Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2023, 13:51
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://s.id/1SBTj
Resource
win10v2004-20230703-en
General
-
Target
https://s.id/1SBTj
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3624 msedge.exe 3624 msedge.exe 4652 msedge.exe 4652 msedge.exe 4796 identity_helper.exe 4796 identity_helper.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe 4652 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4652 wrote to memory of 1568 4652 msedge.exe 83 PID 4652 wrote to memory of 1568 4652 msedge.exe 83 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3872 4652 msedge.exe 85 PID 4652 wrote to memory of 3624 4652 msedge.exe 84 PID 4652 wrote to memory of 3624 4652 msedge.exe 84 PID 4652 wrote to memory of 1632 4652 msedge.exe 86 PID 4652 wrote to memory of 1632 4652 msedge.exe 86 PID 4652 wrote to memory of 1632 4652 msedge.exe 86 PID 4652 wrote to memory of 1632 4652 msedge.exe 86 PID 4652 wrote to memory of 1632 4652 msedge.exe 86 PID 4652 wrote to memory of 1632 4652 msedge.exe 86 PID 4652 wrote to memory of 1632 4652 msedge.exe 86 PID 4652 wrote to memory of 1632 4652 msedge.exe 86 PID 4652 wrote to memory of 1632 4652 msedge.exe 86 PID 4652 wrote to memory of 1632 4652 msedge.exe 86 PID 4652 wrote to memory of 1632 4652 msedge.exe 86 PID 4652 wrote to memory of 1632 4652 msedge.exe 86 PID 4652 wrote to memory of 1632 4652 msedge.exe 86 PID 4652 wrote to memory of 1632 4652 msedge.exe 86 PID 4652 wrote to memory of 1632 4652 msedge.exe 86 PID 4652 wrote to memory of 1632 4652 msedge.exe 86 PID 4652 wrote to memory of 1632 4652 msedge.exe 86 PID 4652 wrote to memory of 1632 4652 msedge.exe 86 PID 4652 wrote to memory of 1632 4652 msedge.exe 86 PID 4652 wrote to memory of 1632 4652 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://s.id/1SBTj1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8233e46f8,0x7ff8233e4708,0x7ff8233e47182⤵PID:1568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,16962449521507650190,1072147791763092863,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,16962449521507650190,1072147791763092863,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵PID:3872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,16962449521507650190,1072147791763092863,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:82⤵PID:1632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16962449521507650190,1072147791763092863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16962449521507650190,1072147791763092863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵PID:3756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16962449521507650190,1072147791763092863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:12⤵PID:4520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,16962449521507650190,1072147791763092863,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:82⤵PID:2640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,16962449521507650190,1072147791763092863,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16962449521507650190,1072147791763092863,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:12⤵PID:1004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16962449521507650190,1072147791763092863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:12⤵PID:5020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16962449521507650190,1072147791763092863,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:12⤵PID:3888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16962449521507650190,1072147791763092863,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:12⤵PID:1424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,16962449521507650190,1072147791763092863,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2864 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4636
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1140
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:396
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5b5f5369274e3bfbc449588bbb57bd383
SHA158bb46d57bd70c1c0bcbad619353cbe185f34c3b
SHA2564190bd2ec2c0c65a2b8b97782cd3ae1d6cead80242f3595f06ebc6648c3e3464
SHA51204a3816af6c5a335cde99d97019a3f68ade65eba70e4667c4d7dd78f78910481549f1dad23a46ccf9efa2e25c6e7a7c78c592b6ace951e1aab106ba06a10fcd6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize144B
MD54d4d1c3ffee5cca063a6355867124cd9
SHA116bed7d65f1ed0894ea06bfcf12500c5d799e587
SHA2567c0948bf2a55cb4673dae7298930e0af6cf7291936ebd9941aab1cf1a18635c3
SHA5129483698c078c8aacd9041fd4969791cdcb01feed16d98d1048167cd5e9a74c1ee76e675f9ee6c892b934b103bb0e075abc632a111a042afa93331188d7b1c2b3
-
Filesize
243B
MD5dd84404c1935142714df24fa28a3c58a
SHA15f34cc52622c4d444012052766d1dac9d333e1c7
SHA2567cb3ebc1e2cab137fabe8c6178a9a37b640645634c8a7f7e738d7b5207513b57
SHA5127b3e447bed52f3e89bd219ce65800a416f917a94ed0833afb6bef8c9ef6abba37d721b888ed963c124c08b18fcbe51059ef40e07f0e8cbac0ac603d14cbf10c0
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
5KB
MD59dce6755f90a908484d78ebdd1886114
SHA14e7f4269c68077503d8b95dbc814af31fcffa45c
SHA256ae583c6a46f71e89686614afb694b7ad3c5e9e60f06155baf0759ed8cda1856a
SHA512c4c4a809672b1220eba2569980eede673ddac755fae436342e88c70451be106fb2a6cbf4f31d7bc0eead8931a1537de640958301c85f7a9c7213f8639e76f684
-
Filesize
5KB
MD55e877424fd6d4f20b7086447aa9c0ac5
SHA193c89008f1375f9346113755d0fd93eb9d11844e
SHA25674c71e959ab982e45ad6a67052768df848b2d46ca062d9bd09ca17708535c8a9
SHA5129e14b0368cade6016262b67bc51b716ccb94a3d7711864dd7d02f4134c8d3be24b6e81bcc03d626efd7e9b1abef46f12321bf7512c8c13411e05cfc608a1d5cc
-
Filesize
24KB
MD529213338df67d29d6454ee5d61ad3970
SHA18c69ca76a2e639060d5ce835a9600e6ea3764a83
SHA256d29fc0d97fa74d382d0f557ecea4e42b7d50dbce43915bfc0c114c16e532aa51
SHA51214db25eba8a863d390b97fce4315402ed7c249598ff6c31d5a191b0f71c274eead42ba0658403e744110de072e6ff1cac3bccee1e48875bde6b1fe39a60d2407
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
12KB
MD5c2e80a52535891e991a461019825a8de
SHA196c9b52b6f22c7a22fb56dc5c286115791732371
SHA256e1068aa1799085d4098af85b0af59237b05cdce226982f1455b0e961eff92ed4
SHA51267cf7e3c0e8a8e139d4e7fb254b731cfc51bb3cfe051c380d6476a22f9f0fb5e8415889c40c1752b5e579743d668407bd831e9a8c8f09698b3f3d5fe4ddac571