Analysis
-
max time kernel
145s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 21:17
Static task
static1
Behavioral task
behavioral1
Sample
cloud.html
Resource
win7-20241010-en
General
-
Target
cloud.html
-
Size
296KB
-
MD5
dc4a239890b3e932b664ba27d7fac1e3
-
SHA1
0206933ba63a5d8da5b58c8f613f680dc84c5008
-
SHA256
b057adb24b01b88dcdfb1b57d59989736a96e3aef2579787ef4f811f52fb3fcb
-
SHA512
c0fa5854f766b9a59bd9449b63c3429cf3d969a44219e6dc345556449ee96d49a00072c28af8f5ca1ec69f569b1ae383cd08e69ca34b5ca489ab29ed0abbb2eb
-
SSDEEP
3072:J11pCQt/DDTDXLQy8U5y97yLx8nXBuU6v/97/ex8yHrHNp9Bw9bCyDW6RVLlk:J11RnLbL1iXBg1sHrtp9WC
Malware Config
Signatures
-
A potential corporate email address has been identified in the URL: [email protected]
-
A potential corporate email address has been identified in the URL: [email protected]
-
A potential corporate email address has been identified in the URL: [email protected]
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1508 msedge.exe 1508 msedge.exe 4976 msedge.exe 4976 msedge.exe 1812 identity_helper.exe 1812 identity_helper.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe 4976 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4976 wrote to memory of 4512 4976 msedge.exe 83 PID 4976 wrote to memory of 4512 4976 msedge.exe 83 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 4612 4976 msedge.exe 84 PID 4976 wrote to memory of 1508 4976 msedge.exe 85 PID 4976 wrote to memory of 1508 4976 msedge.exe 85 PID 4976 wrote to memory of 336 4976 msedge.exe 86 PID 4976 wrote to memory of 336 4976 msedge.exe 86 PID 4976 wrote to memory of 336 4976 msedge.exe 86 PID 4976 wrote to memory of 336 4976 msedge.exe 86 PID 4976 wrote to memory of 336 4976 msedge.exe 86 PID 4976 wrote to memory of 336 4976 msedge.exe 86 PID 4976 wrote to memory of 336 4976 msedge.exe 86 PID 4976 wrote to memory of 336 4976 msedge.exe 86 PID 4976 wrote to memory of 336 4976 msedge.exe 86 PID 4976 wrote to memory of 336 4976 msedge.exe 86 PID 4976 wrote to memory of 336 4976 msedge.exe 86 PID 4976 wrote to memory of 336 4976 msedge.exe 86 PID 4976 wrote to memory of 336 4976 msedge.exe 86 PID 4976 wrote to memory of 336 4976 msedge.exe 86 PID 4976 wrote to memory of 336 4976 msedge.exe 86 PID 4976 wrote to memory of 336 4976 msedge.exe 86 PID 4976 wrote to memory of 336 4976 msedge.exe 86 PID 4976 wrote to memory of 336 4976 msedge.exe 86 PID 4976 wrote to memory of 336 4976 msedge.exe 86 PID 4976 wrote to memory of 336 4976 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\cloud.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8dee146f8,0x7ff8dee14708,0x7ff8dee147182⤵PID:4512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,10953510768196633664,12188987183416914760,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:22⤵PID:4612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,10953510768196633664,12188987183416914760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,10953510768196633664,12188987183416914760,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:82⤵PID:336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10953510768196633664,12188987183416914760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:3712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10953510768196633664,12188987183416914760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:3492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,10953510768196633664,12188987183416914760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6000 /prefetch:82⤵PID:1188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,10953510768196633664,12188987183416914760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6000 