7c2ade0cb894f6720eeba0ee1b195d347a7d67693fcc338f3dea42f12d69e22f

Analysis

max time kernel
35s
max time network
11s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
19-11-2024 15:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Verify_Transaction_Renewal_nbritton#INJQ9SMC.html
Size

3KB
MD5

63c5927663058c3c17d6f56ccec22107
SHA1

62daaa7bd482a1be7425990b24a51553abda73bc
SHA256

7c2ade0cb894f6720eeba0ee1b195d347a7d67693fcc338f3dea42f12d69e22f
SHA512

36d7523c01f044e680cb5ae26a4e75bb91871aa1640a5cc8402990520afa8e76f8c4531af6b477cbcfd2678f2467e137f0df37022b2677c81b50431d6622377f

Score

7^/10

microsoft discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exe

pid process

3976 msedge.exe
3976 msedge.exe
4192 msedge.exe
4192 msedge.exe
1708 msedge.exe
1708 msedge.exe
1084 identity_helper.exe
1084 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

4192 msedge.exe
4192 msedge.exe
4192 msedge.exe
4192 msedge.exe
4192 msedge.exe
4192 msedge.exe
4192 msedge.exe

pid	process
3976	msedge.exe
3976	msedge.exe
4192	msedge.exe
4192	msedge.exe
1708	msedge.exe
1708	msedge.exe
1084	identity_helper.exe
1084	identity_helper.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe
4192	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4192 wrote to memory of 3948	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 3948	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 472	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 3976	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 3976	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 964	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 964	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 964	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 964	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 964	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 964	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 964	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 964	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 964	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 964	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 964	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 964	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 964	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 964	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 964	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 964	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 964	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 964	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 964	4192	msedge.exe	msedge.exe
PID 4192 wrote to memory of 964	4192	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\Verify_Transaction_Renewal_nbritton#INJQ9SMC.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc89243cb8,0x7ffc89243cc8,0x7ffc89243cd8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1304,14778693978763563817,10132916566567447375,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1304,14778693978763563817,10132916566567447375,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1304,14778693978763563817,10132916566567447375,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2492 /prefetch:8
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1304,14778693978763563817,10132916566567447375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1304,14778693978763563817,10132916566567447375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1304,14778693978763563817,10132916566567447375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1304,14778693978763563817,10132916566567447375,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1304,14778693978763563817,10132916566567447375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1304,14778693978763563817,10132916566567447375,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1304,14778693978763563817,10132916566567447375,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1304,14778693978763563817,10132916566567447375,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1304,14778693978763563817,10132916566567447375,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e9a2c784e6d797d91d4b8612e14d51bd

SHA1
25e2b07c396ee82e4404af09424f747fc05f04c2

SHA256
18ddbb93c981d8006071f9d26924ce3357cad212cbb65f48812d4a474c197ce6

SHA512
fc35688ae3cd448ed6b2069d39ce1219612c54f5bb0dd7b707c9e6f39450fe9fb1338cf5bd0b82a45207fac2fbab1e0eae77e5c9e6488371390eab45f76a5df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1fc959921446fa3ab5813f75ca4d0235

SHA1
0aeef3ba7ba2aa1f725fca09432d384b06995e2a

SHA256
1b1e89d3b2f3da84cc8494d07cf0babc472c426ccb1c4ae13398243360c9d02c

SHA512
899d1e1b0feece25ac97527daddcaaeb069cb428532477849eba43a627502c590261f2c26fef31e4e20efd3d7eb0815336a784c4d2888e05afcf5477af872b06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
5261fa49a9b1254f4343d04fadb7f956

SHA1
ed469d76cbb96356d011e011022fa5fd8e21c3e2

SHA256
8e4c08ba5462fe2568f4698d6c0ae1f6608734e0a73cb1dd858ccdee70a5a74d

SHA512
382105498e76213e75c8ddf9492c57c5cec7f42f86244591ecc1ac24880f40d12679f1a3b990e1bf62e16eb813393095a4435a607c75554e48c9da4ed6643bff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ed99a7c237e0e53f330f310ef817e542

SHA1
17bc266ceaf52ff081efa8745cc902dbcef03156

SHA256
29a70a37df368de8e9dfc6d66b5475fb6013a20dd8828ed1560b4e55f0a21261

SHA512
58f83a83a9f75b2a64c12107e7c52d92bb94578841f290cf097f5a7d1615b4cc912f090f3714fbfa797859be35689bea86cc2a0e9592b85354f629ca251fb397

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b812e52766bf5f043564355e6c85c793

SHA1
d2dddc09f344d461c004db3f60dcd31f5257dee4

SHA256
503202f1d8d02b63d91aa25d2b4377aca909d23106aa02f775d7133623c0a873

SHA512
8328c17a5a1ac8f0bca2336f573eb616891e1f7fa851e50a1e1bb86e80946ddb5090e76a1b01477ce4536b38978062740bb1cd5678eac2a2b111d9850a1a1a73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7701ba87040ffb01780f1dbc14bd8e5a

SHA1
6f641201317849b5eb4e05c22700c64de44e47ea

SHA256
99ac322a1fb533b4d72954999a5308863ac41a60c04d75d72224ef945cfada43

SHA512
f4779796f14be6e775c8d3440e25616687eb6eebf1306e1d428caa82af64fd006b509d4c6dcb22f436fd2b1f61125d26fdf61a00b66f9d450f7d43b33aa3a925

Download Submit
\??\pipe\LOCAL\crashpad_4192_CQENTFGYSKTBLTZF

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit