Overview
overview
10Static
static
10some-sampl...1.html
windows7-x64
3some-sampl...1.html
windows10-2004-x64
3some-sampl...0ff.js
windows7-x64
3some-sampl...0ff.js
windows10-2004-x64
3some-sampl...2.html
windows7-x64
3some-sampl...2.html
windows10-2004-x64
3some-sampl...04ed7b
ubuntu-24.04-amd64
6some-sampl...2.html
windows7-x64
3some-sampl...2.html
windows10-2004-x64
3some-sampl...60.exe
windows7-x64
some-sampl...60.exe
windows10-2004-x64
some-sampl...5f4.js
windows7-x64
3some-sampl...5f4.js
windows10-2004-x64
3some-sampl...5fc.js
windows7-x64
3some-sampl...5fc.js
windows10-2004-x64
3some-sampl...6fd.js
windows7-x64
3some-sampl...6fd.js
windows10-2004-x64
3some-sampl...ed5.js
windows7-x64
3some-sampl...ed5.js
windows10-2004-x64
3some-sampl...9.html
windows7-x64
3some-sampl...9.html
windows10-2004-x64
3some-sampl...bb5.js
windows7-x64
3some-sampl...bb5.js
windows10-2004-x64
3some-sampl...4.html
windows7-x64
3some-sampl...4.html
windows10-2004-x64
3some-sampl...e.html
windows7-x64
3some-sampl...e.html
windows10-2004-x64
3some-sampl...a4f.js
windows7-x64
3some-sampl...a4f.js
windows10-2004-x64
3some-sampl...0f6.js
windows7-x64
3some-sampl...0f6.js
windows10-2004-x64
3some-sampl...7.html
windows7-x64
3Analysis
-
max time kernel
145s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
17-02-2025 20:54
Static task
static1
Behavioral task
behavioral1
Sample
some-samples-master/000c817925bc84f700337ac1307bb1b1.html
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
some-samples-master/000c817925bc84f700337ac1307bb1b1.html
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
some-samples-master/00c5a99a4a45fd4fa41f2a1dcf8690ff.js
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral4
Sample
some-samples-master/00c5a99a4a45fd4fa41f2a1dcf8690ff.js
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
some-samples-master/00d2876c4ad4ef3bfefe452f55da9432.html
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
some-samples-master/00d2876c4ad4ef3bfefe452f55da9432.html
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
some-samples-master/010c1e2ffb9d2fc30a429b7db204ed7b
Resource
ubuntu2404-amd64-20240729-en
ubuntu-24.04-amd64
Behavioral task
behavioral8
Sample
some-samples-master/0138333b333805fa0baf93f6d0ccf342.html
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral9
Sample
some-samples-master/0138333b333805fa0baf93f6d0ccf342.html
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
some-samples-master/0157d50dcd839afb5ec4b79cae965360.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral11
Sample
some-samples-master/0157d50dcd839afb5ec4b79cae965360.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
some-samples-master/015f8027e55c523a326dd06a1082b5f4.js
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral13
Sample
some-samples-master/015f8027e55c523a326dd06a1082b5f4.js
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
some-samples-master/019be7ae89b0e13eb1b0f1ceb1d355fc.js
Resource
win7-20250207-en
windows7-x64
Behavioral task
behavioral15
Sample
some-samples-master/019be7ae89b0e13eb1b0f1ceb1d355fc.js
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
some-samples-master/01ac76f3ad93c942aa0c88ff747d06fd.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral17
Sample
some-samples-master/01ac76f3ad93c942aa0c88ff747d06fd.js
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
some-samples-master/01c3927bd930a986d3eb6b8662527ed5.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral19
Sample
some-samples-master/01c3927bd930a986d3eb6b8662527ed5.js
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
some-samples-master/01cf52ba3d0b385551b1d9fcad2e7b59.html
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral21
Sample
some-samples-master/01cf52ba3d0b385551b1d9fcad2e7b59.html
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
some-samples-master/01d8f0b4a1bef3acef8ec448a640bbb5.js
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral23
Sample
some-samples-master/01d8f0b4a1bef3acef8ec448a640bbb5.js
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
some-samples-master/01e080585e79879ea4e54844a2737d84.html
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral25
Sample
some-samples-master/01e080585e79879ea4e54844a2737d84.html
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
some-samples-master/01ed8720e305d7f53ee7cf91f1e4ca8e.html
Resource
win7-20250207-en
windows7-x64
Behavioral task
behavioral27
Sample
some-samples-master/01ed8720e305d7f53ee7cf91f1e4ca8e.html
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
some-samples-master/02150a19ad62efe92ebb7bc8a15daa4f.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral29
Sample
some-samples-master/02150a19ad62efe92ebb7bc8a15daa4f.js
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
some-samples-master/02169ba27d563c5b0bcf3cae3910a0f6.js
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral31
Sample
some-samples-master/02169ba27d563c5b0bcf3cae3910a0f6.js
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
