996e6000cebbcd231bb0ffb7c9dbe528c556d9e0081d38ecae0a6a10d432ce7d

Analysis

max time kernel
145s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 12:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Data/Nav1/DH2.htm
Size

5KB
MD5

ed75912cd0cdb539aabbb95ddfe4ffa4
SHA1

14e1c96a44b7a91a569c35718f9768e83af8833a
SHA256

35037ebbb732cf045d23cd0efcd714c6b79c6a94de595d1fcb3d37e65605d138
SHA512

e3ca9fb24ec89843085a33615a1d972031fac800014f84cdd2baa08688b88de7af53422168fd2a0f2ec3fef25fc2dbe6fbb0b0a57bc0bd72e64f8f3b624bc20f
SSDEEP

96:ucQgITXjytvQax+wBRAfmcZ3w6FiVV9dmdWdjHdlVVbdvdndZdJGLVfI1lcq1tYQ:ucJkut92Z3ADZ1EzYsrsKa

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid process

2044 msedge.exe
2044 msedge.exe
4148 msedge.exe
4148 msedge.exe
4788 identity_helper.exe
4788 identity_helper.exe
4744 msedge.exe
4744 msedge.exe
4744 msedge.exe
4744 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

4148 msedge.exe
4148 msedge.exe
4148 msedge.exe
4148 msedge.exe
4148 msedge.exe
4148 msedge.exe

pid	process
2044	msedge.exe
2044	msedge.exe
4148	msedge.exe
4148	msedge.exe
4788	identity_helper.exe
4788	identity_helper.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4148 wrote to memory of 1956	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 1956	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 3412	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 2044	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 2044	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 4336	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 4336	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 4336	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 4336	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 4336	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 4336	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 4336	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 4336	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 4336	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 4336	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 4336	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 4336	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 4336	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 4336	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 4336	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 4336	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 4336	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 4336	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 4336	4148	msedge.exe	msedge.exe
PID 4148 wrote to memory of 4336	4148	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Data\Nav1\DH2.htm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff8c3c46f8,0x7fff8c3c4708,0x7fff8c3c4718
2⤵
PID:1956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,15035017442504801258,13442005192373992483,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
2⤵
PID:3412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,15035017442504801258,13442005192373992483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,15035017442504801258,13442005192373992483,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
2⤵
PID:4336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15035017442504801258,13442005192373992483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
2⤵
PID:2300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15035017442504801258,13442005192373992483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
2⤵
PID:436

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,15035017442504801258,13442005192373992483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
2⤵
PID:4444

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,15035017442504801258,13442005192373992483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15035017442504801258,13442005192373992483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
2⤵
PID:2212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15035017442504801258,13442005192373992483,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
2⤵
PID:3720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15035017442504801258,13442005192373992483,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
2⤵
PID:4748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,15035017442504801258,13442005192373992483,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
2⤵
PID:1840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,15035017442504801258,13442005192373992483,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2756 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2396

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
71902a42760440261e66555b4c0035af

SHA1
312b3b9f71c7dd54b22cefe4e3ce1fa9d868038d

SHA256
4c2b8d7f6ac2a65cbbbb8a45b0d14bb5d1618c3f36f3f4748d0dabf6e0f2bad6

SHA512
acb2cf15402c7437ee7325e100cae5ac15e78d92bc3bb04eca5d26edbf7e271c32b74940f1da6ab128d3e46227e63d6d2442b1dd93a1e7b0947346890adc3f31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
701b045378a7d8a5a9ac61894e8645f0

SHA1
fc1bf7411b71cc0d0c0560239b8e71f37c46fceb

SHA256
dee6b88c3e3560a0a2fe8d6d4e532ef2e24bc4479e34af0aa1dc523ba0237caf

SHA512
46ed6b29de495cd08ec609704c2060e67a7ad5b4aa078eed0e629de9fe1b656726eeaa4d72579f72dd2ea842c358d438f5c8099f6ff4e455c19a93eda74d66d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
9e215cc87018c669a0c5fed00453ea5f

SHA1
6a9c9b80b4a35dbcc788cb0639ae3917178fae68

SHA256
fe5a69237b4c8577a231ce8e0eeac1705872eb39f2a3540b55af44449851e146

SHA512
b8be70420b3130a7aecdb90bf62db02af8378990c8cfca4df80bb941d599724b7af20055acd178257ab1c9d2232817e9e833227d2163c7b1ddf826757014a56a

Download Submit
\??\pipe\LOCAL\crashpad_4148_BMJKMPWFUYCDPVVO
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit