Overview

overview

1

Static

static

1

URLScan

urlscan

https://mega.nz/file...

windows10-2004-x64

1

Resubmissions

31-03-2023 17:55

230331-whl5psde7y 10

31-03-2023 17:48

230331-wdf3wsde4s 1

31-03-2023 17:47

230331-wc4gsscb74 1

31-03-2023 17:39

230331-v8eymsdd81 4

31-03-2023 16:18

230331-tsdvzabe59 4

Analysis

  • max time kernel
    2s
  • max time network
    7s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-03-2023 17:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://mega.nz/file/6pwW0ZCR#ZDz57mbDtRrC4o2xQ1n78q2zMZQ_P2ZfAzmGqa15VSE

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge https://mega.nz/file/6pwW0ZCR#ZDz57mbDtRrC4o2xQ1n78q2zMZQ_P2ZfAzmGqa15VSE
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4588
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch https://mega.nz/file/6pwW0ZCR#ZDz57mbDtRrC4o2xQ1n78q2zMZQ_P2ZfAzmGqa15VSE
    1⤵
      PID:1988
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd77fa46f8,0x7ffd77fa4708,0x7ffd77fa4718
        2⤵
          PID:4536

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
        Filesize

        152B

        MD5

        462f3c1360a4b5e319363930bc4806f6

        SHA1

        9ba5e43d833c284b89519423f6b6dab5a859a8d0

        SHA256

        fec64069c72a8d223ed89a816501b3950f5e4f5dd88f289a923c5f961d259f85

        SHA512

        5584ef75dfb8a1907c071a194fa78f56d10d1555948dffb8afcacaaa2645fd9d842a923437d0e94fad1d1919dcef5b25bf065863405c8d2a28216df27c87a417

        Download Submit
      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4mjcttnv.rht.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        Download Submit
      • memory/4588-142-0x00000250A4690000-0x00000250A46B2000-memory.dmp
        Filesize

        136KB

        Download
      • memory/4588-145-0x00000250A3B00000-0x00000250A3B10000-memory.dmp
        Filesize

        64KB

        Download