b103107dba3978b2417babd326b0cb37fb801099379c1f9addbe35b8ba7213a2

Analysis

max time kernel
50s
max time network
54s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
19-11-2024 15:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Verify_Transaction_Renewal_nbritton#INJQ9SMC.html
Size

3KB
MD5

a23923b21e3807a1bb54075cf6d96e3b
SHA1

e40e46dccaeadbada202d5a9696548ed7aacc691
SHA256

b103107dba3978b2417babd326b0cb37fb801099379c1f9addbe35b8ba7213a2
SHA512

477bfd98e7c9535e5719e852cfbc245d6cd27ec45193e4d0a02782a202a6765c98875b40920ba4e7019c261ff7ca466572d124a2034580492ec00fe4168cc6df

Score

7^/10

microsoft discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe
2748	msedge.exe
2748	msedge.exe
3096	msedge.exe
3096	msedge.exe
1828	identity_helper.exe
1828	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 3948	2748	msedge.exe	77
PID 2748 wrote to memory of 3948	2748	msedge.exe	77
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 964	2748	msedge.exe	78
PID 2748 wrote to memory of 3680	2748	msedge.exe	79
PID 2748 wrote to memory of 3680	2748	msedge.exe	79
PID 2748 wrote to memory of 3732	2748	msedge.exe	80
PID 2748 wrote to memory of 3732	2748	msedge.exe	80
PID 2748 wrote to memory of 3732	2748	msedge.exe	80
PID 2748 wrote to memory of 3732	2748	msedge.exe	80
PID 2748 wrote to memory of 3732	2748	msedge.exe	80
PID 2748 wrote to memory of 3732	2748	msedge.exe	80
PID 2748 wrote to memory of 3732	2748	msedge.exe	80
PID 2748 wrote to memory of 3732	2748	msedge.exe	80
PID 2748 wrote to memory of 3732	2748	msedge.exe	80
PID 2748 wrote to memory of 3732	2748	msedge.exe	80
PID 2748 wrote to memory of 3732	2748	msedge.exe	80
PID 2748 wrote to memory of 3732	2748	msedge.exe	80
PID 2748 wrote to memory of 3732	2748	msedge.exe	80
PID 2748 wrote to memory of 3732	2748	msedge.exe	80
PID 2748 wrote to memory of 3732	2748	msedge.exe	80
PID 2748 wrote to memory of 3732	2748	msedge.exe	80
PID 2748 wrote to memory of 3732	2748	msedge.exe	80
PID 2748 wrote to memory of 3732	2748	msedge.exe	80
PID 2748 wrote to memory of 3732	2748	msedge.exe	80
PID 2748 wrote to memory of 3732	2748	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\Verify_Transaction_Renewal_nbritton#INJQ9SMC.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc89243cb8,0x7ffc89243cc8,0x7ffc89243cd8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,4993798890925496024,11577703565234017507,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,4993798890925496024,11577703565234017507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,4993798890925496024,11577703565234017507,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,4993798890925496024,11577703565234017507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,4993798890925496024,11577703565234017507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1884,4993798890925496024,11577703565234017507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,4993798890925496024,11577703565234017507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,4993798890925496024,11577703565234017507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,4993798890925496024,11577703565234017507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,4993798890925496024,11577703565234017507,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,4993798890925496024,11577703565234017507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,4993798890925496024,11577703565234017507,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:1940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e9a2c784e6d797d91d4b8612e14d51bd

SHA1
25e2b07c396ee82e4404af09424f747fc05f04c2

SHA256
18ddbb93c981d8006071f9d26924ce3357cad212cbb65f48812d4a474c197ce6

SHA512
fc35688ae3cd448ed6b2069d39ce1219612c54f5bb0dd7b707c9e6f39450fe9fb1338cf5bd0b82a45207fac2fbab1e0eae77e5c9e6488371390eab45f76a5df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1fc959921446fa3ab5813f75ca4d0235

SHA1
0aeef3ba7ba2aa1f725fca09432d384b06995e2a

SHA256
1b1e89d3b2f3da84cc8494d07cf0babc472c426ccb1c4ae13398243360c9d02c

SHA512
899d1e1b0feece25ac97527daddcaaeb069cb428532477849eba43a627502c590261f2c26fef31e4e20efd3d7eb0815336a784c4d2888e05afcf5477af872b06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
4c2546dbaf1e4545342debe628e86380

SHA1
c6227555af3b2d89f34a01349163a9b2c3df8626

SHA256
e6f2aa388bce0d75fa45788a3085fcf3b81545227e16b46cc4c4374809e3b03d

SHA512
ea51122069b05d4fd3ab40683e8942ae5798491525fbd073e9e6d1494da82c11775d2aff5894f405b5c974abc9a6c2b9f88620ba9dd9d611a3b0b210130c6901

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b6325e85c2a21d9fb01dd17d38b9d8cb

SHA1
fb986d8d86e5c83baa3317849e0750f59d7f5f92

SHA256
f4f982490d7fbbc4958ff1e01bcf188878c9660db436c4b739ba4d0c780e7db1

SHA512
f6c91a3c811ab5be55f13f53dae55e1e9b4aa11d58bd6ffa5c7d8c0a084610b90947b3d34ddfd4d775e4449bfb6138d705483f6543e59a94fcaed5bab1adb598

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8f63468626c1a83e7cf4ecc14f97c290

SHA1
578949bf2cb470406c57d3956cd8238d0d9f3233

SHA256
fd0790f7c1b4b7e70bd76254ab5abedf7d92c2cdd6cf01cb4d1ee600223db96e

SHA512
13f41e9ff9857d9b2db6927e18c68d95b2a1599dafc0f99e2c9fb9fb66827fdb16e8244df648fbee790c69491370f32ec0081a99047b1224c9c716f5f8ae7536

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5d10a6c7508bd5f39bc1432c3de75bf3

SHA1
659c65e9c73a2c04515dccb79e2b30593020ebf0

SHA256
8172a6dd7141c4a1175e80df8f12b01eef58c86faba00a4ca960b2dd3e0b8c09

SHA512
a123eaaa8ba951c0a92600c1759092f10d073d25e2736c35eeb84fd1692fdbb7dcfbdc7c040d611c899891393bd0342b997ea9d094a77f9a5b90a1ca44d0f5c9

Download Submit