hxxps://s[.]id/1SBTj

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2023, 13:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://s.id/1SBTj

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3624	msedge.exe
3624	msedge.exe
4652	msedge.exe
4652	msedge.exe
4796	identity_helper.exe
4796	identity_helper.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 1568	4652	msedge.exe	83
PID 4652 wrote to memory of 1568	4652	msedge.exe	83
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3872	4652	msedge.exe	85
PID 4652 wrote to memory of 3624	4652	msedge.exe	84
PID 4652 wrote to memory of 3624	4652	msedge.exe	84
PID 4652 wrote to memory of 1632	4652	msedge.exe	86
PID 4652 wrote to memory of 1632	4652	msedge.exe	86
PID 4652 wrote to memory of 1632	4652	msedge.exe	86
PID 4652 wrote to memory of 1632	4652	msedge.exe	86
PID 4652 wrote to memory of 1632	4652	msedge.exe	86
PID 4652 wrote to memory of 1632	4652	msedge.exe	86
PID 4652 wrote to memory of 1632	4652	msedge.exe	86
PID 4652 wrote to memory of 1632	4652	msedge.exe	86
PID 4652 wrote to memory of 1632	4652	msedge.exe	86
PID 4652 wrote to memory of 1632	4652	msedge.exe	86
PID 4652 wrote to memory of 1632	4652	msedge.exe	86
PID 4652 wrote to memory of 1632	4652	msedge.exe	86
PID 4652 wrote to memory of 1632	4652	msedge.exe	86
PID 4652 wrote to memory of 1632	4652	msedge.exe	86
PID 4652 wrote to memory of 1632	4652	msedge.exe	86
PID 4652 wrote to memory of 1632	4652	msedge.exe	86
PID 4652 wrote to memory of 1632	4652	msedge.exe	86
PID 4652 wrote to memory of 1632	4652	msedge.exe	86
PID 4652 wrote to memory of 1632	4652	msedge.exe	86
PID 4652 wrote to memory of 1632	4652	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://s.id/1SBTj
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8233e46f8,0x7ff8233e4708,0x7ff8233e4718
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,16962449521507650190,1072147791763092863,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,16962449521507650190,1072147791763092863,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,16962449521507650190,1072147791763092863,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16962449521507650190,1072147791763092863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16962449521507650190,1072147791763092863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16962449521507650190,1072147791763092863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,16962449521507650190,1072147791763092863,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,16962449521507650190,1072147791763092863,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16962449521507650190,1072147791763092863,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16962449521507650190,1072147791763092863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16962449521507650190,1072147791763092863,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16962449521507650190,1072147791763092863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,16962449521507650190,1072147791763092863,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b5f5369274e3bfbc449588bbb57bd383

SHA1
58bb46d57bd70c1c0bcbad619353cbe185f34c3b

SHA256
4190bd2ec2c0c65a2b8b97782cd3ae1d6cead80242f3595f06ebc6648c3e3464

SHA512
04a3816af6c5a335cde99d97019a3f68ade65eba70e4667c4d7dd78f78910481549f1dad23a46ccf9efa2e25c6e7a7c78c592b6ace951e1aab106ba06a10fcd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
4d4d1c3ffee5cca063a6355867124cd9

SHA1
16bed7d65f1ed0894ea06bfcf12500c5d799e587

SHA256
7c0948bf2a55cb4673dae7298930e0af6cf7291936ebd9941aab1cf1a18635c3

SHA512
9483698c078c8aacd9041fd4969791cdcb01feed16d98d1048167cd5e9a74c1ee76e675f9ee6c892b934b103bb0e075abc632a111a042afa93331188d7b1c2b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
243B

MD5
dd84404c1935142714df24fa28a3c58a

SHA1
5f34cc52622c4d444012052766d1dac9d333e1c7

SHA256
7cb3ebc1e2cab137fabe8c6178a9a37b640645634c8a7f7e738d7b5207513b57

SHA512
7b3e447bed52f3e89bd219ce65800a416f917a94ed0833afb6bef8c9ef6abba37d721b888ed963c124c08b18fcbe51059ef40e07f0e8cbac0ac603d14cbf10c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9dce6755f90a908484d78ebdd1886114

SHA1
4e7f4269c68077503d8b95dbc814af31fcffa45c

SHA256
ae583c6a46f71e89686614afb694b7ad3c5e9e60f06155baf0759ed8cda1856a

SHA512
c4c4a809672b1220eba2569980eede673ddac755fae436342e88c70451be106fb2a6cbf4f31d7bc0eead8931a1537de640958301c85f7a9c7213f8639e76f684

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5e877424fd6d4f20b7086447aa9c0ac5

SHA1
93c89008f1375f9346113755d0fd93eb9d11844e

SHA256
74c71e959ab982e45ad6a67052768df848b2d46ca062d9bd09ca17708535c8a9

SHA512
9e14b0368cade6016262b67bc51b716ccb94a3d7711864dd7d02f4134c8d3be24b6e81bcc03d626efd7e9b1abef46f12321bf7512c8c13411e05cfc608a1d5cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
29213338df67d29d6454ee5d61ad3970

SHA1
8c69ca76a2e639060d5ce835a9600e6ea3764a83

SHA256
d29fc0d97fa74d382d0f557ecea4e42b7d50dbce43915bfc0c114c16e532aa51

SHA512
14db25eba8a863d390b97fce4315402ed7c249598ff6c31d5a191b0f71c274eead42ba0658403e744110de072e6ff1cac3bccee1e48875bde6b1fe39a60d2407

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c2e80a52535891e991a461019825a8de

SHA1
96c9b52b6f22c7a22fb56dc5c286115791732371

SHA256
e1068aa1799085d4098af85b0af59237b05cdce226982f1455b0e961eff92ed4

SHA512
67cf7e3c0e8a8e139d4e7fb254b731cfc51bb3cfe051c380d6476a22f9f0fb5e8415889c40c1752b5e579743d668407bd831e9a8c8f09698b3f3d5fe4ddac571

Download Submit