hxxps://rb[.]gy/8nv6z

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2023, 11:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://rb.gy/8nv6z

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3704	msedge.exe
3704	msedge.exe
60	msedge.exe
60	msedge.exe
1488	identity_helper.exe
1488	identity_helper.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 4684	3704	msedge.exe	81
PID 3704 wrote to memory of 4684	3704	msedge.exe	81
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 4516	3704	msedge.exe	84
PID 3704 wrote to memory of 60	3704	msedge.exe	83
PID 3704 wrote to memory of 60	3704	msedge.exe	83
PID 3704 wrote to memory of 232	3704	msedge.exe	82
PID 3704 wrote to memory of 232	3704	msedge.exe	82
PID 3704 wrote to memory of 232	3704	msedge.exe	82
PID 3704 wrote to memory of 232	3704	msedge.exe	82
PID 3704 wrote to memory of 232	3704	msedge.exe	82
PID 3704 wrote to memory of 232	3704	msedge.exe	82
PID 3704 wrote to memory of 232	3704	msedge.exe	82
PID 3704 wrote to memory of 232	3704	msedge.exe	82
PID 3704 wrote to memory of 232	3704	msedge.exe	82
PID 3704 wrote to memory of 232	3704	msedge.exe	82
PID 3704 wrote to memory of 232	3704	msedge.exe	82
PID 3704 wrote to memory of 232	3704	msedge.exe	82
PID 3704 wrote to memory of 232	3704	msedge.exe	82
PID 3704 wrote to memory of 232	3704	msedge.exe	82
PID 3704 wrote to memory of 232	3704	msedge.exe	82
PID 3704 wrote to memory of 232	3704	msedge.exe	82
PID 3704 wrote to memory of 232	3704	msedge.exe	82
PID 3704 wrote to memory of 232	3704	msedge.exe	82
PID 3704 wrote to memory of 232	3704	msedge.exe	82
PID 3704 wrote to memory of 232	3704	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://rb.gy/8nv6z
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x9c,0x108,0x7ffb3f1946f8,0x7ffb3f194708,0x7ffb3f194718
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,6926387730785515396,15925645654635352596,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,6926387730785515396,15925645654635352596,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,6926387730785515396,15925645654635352596,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,6926387730785515396,15925645654635352596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,6926387730785515396,15925645654635352596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,6926387730785515396,15925645654635352596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,6926387730785515396,15925645654635352596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,6926387730785515396,15925645654635352596,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,6926387730785515396,15925645654635352596,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,6926387730785515396,15925645654635352596,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,6926387730785515396,15925645654635352596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,6926387730785515396,15925645654635352596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,6926387730785515396,15925645654635352596,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,6926387730785515396,15925645654635352596,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3972 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b5f5369274e3bfbc449588bbb57bd383

SHA1
58bb46d57bd70c1c0bcbad619353cbe185f34c3b

SHA256
4190bd2ec2c0c65a2b8b97782cd3ae1d6cead80242f3595f06ebc6648c3e3464

SHA512
04a3816af6c5a335cde99d97019a3f68ade65eba70e4667c4d7dd78f78910481549f1dad23a46ccf9efa2e25c6e7a7c78c592b6ace951e1aab106ba06a10fcd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
173B

MD5
87c0fe159a80c94492dc475ec40b1889

SHA1
3c5de14c786814aedf8652c940d8c4e544fc4d5e

SHA256
ce5e57416de1737c552ccb3d1bdf07d77eadf42605d30b3d2f7ef96876cf0443

SHA512
7962794b0d28de37a17d1ed858b0845c0415a376a2be8f6f87167245444369aea3de96823327a5fecf537a20289adfd814a827045ac455162fc3e52f88392568

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
50e6fd3ec9c67351d0db58ff69464c01

SHA1
f8b7fe91ed8a304034d4f1f2a57aebbaf09a70c4

SHA256
91183522ccc7433776b82b778f7485955a23a68b363c6a96ced253068449c99b

SHA512
bf2ccb67f099eaf7a4c959d76ca33010bd8062bf59237b4d5cbe6bfe4d6f0777ad4a9d08bd28d064fdba43179a1011738a2e74d841d2eeecdf0bb914df285cb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
45c1b9bbc88dc0a377b97988219d6253

SHA1
9085382ea023f20c0882ceade3ccd9daa5b21df0

SHA256
c4debf6d40b414dcc4423953e8385699a47f2ab2445463ef93945463c2ec40b7

SHA512
b054070fe02022d2f720d030cbb19e3751d42af026b108f8fe8b5e03d87b975049114dae4edd1c04b99cd5d0e246636367ca98732db156eb9e5ba46cb2dc1238

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
29213338df67d29d6454ee5d61ad3970

SHA1
8c69ca76a2e639060d5ce835a9600e6ea3764a83

SHA256
d29fc0d97fa74d382d0f557ecea4e42b7d50dbce43915bfc0c114c16e532aa51

SHA512
14db25eba8a863d390b97fce4315402ed7c249598ff6c31d5a191b0f71c274eead42ba0658403e744110de072e6ff1cac3bccee1e48875bde6b1fe39a60d2407

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
3e0813dd9cf5ab2afa09c913699df02d

SHA1
d40e8aa220256d8a3ce20a9ea5aca386a2da5e4e

SHA256
d567954a8681436a73e74b56d913181842fdce48d2e8cdcff9bbd8e011efd762

SHA512
8c5762b19416aa44a6f2880561127375703026545b4c48701ba848c69e0e4a724f9171671a518432f4b20ab0016baf1621e2ebbcc22ad64c3bb2980a69175bb0

Download Submit