hxxps://s[.]id/1SBTj

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2023, 05:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://s.id/1SBTj

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
644	msedge.exe
644	msedge.exe
2584	msedge.exe
2584	msedge.exe
668	identity_helper.exe
668	identity_helper.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe
4092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 4720	2584	msedge.exe	82
PID 2584 wrote to memory of 4720	2584	msedge.exe	82
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 1476	2584	msedge.exe	84
PID 2584 wrote to memory of 644	2584	msedge.exe	83
PID 2584 wrote to memory of 644	2584	msedge.exe	83
PID 2584 wrote to memory of 3908	2584	msedge.exe	85
PID 2584 wrote to memory of 3908	2584	msedge.exe	85
PID 2584 wrote to memory of 3908	2584	msedge.exe	85
PID 2584 wrote to memory of 3908	2584	msedge.exe	85
PID 2584 wrote to memory of 3908	2584	msedge.exe	85
PID 2584 wrote to memory of 3908	2584	msedge.exe	85
PID 2584 wrote to memory of 3908	2584	msedge.exe	85
PID 2584 wrote to memory of 3908	2584	msedge.exe	85
PID 2584 wrote to memory of 3908	2584	msedge.exe	85
PID 2584 wrote to memory of 3908	2584	msedge.exe	85
PID 2584 wrote to memory of 3908	2584	msedge.exe	85
PID 2584 wrote to memory of 3908	2584	msedge.exe	85
PID 2584 wrote to memory of 3908	2584	msedge.exe	85
PID 2584 wrote to memory of 3908	2584	msedge.exe	85
PID 2584 wrote to memory of 3908	2584	msedge.exe	85
PID 2584 wrote to memory of 3908	2584	msedge.exe	85
PID 2584 wrote to memory of 3908	2584	msedge.exe	85
PID 2584 wrote to memory of 3908	2584	msedge.exe	85
PID 2584 wrote to memory of 3908	2584	msedge.exe	85
PID 2584 wrote to memory of 3908	2584	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://s.id/1SBTj
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xc4,0x108,0x7ffe223246f8,0x7ffe22324708,0x7ffe22324718
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,13143261252258436813,4252042961876724683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,13143261252258436813,4252042961876724683,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,13143261252258436813,4252042961876724683,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13143261252258436813,4252042961876724683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13143261252258436813,4252042961876724683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13143261252258436813,4252042961876724683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,13143261252258436813,4252042961876724683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,13143261252258436813,4252042961876724683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13143261252258436813,4252042961876724683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13143261252258436813,4252042961876724683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13143261252258436813,4252042961876724683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13143261252258436813,4252042961876724683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,13143261252258436813,4252042961876724683,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5184 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8411007bafe7b1182af1ad3a1809b4f8

SHA1
4a78ee0762aadd53accae8bb211b8b18dc602070

SHA256
1f274d0d144942d00e43fb94f9c27fc91c68dce50cd374ac6be4472b08215ca3

SHA512
909e2e33b7614cb8bbd14e0dfff1b7f98f4abbf735f88292546ce3bfa665e4cb5ee4418561004e56afc5dd30d21483b05f6358dad5624c0dc3ab1ba9a3be18eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
774d297203312ebf5a54585b8c9f9a71

SHA1
0f1deea59cc157822f1a258803aa1f34fce74fad

SHA256
e69381d04fe844deb612f3f82c2eae53a7267b50a3d6a006bc3e339a29376dd4

SHA512
062052b99ca2f93ba88a1ea7e6a8b2f0fd10f886a9283a319b67210c47f1726d29453c7a6a5c2423cf8c0cfa13e356fde72eb3d4bebf4f5ec8fd57104e12984a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
243B

MD5
dd84404c1935142714df24fa28a3c58a

SHA1
5f34cc52622c4d444012052766d1dac9d333e1c7

SHA256
7cb3ebc1e2cab137fabe8c6178a9a37b640645634c8a7f7e738d7b5207513b57

SHA512
7b3e447bed52f3e89bd219ce65800a416f917a94ed0833afb6bef8c9ef6abba37d721b888ed963c124c08b18fcbe51059ef40e07f0e8cbac0ac603d14cbf10c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
af23726c35794bcc7cb62ba8972be0bd

SHA1
227a83e62758524055218444a1fe9ed0f8c50199

SHA256
5768dfe0a649e3902d469e2b005827808b31ea2f155daff9ac6421a673a01496

SHA512
b4381ac8146bc3d295b6a82b08beed08749bbaec151bd6f221e214abc86db73cd5461d4437e57b93c602fb464af6c4801031f723b885f606f594484d3e300686

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3a80ecacda7e80363e1f6c751bfa2142

SHA1
47005866df69bd5ac9bdf56bac4cdbe9e0dcacea

SHA256
4599780a82b42ce53dadb6b1a12ede2ec3437ee4c46d2876e6106f68fbea2740

SHA512
26597e5f76c124b96f5cefb3a198c90b38df294ca4b122ea5d2ce09f7f8af22616a18ed1c96b5ae8af19c9672f84065e2477272a2bf0ceb17a5bd4849a9a16ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
8caf4d73cc5a7d5e3fb3f9f1a9d4a0cc

SHA1
83f8586805286b716c70ddd14a2b7ec6a4d9d0fe

SHA256
0e0c905b688340512e84db6cf8af6dbdfe29195fefde15bd02e4917a2c5fda8c

SHA512
084ef25ea21ee1083735c61b758281ba84b607e42d0186c35c3700b24a176ada47bf2e76ed7dadd3846f2b458c977e83835ced01cda47cdd7ab2d00e5a1a294e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
bc345de89fa5500c93a85ea4a0598af5

SHA1
90faff5329b3c7cd893f613e7bdda39a719ec494

SHA256
acbefb2af49ee815027c02dc4888a6ac8e8b9531bfdb3764ef8434d0490d8156

SHA512
6f1e61a23359d911e7f814b5a562dd7899dd010d01133a9ec6b91f5afc7ed0e73670c242b24a739d9342087effd2dd72075a6274ecbb92e1c0f56953633dd6c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
12cd01c56d56f17474581b3ba52af068

SHA1
18677218a578316e984caff0c102514d7fa1faff

SHA256
3d272c50f5655178504fceaa6d400cf2424a1785d95e6c9101f97bac0a0e24b7

SHA512
68c74080aec81617e85b4d33cf053773726eb90eab482ecc34c454ba6e7430da9fb6bb7c73d83dcfafcd0371f046126c94d972b670f4eddd7400b577439e4950

Download Submit