a1741a2104217776b25418bf69bb1afaf7eda75a09eccd0484a2500c863e4f9f

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2024, 19:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

View_alert_details_(KW78M).html
Size

3KB
MD5

6bf81a7b13f552ee4b6484bd80f34175
SHA1

2f4f908d5641d43fe59f9b093d6b6aa9c2ab08e9
SHA256

a1741a2104217776b25418bf69bb1afaf7eda75a09eccd0484a2500c863e4f9f
SHA512

ae3134203e7ab852bf2459236e5d51ff1690adaf368e8a8af7114d99b928db0d92815c5d2c92bd52739e521cf5693fd08664e8107a1438e3718a6e4c569545af

Score

7^/10

microsoft discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3244	msedge.exe
3244	msedge.exe
4488	msedge.exe
4488	msedge.exe
3516	identity_helper.exe
3516	identity_helper.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe
4488	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 2588	4488	msedge.exe	83
PID 4488 wrote to memory of 2588	4488	msedge.exe	83
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3960	4488	msedge.exe	84
PID 4488 wrote to memory of 3244	4488	msedge.exe	85
PID 4488 wrote to memory of 3244	4488	msedge.exe	85
PID 4488 wrote to memory of 2544	4488	msedge.exe	86
PID 4488 wrote to memory of 2544	4488	msedge.exe	86
PID 4488 wrote to memory of 2544	4488	msedge.exe	86
PID 4488 wrote to memory of 2544	4488	msedge.exe	86
PID 4488 wrote to memory of 2544	4488	msedge.exe	86
PID 4488 wrote to memory of 2544	4488	msedge.exe	86
PID 4488 wrote to memory of 2544	4488	msedge.exe	86
PID 4488 wrote to memory of 2544	4488	msedge.exe	86
PID 4488 wrote to memory of 2544	4488	msedge.exe	86
PID 4488 wrote to memory of 2544	4488	msedge.exe	86
PID 4488 wrote to memory of 2544	4488	msedge.exe	86
PID 4488 wrote to memory of 2544	4488	msedge.exe	86
PID 4488 wrote to memory of 2544	4488	msedge.exe	86
PID 4488 wrote to memory of 2544	4488	msedge.exe	86
PID 4488 wrote to memory of 2544	4488	msedge.exe	86
PID 4488 wrote to memory of 2544	4488	msedge.exe	86
PID 4488 wrote to memory of 2544	4488	msedge.exe	86
PID 4488 wrote to memory of 2544	4488	msedge.exe	86
PID 4488 wrote to memory of 2544	4488	msedge.exe	86
PID 4488 wrote to memory of 2544	4488	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\View_alert_details_(KW78M).html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e48d46f8,0x7ff9e48d4708,0x7ff9e48d4718
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,15009027627395728540,10820676947836155882,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,15009027627395728540,10820676947836155882,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,15009027627395728540,10820676947836155882,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15009027627395728540,10820676947836155882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15009027627395728540,10820676947836155882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,15009027627395728540,10820676947836155882,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,15009027627395728540,10820676947836155882,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15009027627395728540,10820676947836155882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15009027627395728540,10820676947836155882,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15009027627395728540,10820676947836155882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15009027627395728540,10820676947836155882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15009027627395728540,10820676947836155882,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,15009027627395728540,10820676947836155882,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
802B

MD5
9c0b5ae5d198d5d19679ad2505ee5258

SHA1
3b625f2f63fec7f427215e7188b86f487938a78c

SHA256
838162a54b18aeb155efcc5c9ac4032d930cbe6b254054bc9a34bb6bca1a912e

SHA512
0c27fdbdc26425fdb976ce7b84f03d9bc72208f5507b43aa5bfa797ecd05619b974d7f712dce7b71049fa168805e03af2653e206a1a195f87ffb2b87e9b9e4d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6127a117573f2b7c5b11e7f4ee57b423

SHA1
70c759c3f1d17110470a8311c45b118d5347cd59

SHA256
6a136b5036f102c028a12156061bd1e87bb84ea494bc5bfefd0382bd660745ca

SHA512
10063829b9fc4f4245b62e854b1022466f49aa2b55905fc21fda9e7e53ca9468f9994474a94782f1701c20aea96315928afcca80b16ff899312df4ef127ce993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
da8feae79c2844c45b5df01e669bb6e6

SHA1
600969d5a1bda63e11e3c9a42dcf5cde82dfe0e0

SHA256
0ab93fce1218d4eaffd76110c55954caf854f2f9423fa8e36121dc8cc7a184ee

SHA512
64c8c715aa09727d8e6e89bf15ca2d3b3b0a2a797c3b96b4fecc498d0b7a67fd0a1e592f8433ad07831648a7c7979f3dd4918df861c628e2215cc816702b693b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7a638a7bde42bed68ee9138f4823b1b4

SHA1
3afd913f57516759109880e65d0f2617bac6f7fd

SHA256
49767c999edc8d799fc028435526deee1f623adf10766864231d7582238e74fb

SHA512
14fca690317cae901127dbe6060dd6dcde8024f494f62fcae1e2d5946bb5552da4b1a4cc08d36bf74083a4a9ac5525a73f39bccca1879811d920e9691c0831d2

Download Submit