hxxps://ja2r7[.]app[.]goo[.]gl/Cd7UBLumkhmHH5k2A

Analysis

max time kernel
21s
max time network
24s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
02/07/2023, 22:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://ja2r7.app.goo.gl/Cd7UBLumkhmHH5k2A

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1732	powershell.exe
1732	powershell.exe
4928	msedge.exe
4928	msedge.exe
820	msedge.exe
820	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	powershell.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 2308	820	msedge.exe	87
PID 820 wrote to memory of 2308	820	msedge.exe	87
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 1424	820	msedge.exe	89
PID 820 wrote to memory of 4928	820	msedge.exe	90
PID 820 wrote to memory of 4928	820	msedge.exe	90
PID 820 wrote to memory of 488	820	msedge.exe	91
PID 820 wrote to memory of 488	820	msedge.exe	91
PID 820 wrote to memory of 488	820	msedge.exe	91
PID 820 wrote to memory of 488	820	msedge.exe	91
PID 820 wrote to memory of 488	820	msedge.exe	91
PID 820 wrote to memory of 488	820	msedge.exe	91
PID 820 wrote to memory of 488	820	msedge.exe	91
PID 820 wrote to memory of 488	820	msedge.exe	91
PID 820 wrote to memory of 488	820	msedge.exe	91
PID 820 wrote to memory of 488	820	msedge.exe	91
PID 820 wrote to memory of 488	820	msedge.exe	91
PID 820 wrote to memory of 488	820	msedge.exe	91
PID 820 wrote to memory of 488	820	msedge.exe	91
PID 820 wrote to memory of 488	820	msedge.exe	91
PID 820 wrote to memory of 488	820	msedge.exe	91
PID 820 wrote to memory of 488	820	msedge.exe	91
PID 820 wrote to memory of 488	820	msedge.exe	91
PID 820 wrote to memory of 488	820	msedge.exe	91
PID 820 wrote to memory of 488	820	msedge.exe	91
PID 820 wrote to memory of 488	820	msedge.exe	91

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell start shell:Appsfolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge https://ja2r7.app.goo.gl/Cd7UBLumkhmHH5k2A
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-redirect=Windows.Launch https://ja2r7.app.goo.gl/Cd7UBLumkhmHH5k2A
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0x78,0x104,0x7ffee04146f8,0x7ffee0414708,0x7ffee0414718
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2280,13068703398828539241,6899258021574668525,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2280,13068703398828539241,6899258021574668525,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2280,13068703398828539241,6899258021574668525,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,13068703398828539241,6899258021574668525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,13068703398828539241,6899258021574668525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,13068703398828539241,6899258021574668525,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,13068703398828539241,6899258021574668525,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2280,13068703398828539241,6899258021574668525,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:2920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
09932bc072dfd2591f537c31e7f7c5bc

SHA1
5992d292629688f3b98db35a6274f9b9ef8baef1

SHA256
41de587416d72dd9c2e27745572592deb76b2646b7c6491a6041019662a10c32

SHA512
0141ddf09fbef149d342e48c3fc98231a707b9d95f52e65c530e3a7d7f4172a68bd15c270eb44759063b528a938a14ab19c5ff400c6f7092aff793d8a93e1a47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
218e449501e9bc2755a9758e17de9cde

SHA1
b29d3810fddc119b996275825d0d6b6bfe00129f

SHA256
6d27f9bfbdbb874d2e62a7e5276ff2405fefb4971374b6b593aaf0e408b15c86

SHA512
5d0fa1934bfe03f54332134d07aad59044b05510c38b2ebd98f963867f2efc1e52aaca23e26925b395e7b5a6ae1a0c95c98d51050c909ae6a2d78ddc8f02cf68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk

Filesize
2KB

MD5
a54a781d1d7627bc71af442d9a941a0d

SHA1
85e59e6977e3b2b41c6f2ed5714f37323a4bba7b

SHA256
b416abff4de7e0e58b58fcef92d0df38bf1f96fe454b3da97143b1b8956720b6

SHA512
e8f00c4056ce8df0facd47d31faed317f07587fad0e9a07136af9851ce69401fa8ff9505b1109bc4d7423ef8fc3d3e57f44eeacc59a97067a899022ecb8b69bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
7063911c6cdc782e79ea9d57eedfb518

SHA1
1290a9ba8ce5fa40e56d52a89015bd15f5e41e8d

SHA256
1900dbee79f605950601ec528694a3ab8db9f9ce19a065b3c3dac4407e6c6403

SHA512
0dc8824376f1031d17ed468e06540b05d59a928ee976418969e7919bc7e483fdcee17f36a27dc1f6f6186df6c29ce060f80a295c3fc9ffb26c39692a398ba14f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
06031cccee6e1ce17966c1b80f33d9ef

SHA1
8bde290327d41dc22ce2fa24bac69f4e849af953

SHA256
3f5e917be6bfc9311f21bd4a8e702938814a3da67c1220db142cc94976fa4c90

SHA512
1a8875afb7f567c16a1ea01318bd97a06dcffd7470fb80f154dbdc57487c1a50ab21127e8af433f2fb0b1e753813b24d789a4fdfd9992267ff75ef0b15fc7322

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
033fe15633528b54be0ebc514c5a7f8f

SHA1
3a56231ce83d2cc24609cfa6e0b8c84238c348c0

SHA256
0b7a34c70b229d8a9e12a2a7d4961db57691f181089776965a30e68c89399884

SHA512
407dd29af66d755b30ea916c4fd9d23a18e7a87e66fbb4993f86167a410ff4f9a91a03b4b8410cbcb9043a58402e297dbb6b64d9e804d9bfab6ba38c1ddab4cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_33zcvtjr.25r.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1732-148-0x0000017ED5100000-0x0000017ED5110000-memory.dmp

Filesize
64KB

Download
memory/1732-147-0x0000017ED5100000-0x0000017ED5110000-memory.dmp

Filesize
64KB

Download
memory/1732-146-0x0000017ED5100000-0x0000017ED5110000-memory.dmp

Filesize
64KB

Download
memory/1732-145-0x0000017ED50D0000-0x0000017ED50F2000-memory.dmp

Filesize
136KB

Download