1824be1799f0c32c14c5fcb3c5d34c98b9fb4d2b867067b8ddc3d129783812fe

Analysis

max time kernel
146s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
26/02/2025, 23:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

quarantine/GEFwbK0.html
Size

162B
MD5

1b7c22a214949975556626d7217e9a39
SHA1

d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256

340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512

ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1772	msedge.exe
1772	msedge.exe
4272	msedge.exe
4272	msedge.exe
756	identity_helper.exe
756	identity_helper.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 768	4272	msedge.exe	86
PID 4272 wrote to memory of 768	4272	msedge.exe	86
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 4488	4272	msedge.exe	87
PID 4272 wrote to memory of 1772	4272	msedge.exe	88
PID 4272 wrote to memory of 1772	4272	msedge.exe	88
PID 4272 wrote to memory of 4652	4272	msedge.exe	89
PID 4272 wrote to memory of 4652	4272	msedge.exe	89
PID 4272 wrote to memory of 4652	4272	msedge.exe	89
PID 4272 wrote to memory of 4652	4272	msedge.exe	89
PID 4272 wrote to memory of 4652	4272	msedge.exe	89
PID 4272 wrote to memory of 4652	4272	msedge.exe	89
PID 4272 wrote to memory of 4652	4272	msedge.exe	89
PID 4272 wrote to memory of 4652	4272	msedge.exe	89
PID 4272 wrote to memory of 4652	4272	msedge.exe	89
PID 4272 wrote to memory of 4652	4272	msedge.exe	89
PID 4272 wrote to memory of 4652	4272	msedge.exe	89
PID 4272 wrote to memory of 4652	4272	msedge.exe	89
PID 4272 wrote to memory of 4652	4272	msedge.exe	89
PID 4272 wrote to memory of 4652	4272	msedge.exe	89
PID 4272 wrote to memory of 4652	4272	msedge.exe	89
PID 4272 wrote to memory of 4652	4272	msedge.exe	89
PID 4272 wrote to memory of 4652	4272	msedge.exe	89
PID 4272 wrote to memory of 4652	4272	msedge.exe	89
PID 4272 wrote to memory of 4652	4272	msedge.exe	89
PID 4272 wrote to memory of 4652	4272	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\quarantine\GEFwbK0.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8297446f8,0x7ff829744708,0x7ff829744718
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,9470080567967369979,2915843246628451140,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,9470080567967369979,2915843246628451140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,9470080567967369979,2915843246628451140,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9470080567967369979,2915843246628451140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9470080567967369979,2915843246628451140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,9470080567967369979,2915843246628451140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,9470080567967369979,2915843246628451140,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9470080567967369979,2915843246628451140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9470080567967369979,2915843246628451140,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9470080567967369979,2915843246628451140,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9470080567967369979,2915843246628451140,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,9470080567967369979,2915843246628451140,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3488 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
39c51e5592e99966d676c729e840107b

SHA1
e2dd9be0ffe54508a904d314b3cf0782a9a508b7

SHA256
29f29a3495976b65de3df2d537628d260bc005da5956b262ff35e9f61d3d9ed3

SHA512
b20532d0131b12603410c3cb425cb5df0ddc740f34e688455eff757802ffc854be771b30c3ff196e56b396c6fe53928a1577c8330b00f3f7b849fcf625e51bf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
39e376ee2f541e6b1ed0bca701e8fb59

SHA1
bfe3cc2eed8721339d433533aef6e18e0a13a9a3

SHA256
80eda1e4d8c05e257ff17ef734d606e67d8ab70b3e351430b2b231631eed5e04

SHA512
a3f082c32857db0e3dec24394a259fff85e21b6a7b057ef55933504c23ec38cbb3237eb519d38385fc53cbc584c52aaf66291f44231245d9afee509a108a3350

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9bcb2d514ba3efd957eb05ae23870238

SHA1
35f1fd68170fa393150e3c99996bd54895562ab3

SHA256
39c2195f90d0f08e559b5b82d5969955242f7311c57227d6efde15c901daa886

SHA512
2345172ea06f1dfe56807e13b42b433efe336b4c64464bae22de9a14ef01881df5d109f8d82c6198749b6709461b6873fb3eb600b52823ae9bbda6fef379157c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
23128425cee77e8d2c44a586910cce0a

SHA1
06620501a1bbf08b0de2d4d5ecf9f9f1d6bc17fe

SHA256
cb649a8b1628238750eaed44fb960fde738053fffaa1fa7a5b43a51a439a0b36

SHA512
a05e40196d2b5f253e888c758eb04c54ea86bfea75b5f06037c9382f3ae8c48f01d158592b3f83a0f122bcdbded19f7eb8c6cc2e4c4054c411d31d5d62843380

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
10b1e09e2534dbb9d75fb76e9afa714f

SHA1
fd2d3d4b175852c4b097e4132796d78a614c4d83

SHA256
d649ef377e3944ab56ac2b881604588039978a98b0c45bf0dfd2e9de6418b490

SHA512
d688650f1344117e6255c7762ee6973f1182906ec77e8b285e65d1788bc8f41982dfe520159d0ca98f67f3ede13e52b8d4bcb61e770ec891f2120adec2601782

Download Submit