some-samples-master/027159c684c78666d4a1eac52f89cd57.html
Resource
win7-20241023-en
windows7-x64
General
-
Target
some-samples-master/01cf52ba3d0b385551b1d9fcad2e7b59.html
-
Size
171KB
-
MD5
01cf52ba3d0b385551b1d9fcad2e7b59
-
SHA1
45d68fa808741a479bf9ab1fa6637524c8dda522
-
SHA256
7ef5fdf3711473be955049aae0088177c8be78024e5ee446d2cbc86c4d1fe23f
-
SHA512
7f1527c564d7acad396229ba58c02b4ef08aa117b9713e14144848e3622f0a4ebe2d5b5642b3397e430a76c453e0c8afc49122f0d303e7af1fcbf409e5845d04
-
SSDEEP
3072:S4kXFwsIdF1UfHySW6z0hGWc8xnobN2Yls2nmuho4amFahRMUSNHHUWfuvIyfkMN:Sr1wsIdF1UfHyx6z0hGWc8xnobN2Ylsz
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2276 msedge.exe 2276 msedge.exe 4240 msedge.exe 4240 msedge.exe 1092 msedge.exe 1092 msedge.exe 1092 msedge.exe 1092 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4240 msedge.exe 4240 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4240 wrote to memory of 3612 4240 msedge.exe 81 PID 4240 wrote to memory of 3612 4240 msedge.exe 81 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 3904 4240 msedge.exe 82 PID 4240 wrote to memory of 2276 4240 msedge.exe 83 PID 4240 wrote to memory of 2276 4240 msedge.exe 83 PID 4240 wrote to memory of 2360 4240 msedge.exe 84 PID 4240 wrote to memory of 2360 4240 msedge.exe 84 PID 4240 wrote to memory of 2360 4240 msedge.exe 84 PID 4240 wrote to memory of 2360 4240 msedge.exe 84 PID 4240 wrote to memory of 2360 4240 msedge.exe 84 PID 4240 wrote to memory of 2360 4240 msedge.exe 84 PID 4240 wrote to memory of 2360 4240 msedge.exe 84 PID 4240 wrote to memory of 2360 4240 msedge.exe 84 PID 4240 wrote to memory of 2360 4240 msedge.exe 84 PID 4240 wrote to memory of 2360 4240 msedge.exe 84 PID 4240 wrote to memory of 2360 4240 msedge.exe 84 PID 4240 wrote to memory of 2360 4240 msedge.exe 84 PID 4240 wrote to memory of 2360 4240 msedge.exe 84 PID 4240 wrote to memory of 2360 4240 msedge.exe 84 PID 4240 wrote to memory of 2360 4240 msedge.exe 84 PID 4240 wrote to memory of 2360 4240 msedge.exe 84 PID 4240 wrote to memory of 2360 4240 msedge.exe 84 PID 4240 wrote to memory of 2360 4240 msedge.exe 84 PID 4240 wrote to memory of 2360 4240 msedge.exe 84 PID 4240 wrote to memory of 2360 4240 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\payload.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9455946f8,0x7ff945594708,0x7ff9455947182⤵PID:3612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,1015800124375319689,16947817483619549231,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:22⤵PID:3904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,1015800124375319689,16947817483619549231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,1015800124375319689,16947817483619549231,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:82⤵PID:2360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1015800124375319689,16947817483619549231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:3664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1015800124375319689,16947817483619549231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:3672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,1015800124375319689,16947817483619549231,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1192 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1092
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2628
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4988
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD56cdd2d2aae57f38e1f6033a490d08b79
SHA1a54cb1af38c825e74602b18fb1280371c8865871
SHA25656e7dc53fb8968feac9775fc4e2f5474bab2d10d5f1a5db8037435694062fbff
SHA5126cf1ccd4bc6ef53d91c64f152e90f2756f34999a9b9036dc3c4423ec33e0dcee840e754d5efac6715411751facbe78acc6229a2c849877589755f7f578ef949a
-
Filesize
152B
MD5f2b08db3d95297f259f5aabbc4c36579
SHA1f5160d14e7046d541aee0c51c310b671e199f634
SHA256a43c97e4f52c27219be115d0d63f8ff38f98fc60f8aab81136e068ba82929869
SHA5123256d03196afe4fbe81ae359526e686684f5ef8ef03ce500c64a3a8a79c72b779deff71cf64c0ece7d21737ffc67062ec8114c3de5cafd7e8313bb0d08684c75
-
Filesize
6KB
MD56adba80678269f45014670cc1370f8c3
SHA1409e1221cf6e228b710ed7ec588f9ba0c1b0cceb
SHA256e659b8950027151975321f99566cf570bc9d457d9df7b684f11316669f40aba7
SHA512821eeeb17aeec2963f96953a6d5bbed627f9bdd9fb71164ea005386a75b62eca74120b8d554f72dcca4345ed8f16fb342ec7626853ec6424a2816671b282a431
-
Filesize
6KB
MD594d68a0beaea3871d98764eb004db19d
SHA15528b9aeeb8ed21384e8567f580f3369835276d5
SHA25619de34d2b7a1776092dd474a4f451fecae06f2be609681f25ce4211f25ff7ae0
SHA512261a3961eec420aa0b3a3957f890d2a5e4dde417b0002c4ae9e755f99eb1ed95d83f0c8404ea498a9242f648eb750c56ec2b3417059cdbd72117a2b65dfa673b
-
Filesize
10KB
MD5e5d2bdbb59c2074207948be219999862
SHA1dec446feec2d046f44ad4736f84711da6ed0363c
SHA256b27d868071325d2b1f7382beece532a7827f2ddaba68098e9ff6ba30dd15571e
SHA512db0db77f110f38230268fad2aa4c686a1a80d323389561e1615fdc98883a2e075790ae6dcb2f30cbdbad22fdd6ee834807a3f746920e68385c1e465dfbe70176