Analysis
-
max time kernel
112s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 20:36
Static task
static1
Behavioral task
behavioral1
Sample
6985cff3361574de9a919a8748d16d537cc8a7020cb04772004926937c7e7a06N.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6985cff3361574de9a919a8748d16d537cc8a7020cb04772004926937c7e7a06N.html
Resource
win10v2004-20241007-en
General
-
Target
6985cff3361574de9a919a8748d16d537cc8a7020cb04772004926937c7e7a06N.html
-
Size
51KB
-
MD5
b35baf7e127a15ae8564a55a3b9bbe40
-
SHA1
83f22ced766890d04546d22697cb5097065132b3
-
SHA256
6985cff3361574de9a919a8748d16d537cc8a7020cb04772004926937c7e7a06
-
SHA512
72b4f6adf0ddd738092e0207302df08eed9e70b582edba2f16b88ca7d4accad4c6d0e92dd6ab74131fa910f55170436755a2290a5c79d4388706053862691938
-
SSDEEP
1536:HIRIOITIwIgIiKZgNDfIwIGI5I7J7SwIRIOITIwIgI/KZgNDfIwIGI5ISJ7S11nb:o1ncaSbrS
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2024 msedge.exe 2024 msedge.exe 960 msedge.exe 960 msedge.exe 2556 identity_helper.exe 2556 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe 960 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 960 wrote to memory of 5060 960 msedge.exe 83 PID 960 wrote to memory of 5060 960 msedge.exe 83 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 4124 960 msedge.exe 84 PID 960 wrote to memory of 2024 960 msedge.exe 85 PID 960 wrote to memory of 2024 960 msedge.exe 85 PID 960 wrote to memory of 3596 960 msedge.exe 86 PID 960 wrote to memory of 3596 960 msedge.exe 86 PID 960 wrote to memory of 3596 960 msedge.exe 86 PID 960 wrote to memory of 3596 960 msedge.exe 86 PID 960 wrote to memory of 3596 960 msedge.exe 86 PID 960 wrote to memory of 3596 960 msedge.exe 86 PID 960 wrote to memory of 3596 960 msedge.exe 86 PID 960 wrote to memory of 3596 960 msedge.exe 86 PID 960 wrote to memory of 3596 960 msedge.exe 86 PID 960 wrote to memory of 3596 960 msedge.exe 86 PID 960 wrote to memory of 3596 960 msedge.exe 86 PID 960 wrote to memory of 3596 960 msedge.exe 86 PID 960 wrote to memory of 3596 960 msedge.exe 86 PID 960 wrote to memory of 3596 960 msedge.exe 86 PID 960 wrote to memory of 3596 960 msedge.exe 86 PID 960 wrote to memory of 3596 960 msedge.exe 86 PID 960 wrote to memory of 3596 960 msedge.exe 86 PID 960 wrote to memory of 3596 960 msedge.exe 86 PID 960 wrote to memory of 3596 960 msedge.exe 86 PID 960 wrote to memory of 3596 960 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\6985cff3361574de9a919a8748d16d537cc8a7020cb04772004926937c7e7a06N.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8568146f8,0x7ff856814708,0x7ff8568147182⤵PID:5060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,13686192964670622238,8565978754137505078,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:22⤵PID:4124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,13686192964670622238,8565978754137505078,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,13686192964670622238,8565978754137505078,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:82⤵PID:3596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,13686192964670622238,8565978754137505078,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:5000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,13686192964670622238,8565978754137505078,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:2908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,13686192964670622238,8565978754137505078,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:82⤵PID:2764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,13686192964670622238,8565978754137505078,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,13686192964670622238,8565978754137505078,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:12⤵PID:3884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,13686192964670622238,8565978754137505078,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:12⤵PID:2460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,13686192964670622238,8565978754137505078,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:1692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,13686192964670622238,8565978754137505078,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:12⤵PID:4904
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4784
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2448
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e55832d7cd7e868a2c087c4c73678018
SHA1ed7a2f6d6437e907218ffba9128802eaf414a0eb
SHA256a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574
SHA512897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f
-
Filesize
152B
MD5c2d9eeb3fdd75834f0ac3f9767de8d6f
SHA14d16a7e82190f8490a00008bd53d85fb92e379b0
SHA2561e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66
SHA512d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd
-
Filesize
454B
MD547547f9d6856a48de40e89bc8f64d094
SHA105e98800f25e43b93821656fc5ab9efcbcf6a0e0
SHA256a0d9d753a29eeac64f38a7260ffe8d376de6512aadcdebc1f9cec03c808f997f
SHA51273690d974e13dc1889feb6694a63f20e92ef90f9d4232c92aeab4e554fdad9650ac1b6799f3f240723916dcc74bbf66335be38f4e500344caa332477376dee4e
-
Filesize
6KB
MD52003213791bf8a34ff2c215f28f94930
SHA107d3eb5d27910042d84ef6c947d5d975e9b1e6c5
SHA2564aa117bb48ba759c3e351d99dd146ab12d3fbb49d8ba320dd0a01a9548bf1c81
SHA512908f1ca8d03a7880bf9e9850bdeff24436c54c3e83e834bdc496c400a435f91f8694916d82e51567e9c12d4b87082f9ccd941c34a044d854f5dee837c34409eb
-
Filesize
5KB
MD5ec57035df5888516b17f834175f4c2bd
SHA1bf8f7c5f7bde31465f7fe38756b273586ef88065
SHA256d870cf16f76139699f97f2316880b8dea03763a2da2f61cb498158561f02ebb9
SHA51221c85c3844d85e5bf4105c0f5f9074eadcf90de550b05952e13de7b2ce7d056456300ad13c1a45a3008ad499063fbb04242aa28f1fe289479f5ea9abdb0d8b9c
-
Filesize
6KB
MD545890c0d1186aefc460009d34b4336da
SHA1ede14294ceb1414b10eafbf792922f7426677c68
SHA25624aca8750e77efe473167716420d53c343ba9d5caa5d1888106fe931e97c800e
SHA512fa5a3ed9e4af726f4135372c79680ee004dc1b3f9082fa95941baff67f968f458a4989ceac698d2fc78593e15a7d1d5fb7547ff11c42666c0336add1566080cc
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5db3c75ff1f9a93b849a8350d95e08366
SHA18f80f3d26c28a78aac0883628343793332307514
SHA2569f5cc4ccad3dd7cd590745dbd6fb357b1faba428f3ebbd28cb0a3e6e40ad8e29
SHA51298962fb05905991abeb4919457d3ee73a6f0daf2565ef98465c786c2727d9457a46c976112e84c33c1947850842c309bdd3f4103f65e190b41e31908ff7a969f