50133cbb03a7960a1568ea47a04a5200ebc00493bf3bce0699fdaf0377073587ac52fcb87cfea05b013bc56ae6d82e1df8669640b
SSDEEP 96:nOkK9IG12y4wwpvWMoiVmdeH7ChiyWQyVxbu5VD7AiEwb:nOkPGIy4wGWMXtlxba
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 141bc90878fbf662eed77828f84768090dec7d28259b5e369b92768a3a22bbd4
MD5 3912c6846503be0537387d616841c466
SHA1 96660381b4a1a7aa35fd52d1c4c191b1613fc1b7
SHA512 5cd60dc034df65ca52d82291605b066b8bc1cba8a4db088444b9b4147c9a475851551cf935d1e9b003ec5856eaf9e35b06720f128ad544707e6cfb97ed77a1b7
SSDEEP 192:noCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupq5Ce2RU74nD3HqRUx3GPOO:/9iIxuERzA83h09RZxYq58baSFGmx8oM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 344f2937e5ea3c65480a703d442b8d7a7a13a1acfa517ef5fd429c59b56b1996
MD5 176dc905d27a7e4238c4855e9d67fa87
SHA1 cd1ae8e61c2a8caf1df80b62434e0a2759d91f67
SHA512 142eb1903aa9b2719e23c54d6b3db2d004d8148f2442a13e12e99f0e0d32d8470d22a86098cfc59897ada441b51225a6f7adfabd113aa3b431aaa2c23bfa3594
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupN5ke2RUF4nDgHqRUx3GPOO:A9iIxuERzA83h09RZxYN5K3LSFGmx8oM
MD5 SHA1 SHA512 SSDEEP

Submit Download