63784f25a485944de47297b410a86ef06d87908700b0d91da9ac38c5121f0767

Analysis

max time kernel
147s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
13/01/2025, 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

email-html-1.html
Size

20KB
MD5

3a7fc69de184952a924fa6b4e0f6fb0a
SHA1

e5977d08e38f988853c11c0cbd55941544f1a904
SHA256

55ca05ff83bc52def2fc2230adc20e55c7a319153d47c54dc2c84dbaabf19de4
SHA512

e31a669d99db379a9b7ff4f0a2b2c251cdd5ab4206ead050131a67f051b0f0e1cc3afb87137cc63bfe7e4fd10507c822060d0314f6a33ff753f58236cdc6e0e3
SSDEEP

192:2mAcRzQ+uf9aIskk1o+RF141h41QCHXD1121hLSEbMImXmpcRzXDuf94skk1S61R:6cNbRF1QmMLcaEvFBoLD

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1364	msedge.exe
1364	msedge.exe
4896	msedge.exe
4896	msedge.exe
4120	identity_helper.exe
4120	identity_helper.exe
2268	msedge.exe
2268	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe
2264	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 1452	4896	msedge.exe	77
PID 4896 wrote to memory of 1452	4896	msedge.exe	77
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 3872	4896	msedge.exe	78
PID 4896 wrote to memory of 1364	4896	msedge.exe	79
PID 4896 wrote to memory of 1364	4896	msedge.exe	79
PID 4896 wrote to memory of 2212	4896	msedge.exe	80
PID 4896 wrote to memory of 2212	4896	msedge.exe	80
PID 4896 wrote to memory of 2212	4896	msedge.exe	80
PID 4896 wrote to memory of 2212	4896	msedge.exe	80
PID 4896 wrote to memory of 2212	4896	msedge.exe	80
PID 4896 wrote to memory of 2212	4896	msedge.exe	80
PID 4896 wrote to memory of 2212	4896	msedge.exe	80
PID 4896 wrote to memory of 2212	4896	msedge.exe	80
PID 4896 wrote to memory of 2212	4896	msedge.exe	80
PID 4896 wrote to memory of 2212	4896	msedge.exe	80
PID 4896 wrote to memory of 2212	4896	msedge.exe	80
PID 4896 wrote to memory of 2212	4896	msedge.exe	80
PID 4896 wrote to memory of 2212	4896	msedge.exe	80
PID 4896 wrote to memory of 2212	4896	msedge.exe	80
PID 4896 wrote to memory of 2212	4896	msedge.exe	80
PID 4896 wrote to memory of 2212	4896	msedge.exe	80
PID 4896 wrote to memory of 2212	4896	msedge.exe	80
PID 4896 wrote to memory of 2212	4896	msedge.exe	80
PID 4896 wrote to memory of 2212	4896	msedge.exe	80
PID 4896 wrote to memory of 2212	4896	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-1.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffaa6d23cb8,0x7ffaa6d23cc8,0x7ffaa6d23cd8
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1788,536862009416119306,6686332104922638934,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1788,536862009416119306,6686332104922638934,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1788,536862009416119306,6686332104922638934,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1788,536862009416119306,6686332104922638934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1788,536862009416119306,6686332104922638934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1788,536862009416119306,6686332104922638934,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1788,536862009416119306,6686332104922638934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1788,536862009416119306,6686332104922638934,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1788,536862009416119306,6686332104922638934,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1788,536862009416119306,6686332104922638934,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1788,536862009416119306,6686332104922638934,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1788,536862009416119306,6686332104922638934,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2968 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
826c7cac03e3ae47bfe2a7e50281605e

SHA1
100fbea3e078edec43db48c3312fbbf83f11fca0

SHA256
239b1d7cc6f76e1d1832b0587664f114f38a21539cb8548e25626ed5053ea2ab

SHA512
a82f3c817a6460fd8907a4ac6ab37c2129fb5466707edcfb565c255680d7f7212a5669fe2a42976150f16e4e549ea8310078f22ed35514ee1b7b45b46d8cc96e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
02a4b762e84a74f9ee8a7d8ddd34fedb

SHA1
4a870e3bd7fd56235062789d780610f95e3b8785

SHA256
366e497233268d7cdf699242e4b2c7ecc1999d0a84e12744f5af2b638e9d86da

SHA512
19028c45f2e05a0cb32865a2554513c1536bf9da63512ff4e964c94a3e171f373493c7787d2d2a6df8012648bbefab63a9de924f119c50c39c727cf81bdc659f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
314B

MD5
af050c6cd0a92da63ff36ee538ed62d7

SHA1
79a163caaae3efce6d50d9c5e3ee2e6ba4bb68d3

SHA256
7f8edb968b5745a6016fadfaed053394555d00f28f9695ff9e106f2419adbff1

SHA512
8ad1f8e322c64ff2955e1bc3fd67ae6080ee5cb2e569d28ea83093c74feb7502ef92a11c277574f950516a42f371d65329c674260b94aadae966806387471f22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
81d9d2f45e88cfdf835315e52b7efe7d

SHA1
2cf4c855e21400487816b10b06d49ca7b049ec55

SHA256
fc19d7f0b2e8f97a8a1c6b4d257dc18711af8fa414d2160a809d87694116d0d8

SHA512
5b33923464b2234e320194c0b494bdbd55bb8be44b0e427389d5d5381eced8587b4d6ebde3340e983f5af2016a340b22a26755182ae17a97329af61610fcac53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dc4f456e1e4a7d0e9bda4eeb3dcf5460

SHA1
69d75404e9d8270dc56d181629aab5a6b28e4c6b

SHA256
9b99042edc4e11de6a48665e052013109004f983b5b416858e4cba312038967c

SHA512
cba320c0084eb2fb0f6d5a089017a01c84ab2325808ef3d154200688425af02c00f31dcd01774c627fa5b06dd8bfcfd97f32354a74ba417b5f78f329ec2356d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2cef2fa2241d40bed2e2a258b80840d8

SHA1
90fc422217a38e697c0b2467be1da872549a9a16

SHA256
cd55c8b192258a548626dfbbdb43fe71ea36e3592f216cda54f454a5f89a7393

SHA512
3286cecf86eb2463ebae941fe190b075659eb818067e72ea867d15d3115bfabe351b2ab904a0cc5b6f05ab886d92c6c5227d4a64eaf336aadbee038c3186d228

Download Submit