hxxps://s[.]id/1SC4n

Analysis

max time kernel
146s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2023, 14:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://s.id/1SC4n

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4868	msedge.exe
4868	msedge.exe
392	msedge.exe
392	msedge.exe
2060	identity_helper.exe
2060	identity_helper.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 4088	392	msedge.exe	80
PID 392 wrote to memory of 4088	392	msedge.exe	80
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4820	392	msedge.exe	82
PID 392 wrote to memory of 4868	392	msedge.exe	81
PID 392 wrote to memory of 4868	392	msedge.exe	81
PID 392 wrote to memory of 2360	392	msedge.exe	83
PID 392 wrote to memory of 2360	392	msedge.exe	83
PID 392 wrote to memory of 2360	392	msedge.exe	83
PID 392 wrote to memory of 2360	392	msedge.exe	83
PID 392 wrote to memory of 2360	392	msedge.exe	83
PID 392 wrote to memory of 2360	392	msedge.exe	83
PID 392 wrote to memory of 2360	392	msedge.exe	83
PID 392 wrote to memory of 2360	392	msedge.exe	83
PID 392 wrote to memory of 2360	392	msedge.exe	83
PID 392 wrote to memory of 2360	392	msedge.exe	83
PID 392 wrote to memory of 2360	392	msedge.exe	83
PID 392 wrote to memory of 2360	392	msedge.exe	83
PID 392 wrote to memory of 2360	392	msedge.exe	83
PID 392 wrote to memory of 2360	392	msedge.exe	83
PID 392 wrote to memory of 2360	392	msedge.exe	83
PID 392 wrote to memory of 2360	392	msedge.exe	83
PID 392 wrote to memory of 2360	392	msedge.exe	83
PID 392 wrote to memory of 2360	392	msedge.exe	83
PID 392 wrote to memory of 2360	392	msedge.exe	83
PID 392 wrote to memory of 2360	392	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://s.id/1SC4n
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdef2246f8,0x7ffdef224708,0x7ffdef224718
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,12556622422104194948,10991471050471938431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,12556622422104194948,10991471050471938431,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,12556622422104194948,10991471050471938431,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12556622422104194948,10991471050471938431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12556622422104194948,10991471050471938431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12556622422104194948,10991471050471938431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12556622422104194948,10991471050471938431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12556622422104194948,10991471050471938431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,12556622422104194948,10991471050471938431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3404 /prefetch:8
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,12556622422104194948,10991471050471938431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12556622422104194948,10991471050471938431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12556622422104194948,10991471050471938431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,12556622422104194948,10991471050471938431,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3460 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a7ad9bb1054aa03e39b3554833d0c3ec

SHA1
cbd5b99ca100bc2f1292df23bf8e2a5a6f9640d9

SHA256
0c3eae39386b4117ad26187afc4933e254468cd12d813271f4b7420cee73c189

SHA512
d1d0b77e0bc412b4ee687e849531a7c9b70200d45d0bdbf38357b6fc59af835522e749b2fd8c2d4cde73518970568c38d73416c97381a11cc6029c14b1678276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
9d05f018d29b717f99c219221b243adb

SHA1
204083d33d2b3922d2c66ab893c73d8326525c9b

SHA256
53ec279c689422387de71c5bffd02e521aea3739ab4952b18d27af0f8258d47e

SHA512
cd7c673972ac03489f41c862a968c393ee335e62128bdc4266719333f447f17173e9a3cd1caf0e9a7c245d3c7218b63f08b0b24908cb1ac6e0d73b0c8e6d7b9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
243B

MD5
dd84404c1935142714df24fa28a3c58a

SHA1
5f34cc52622c4d444012052766d1dac9d333e1c7

SHA256
7cb3ebc1e2cab137fabe8c6178a9a37b640645634c8a7f7e738d7b5207513b57

SHA512
7b3e447bed52f3e89bd219ce65800a416f917a94ed0833afb6bef8c9ef6abba37d721b888ed963c124c08b18fcbe51059ef40e07f0e8cbac0ac603d14cbf10c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6718b1aa56b9e71288563b30526dc98a

SHA1
028eb98f432ce8824f03edbb43a7336d94a40b5a

SHA256
f166911420ad62f60d4901d32fa12ab0502e7926d258ecde9d6f508ec94d617e

SHA512
cb0a93053c89030583fbe47d358d8c6f5428a8da6721c4e831443e7a1d52138714dd6f48c75a6040bcc06ebcb650fc3930627b73345956c38a046b1099b12fad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
28473fa1e3fe806ed410997ae39d648c

SHA1
fac78b2d168d48abd5f22053dc85a146f3971298

SHA256
a2a08c43c09760c96da91505bb0b29bd20896d1b7bde16b241f28f247e74601a

SHA512
4533e86b28856b6c2bac6cd7e5a219241d968908fad6d40ada3524abd668f56df289f28b7efe9205033e44d4ec83fa27ce79b360757c22d318d35c67e9f6e041

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e62cc4051e1f8eaa0abda5d730a2496b

SHA1
d15346e40b196bc313cbfe5ac96b3c90b83345be

SHA256
ffb5b740b8777d010f0d32a120092084c3cd32eaceb937188d698ddc22df2fcb

SHA512
3e8f6d89c7c153177b2149d86cd8602ceafedf66f5335a86b19dfa46fc38c47f6ff9a272c3b71b4464a5921ebdf2461fba25692ca916b9715bac520bf1e81a22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
b771b8cf8693498b4ee73d5d04e2e408

SHA1
830a60d4be525c0da5e68dc696d154dd26af7099

SHA256
aecc7bb05b60ddbbc00c6549d223df7ce30a7f48e736c7d6bc6dcf59c507b441

SHA512
83bc4f5195dc02f4c71eabeb40f8f44116b1bf50baadfb695ccdfceec203498dd2e350f29e59e26d6120d19cacb79619bc48e04147634db91cf0c8e6715bc5b9

Download Submit