3f43257a362c9be5875ab171603766400c0dad5eaa48bbe70b6de3dfc8bd613d

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-12-2024 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

attachment-1.html
Size

4KB
MD5

5afdfeec2d5d3629827ec111471e74bf
SHA1

5f7363a45e6a61fefc517a4e3950844c1206cb71
SHA256

1af239c9e8c8647c4af4177525c3fb4f2cffbb13eb5187e5e0a7208a6c70cfbd
SHA512

cecc1eaf4113e99e6f7e760602c373bc7f1eddd4f878b3f2a88b3b5d4549d1a6a32ef3beaa257329a6b5f09fbb57d11038b026ca934274c638fb5c83858a6bd7
SSDEEP

96:snt32s97liOCmyHPrC6yVWdiJ7mcYbYwuYHkfGm+cW/lI5sdh332lYVHjcPpt4lO:4xPliOCVvyWdQmch38kfGm+tlI5sddGr

Score

7^/10

microsoft discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
39	api.ipify.org
40	api.ipify.org

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4952	msedge.exe
4952	msedge.exe
2600	identity_helper.exe
2600	identity_helper.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe
2724	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 4988	4952	msedge.exe	82
PID 4952 wrote to memory of 4988	4952	msedge.exe	82
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4308	4952	msedge.exe	83
PID 4952 wrote to memory of 4544	4952	msedge.exe	84
PID 4952 wrote to memory of 4544	4952	msedge.exe	84
PID 4952 wrote to memory of 3068	4952	msedge.exe	85
PID 4952 wrote to memory of 3068	4952	msedge.exe	85
PID 4952 wrote to memory of 3068	4952	msedge.exe	85
PID 4952 wrote to memory of 3068	4952	msedge.exe	85
PID 4952 wrote to memory of 3068	4952	msedge.exe	85
PID 4952 wrote to memory of 3068	4952	msedge.exe	85
PID 4952 wrote to memory of 3068	4952	msedge.exe	85
PID 4952 wrote to memory of 3068	4952	msedge.exe	85
PID 4952 wrote to memory of 3068	4952	msedge.exe	85
PID 4952 wrote to memory of 3068	4952	msedge.exe	85
PID 4952 wrote to memory of 3068	4952	msedge.exe	85
PID 4952 wrote to memory of 3068	4952	msedge.exe	85
PID 4952 wrote to memory of 3068	4952	msedge.exe	85
PID 4952 wrote to memory of 3068	4952	msedge.exe	85
PID 4952 wrote to memory of 3068	4952	msedge.exe	85
PID 4952 wrote to memory of 3068	4952	msedge.exe	85
PID 4952 wrote to memory of 3068	4952	msedge.exe	85
PID 4952 wrote to memory of 3068	4952	msedge.exe	85
PID 4952 wrote to memory of 3068	4952	msedge.exe	85
PID 4952 wrote to memory of 3068	4952	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\attachment-1.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff927b146f8,0x7ff927b14708,0x7ff927b14718
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,5941094011880798498,10897902786584686621,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,5941094011880798498,10897902786584686621,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,5941094011880798498,10897902786584686621,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5941094011880798498,10897902786584686621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5941094011880798498,10897902786584686621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5941094011880798498,10897902786584686621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,5941094011880798498,10897902786584686621,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,5941094011880798498,10897902786584686621,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5941094011880798498,10897902786584686621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5941094011880798498,10897902786584686621,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5941094011880798498,10897902786584686621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5941094011880798498,10897902786584686621,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,5941094011880798498,10897902786584686621,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
e4ec76fedb11bfcf1b9c4d1680918f7a

SHA1
3a65e3d74a2fdcc1d12391ac3a9a6e21fcf289bf

SHA256
7989057fec7255f3985f8be148d0fbda1b25e0016ec4128448f129e8fe53177b

SHA512
703f5ad38ab0baaa7ebb91ae27847e9f9c6b0140e52e4157e018cd20aabf17e9fc10524ea0e04bd8bd071d835efc9f524220d7a3549cb0873838ef337a3f62ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
532B

MD5
d602c397c6cc9f836ad10bf48d13ca75

SHA1
4ea9cc360a0acd9125b3a5951d7c09a6edfef9a4

SHA256
da03083cbc3a60e9f088a7f6eb3b920db246d69585ca2ef749aeaa93be5f10df

SHA512
b89f80659b886207a5547ae33a3d00be9e64ce4b8a111a0c7b8e3be7a376a5d4a609b29d50ec96628554d5f341b57267191f38f5ec91fa49a3df749d12438534

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
afcd81ee54b691b4b2ed3f7a31c77304

SHA1
57ae3d0b9c614260df34bcdd9215dfe78188832d

SHA256
8e91bbb940aee413a024acf0f6a31882d82d640af68ee1c4cbf526b793203342

SHA512
0d9ace44c29e1d198f58d064da66f5219099540191ff52d55bb2689cf8e258f0d1aa674f74663c38b0325e44a84afc292355a8e93bd689c97a0e3bf1a5cfd80f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
10426f8a4a0294f9d67e01674500f8c1

SHA1
5325b0121dc7f1c388536843c397ca6fb8ed4627

SHA256
6024f9c8ebc93042c3a571ec028398701e3412274fcb9ce972b6d1aaf303db99

SHA512
e1dc73f0067f43dbd378d8d1f4c00a8579cf50a22848b2112570b9c668ca1460fdb52655a3e348a366291e712a776d910d95d82db768d1886422d0bff311e40c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fd7b822217a6b39df161eb1649a9a110

SHA1
7b3b175633cd9988b95e7a9e5a9aa20cf6f74517

SHA256
20148a6369336caf82d0f1c055ffb5e6e8774fca78c3850b8c0bb15dc3e04b99

SHA512
aeef9bf41990246e51014a3dc5e3f614ef84c88f5cf03f1d034786daf8d74e191b163de3d07838e15217fa442fab8ba9069a524a9d8aa3d838bd135180ba24aa

Download Submit