Analysis
- max time kernel
1s - max time network
7s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 22:22
Static task
static1
Behavioral task
behavioral1
Sample
.html
Resource
win10v2004-20260513-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
.html
Resource
win11ltsc2024-20260709-en
26 signatures
150 seconds
General
- Target .html
- Size 25KB
- Sample260802-2ablwsshne
- SHA256 6639d05dec30f47dbc68b4e314d52ad66b7b465c3eed6c43c94b5e4973da68d7
- MD5 92ff7dae213cbe09ce408e4adc7bb7ff
- SHA1 20be8c4cba56de841d76853589567a715803da82
- SHA512 3bd3b04c2dbfeacf1717070f4423f571e82a41d6dd315818648ce998cbd822f2e17464ff137edb852a2bffeff0268001649ed581846d92894f1034355be38ba1
- SSDEEP 384:+hbLS5im/4Cjl30HE/Epmb1g9I8VkFGckQCKQZ+okj9sBrm:+h/Ssm/8HE/Epkg9I8SGfQCFU9sBC
- TLSH T165C2285B7958F33A019102B1BA7B7214AF2B0079E3748BB78498806CB54759EDDBB3CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 728 msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe 1472 msedge.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1472 wrote to memory of 4760 1472 msedge.exe 85 PID 1472 wrote to memory of 728 1472 msedge.exe 86 PID 1472 wrote to memory of 448 1472 msedge.exe 87 PID 1472 wrote to memory of 448 1472 msedge.exe 87 PID 1472 wrote to memory of 448 1472 msedge.exe 87 PID 1472 wrote to memory of 4664 1472 msedge.exe 88 PID 1472 wrote to memory of 4664 1472 msedge.exe 88 PID 1472 wrote to memory of 1436 1472 msedge.exe 90 PID 1472 wrote to memory of 1544 1472 msedge.exe 91 PID 1472 wrote to memory of 1436 1472 msedge.exe 90 PID 1472 wrote to memory of 1436 1472 msedge.exe 90 PID 1472 wrote to memory of 1544 1472 msedge.exe 91 PID 1472 wrote to memory of 1544 1472 msedge.exe 91 PID 1472 wrote to memory of 440 1472 msedge.exe 92 PID 1472 wrote to memory of 5068 1472 msedge.exe 93 PID 1472 wrote to memory of 440 1472 msedge.exe 92 PID 1472 wrote to memory of 440 1472 msedge.exe 92 PID 1472 wrote to memory of 5068 1472 msedge.exe 93 PID 1472 wrote to memory of 5068 1472 msedge.exe 93
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\.html1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff9557ec188,0x7ff9557ec194,0x7ff9557ec1a02⤵PID:4760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,14546208830617997068,16332182404997007339,524288 --field-trial-handle=2276,i,14329787974611028994,4490725288127561586,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:32⤵
- System Time Discovery
PID:728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,731572322066167546,4471823691471687270,262144 --field-trial-handle=2276,i,14329787974611028994,4490725288127561586,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:22⤵PID:448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,7698501842756087533,5624963008150565597,524288 --field-trial-handle=2276,i,14329787974611028994,4490725288127561586,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:82⤵PID:4664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,15750729725820361344,1539190653304694844,2097152 --field-trial-handle=2276,i,14329787974611028994,4490725288127561586,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:12⤵PID:1436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,4643031794570277458,16563875036342905881,2097152 --field-trial-handle=2276,i,14329787974611028994,4490725288127561586,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:12⤵PID:1544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,13243873103887996193,5387835671040650379,2097152 --field-trial-handle=2276,i,14329787974611028994,4490725288127561586,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:12⤵PID:440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,5170580243489236112,4400759952591625500,2097152 --field-trial-handle=2276,i,14329787974611028994,4490725288127561586,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:22⤵PID:5068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,6152640307633721880,9357285232365227717,524288 --field-trial-handle=2276,i,14329787974611028994,4490725288127561586,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:82⤵PID:4376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,2881698119073709047,4688868699408922184,524288 --field-trial-handle=2276,i,14329787974611028994,4490725288127561586,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:82⤵PID:3716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,1084521326105573649,2288434025730543981,524288 --field-trial-handle=2276,i,14329787974611028994,4490725288127561586,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:82⤵PID:5024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,1084521326105573649,2288434025730543981,524288 --field-trial-handle=2276,i,14329787974611028994,4490725288127561586,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:82⤵PID:4184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:752
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
- Size 105KB
- SHA256 e85b0ead13f780523006ec78ba1f44cba1401bc2d7d23b7891be113cfeb9b806
- MD5 84399925537bf33809bfbe648a5f30cd
- SHA1 3ef36da0379cc54303aa77ca9b9a75ada5a30a98
- SHA512 4ef99f0287e57485571c21bbdc1b9791c36660ad06085389dc5eb1684207048b183691af54aaa9e7a0a61dc9d362b6d1e352ae41e7a2d3b2e9da8f568b26fdac
- SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
- TLSH T19DB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
- MD5 e3962be2eb3bd350a67bf6309159a1cc
- SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
- SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
- TLSH T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
- MD5 dd54db185d82309b854bfa7657ba4600
- SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
- SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
- TLSH T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 6KB
- SHA256 7ecd9b6cf0ca4bf8bb2cb7d89070cb1547c260554ea4e5dfa0e841d96e52b0aa
- MD5 f41db8f7300737be95ad588f21cc1f01
- SHA1 a8315da76f4265730133410b30b7abc68f32fabd
- SHA512 ac3596346682f9a135521dd4982ff889184df729e9a4b7547eb81273cac522e97d1c2a97aa97991bbf4101cbf9560b8e6d6b562b32211e4872369ccc51d3f7ea
- SSDEEP 96:KA1eK2AANKK2IKiSIK/KcGMKvqK2jWKcg3o:E0RXs31l
- TLSH T191E11B1270FA62413D7E6B08876497568E41F193302DE86B7BAC65B14D26E209CFFCDD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 2c46fdf61e42cab54f8bae5d389c0577a16ec532f3a6547a1943c0d35c4cfc55
- MD5 902c2b6ba76ba1efde0f69a168334ece
- SHA1 551a91440665b6577e00f46414d4ef55602995f0
- SHA512 d9597a95ea186922d031b7e43e59f2c9c53f0a03876bab1a43cd4ab4897543a52e9ed3b4f2a21cbf2af55e00070c6cf8bfce3dadd0eb799f3c1c5ef89c96a77f
- SSDEEP 192:yON261VWQmiUyyByMgGX5Obd+jtOwaojD/a/x3w4U6:yON26WHgGX5od+ROwVyK4U6
- TLSH T18702D935A9287CB78FF3AE49F58737135FA52067E9546F84D6E81B1C00D769C2307826
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 a722c425886db006b1d3f5aa278e2f6158a1e5605a28bfffb7043b43169f4444
- MD5 b345f1a341138888ed3b2bfa95d30175
- SHA1 c34507901f5aaadbc236ef262607708d2866ae83
- SHA512 d64e985c15a93396d116ccc04fb017ef86504e6e5875e1a1ca3b43c6c8da32a3de995cf726a23e2597dbf87c58d297c9cf01a60b8bd1e1c9eb0e5063852a2fa9
- SSDEEP 192:MAONgk61TYWQmiUyyayMM1GX5Obd+jtOwaoj4EejJ/1nqLeU6:JONT6lcEGX5od+ROwVMbrU6
- TLSH T17D120A32E428BC679EE3A585F88731138EA55167DA897FC495EC2B1C01DB6AC230AC16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 567b5bedbe1b8d75c6d72e991b33d4551e2e9d482bbd30ee0b75cca580c23482
- MD5 d930a5ce520dfb965515057f2326505c
- SHA1 47f48648a24400ad02da902ba3cef821bf03249f
- SHA512 ef131de392c14c9ae491832356d362d627c54735252a5594e6923c5fb2b152851da166309bd87b9916fefa49af9ef25376aa99ef5210596d470e76ed7bd97330
- TLSH T1DE415A58BBF91148B3B77E5A9BF7A86D447F79771E0A945E00110D4F0926B40C9B2B33
- MD5 SHA1 SHA512 TLSH