d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-01-2025 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eW91LmFyZUBpZGlvdC5jb20=.html
Size

315B
MD5

a34ac19f4afae63adc5d2f7bc970c07f
SHA1

a82190fc530c265aa40a045c21770d967f4767b8
SHA256

d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
SHA512

42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
556	msedge.exe
556	msedge.exe
4028	msedge.exe
4028	msedge.exe
2408	identity_helper.exe
2408	identity_helper.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 436	4028	msedge.exe	82
PID 4028 wrote to memory of 436	4028	msedge.exe	82
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 1432	4028	msedge.exe	83
PID 4028 wrote to memory of 556	4028	msedge.exe	84
PID 4028 wrote to memory of 556	4028	msedge.exe	84
PID 4028 wrote to memory of 4288	4028	msedge.exe	85
PID 4028 wrote to memory of 4288	4028	msedge.exe	85
PID 4028 wrote to memory of 4288	4028	msedge.exe	85
PID 4028 wrote to memory of 4288	4028	msedge.exe	85
PID 4028 wrote to memory of 4288	4028	msedge.exe	85
PID 4028 wrote to memory of 4288	4028	msedge.exe	85
PID 4028 wrote to memory of 4288	4028	msedge.exe	85
PID 4028 wrote to memory of 4288	4028	msedge.exe	85
PID 4028 wrote to memory of 4288	4028	msedge.exe	85
PID 4028 wrote to memory of 4288	4028	msedge.exe	85
PID 4028 wrote to memory of 4288	4028	msedge.exe	85
PID 4028 wrote to memory of 4288	4028	msedge.exe	85
PID 4028 wrote to memory of 4288	4028	msedge.exe	85
PID 4028 wrote to memory of 4288	4028	msedge.exe	85
PID 4028 wrote to memory of 4288	4028	msedge.exe	85
PID 4028 wrote to memory of 4288	4028	msedge.exe	85
PID 4028 wrote to memory of 4288	4028	msedge.exe	85
PID 4028 wrote to memory of 4288	4028	msedge.exe	85
PID 4028 wrote to memory of 4288	4028	msedge.exe	85
PID 4028 wrote to memory of 4288	4028	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\eW91LmFyZUBpZGlvdC5jb20=.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff93b0346f8,0x7ff93b034708,0x7ff93b034718
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,7415801770074671096,14681879700348262042,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,7415801770074671096,14681879700348262042,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2532 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,7415801770074671096,14681879700348262042,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7415801770074671096,14681879700348262042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7415801770074671096,14681879700348262042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,7415801770074671096,14681879700348262042,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4996 /prefetch:8
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,7415801770074671096,14681879700348262042,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4996 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7415801770074671096,14681879700348262042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7415801770074671096,14681879700348262042,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7415801770074671096,14681879700348262042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7415801770074671096,14681879700348262042,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,7415801770074671096,14681879700348262042,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5160 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f4703421463017955f7cba7973c71908

SHA1
cca911e8951d534e2a189cbafc99f2650c8e84bd

SHA256
98403255e35544c6d0ac80ab6d73019dc360a770bf2f108aa4d28697cfd8b744

SHA512
24706e0bcb5e24e07d02526ddd3930105535d552e9af164beb4b91954dd41e55e0b821aab1132fa6e07ba720f368c936b53163e6feb5cf6de8501e8e7fd07013

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7ca9ab5de99ffb796af02bfcb78f6238

SHA1
6a4ae8a9ca199bb164c4bf773e0272188a680d99

SHA256
2533ec74f5ef7199411ae9e98501975597eba42d5567973f486f8c0cbed0bfb9

SHA512
667333a8444a3e9a8cdbdcc410dc8dc67b12f8a5243ef72ee619de34bd42ec8f8663194426866377e5f8bff48af08d2750b615b31263d8a07015944793bf1ae2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1e8a2d5b2007c6cb4b126633f61cb895

SHA1
1e15076340c1529970d102c72bde92486c5b49ed

SHA256
020c42abcc731fe308e7c5aaeeb06d10af8d2415e06c0ce62b61ebd1f4dcd023

SHA512
8df627829651200f1c7d1cdb1751c3bc74f3a8143cb6d70315d53ec577b57f60e68b074c0c4775afdadd720ff9b0aa5dbef7223cc8e51866b4068b730646255d

Download Submit