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10953510768196633664,12188987183416914760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:12⤵PID:2904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10953510768196633664,12188987183416914760,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:12⤵PID:2020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10953510768196633664,12188987183416914760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:12⤵PID:2192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,10953510768196633664,12188987183416914760,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:12⤵PID:4940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,10953510768196633664,12188987183416914760,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4804 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1916
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3452
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4464
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5b8880802fc2bb880a7a869faa01315b0
SHA151d1a3fa2c272f094515675d82150bfce08ee8d3
SHA256467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812
SHA512e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2
-
Filesize
152B
MD5ba6ef346187b40694d493da98d5da979
SHA1643c15bec043f8673943885199bb06cd1652ee37
SHA256d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73
SHA5122e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c
-
Filesize
1KB
MD544cf8fa9bbf37f71bce787f168a36008
SHA16b121aa4ea3534266d07b0b33a339263114f8603
SHA256ff64ef3ed0642d5ff10b9aeda1c3185c9e09f038643d591f1db4a64db1c5fa5b
SHA512686c98432769142d32cf9253bcf2fe3901e1a32dade17427fd7069c76648cdb8a77f6556e864d64df6d2033122b203bb695a9199efe9e2193a36c41d94ccc6a2
-
Filesize
6KB
MD5e6ee6d5f26e104af98bc55490891641a
SHA1416fbf5130b07349ec50b0c4f94c1541fef22b42
SHA25651e8e5627a7988e45e1cc5226680b5a3dae6ba4c0b8a78c7daa0cecba1c40c9c
SHA512a6b29c0e027c474c5cccd984c5b0cd8845ad23f46f570068309256ae4f2ab9066e9bd393462469fd5e10decec21924d882f1ee2fb2f468f997251c6deba7b0be
-
Filesize
5KB
MD5432d2406fcb5e9438daa621ddb2d08bd
SHA134923085645b920eb112189f71cca025ca8dc0df
SHA2563b93dae9b65cae143ed674fb80d6b136a2a961e01c49dd13c5050a6a1222e521
SHA5129e3753368d62db2b52c039ba72fa6a68a4d485a053099fe9805771ead19898909a31ac839662179ceaec2aa62d5fa10f490436793f86a9e0033089f47fd8c22e
-
Filesize
6KB
MD5b1492b7b6e065ed1a9f92314a922cd0e
SHA1914b9f8d6a1c671c9712fd1449401a37a90ae08a
SHA2567ebc1a3cdb90807374e4df2a1bcf3df882160312566519f9942f51e15536de91
SHA512215afdfa4fc58199b150a3d45a37ba0db58dedafd60b6ac9899a33fa6dfcaf8e2b26cedd97f1652d0d9a2e10fd8c9acf106083f77aae6d4d92b2058a8704cd0b
-
Filesize
539B
MD586a7ba911bf728ce262f7c98313b41f4
SHA15da962ab0ce1631340bfd9e9d1548c113ddcdf96
SHA256fce80723cfaa728923a1df9527c14314568f7da925a8e72cf197ea96a5b114b9
SHA51208750834e99dab782f3678524611bd522ce78bdd1b49f9a62df0fc476b4df11f70d70f49aab438317b12276e4240b4f1d9a212a8f20c5f8ff7eac0afd3147caf
-
Filesize
371B
MD58f87d8fc19dca318625175a860f8da91
SHA1e5f322980041f08f559412c33d206808ddb7d80c
SHA256a984e7649e1b0c9587ec6f2abc5f5629e4fc5816d6c9e628b54aea84ae016704
SHA51275688e96963135dad4989e5316f19481d5be6961db975b73e9f990d29ef801d061c83649401029f844c787ca18523f2b68c474328e5f4798e1045736d169d706
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5fa0805efbd5f140dd07b0d26e5516004
SHA14f83ff2347df14aa75c2a9c29d0a2cf81a2f9aa5
SHA25609041f49ff903d44fbe8408b96579e3e131182b39d8f24ba13faaad2b118cb34
SHA512ed9d43c57f66a0a22f0f67262c349d6e670174f401e66feee5ab9d770dd9bc5f3a70b2a38c544e1f55fc8708171e4c278a4f15ae7435aaa24460a392683f8892