Analysis
-
max time kernel
145s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
07-12-2023 23:33
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://tinyurl.com/at00au
Resource
win10v2004-20231130-en
General
-
Target
https://tinyurl.com/at00au
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 844 msedge.exe 844 msedge.exe 4064 msedge.exe 4064 msedge.exe 4300 identity_helper.exe 4300 identity_helper.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe 64 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4064 wrote to memory of 1484 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1484 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 1120 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 844 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 844 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 4536 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 4536 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 4536 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 4536 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 4536 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 4536 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 4536 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 4536 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 4536 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 4536 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 4536 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 4536 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 4536 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 4536 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 4536 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 4536 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 4536 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 4536 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 4536 4064 msedge.exe msedge.exe PID 4064 wrote to memory of 4536 4064 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://tinyurl.com/at00au1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a91146f8,0x7ff9a9114708,0x7ff9a91147182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,17284429171090729808,16279448504364050130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,17284429171090729808,16279448504364050130,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17284429171090729808,16279448504364050130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17284429171090729808,16279448504364050130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,17284429171090729808,16279448504364050130,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2976 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17284429171090729808,16279448504364050130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,17284429171090729808,16279448504364050130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,17284429171090729808,16279448504364050130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17284429171090729808,16279448504364050130,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17284429171090729808,16279448504364050130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17284429171090729808,16279448504364050130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17284429171090729808,16279448504364050130,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,17284429171090729808,16279448504364050130,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5524 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD526f8219c59547d181c1f9070c2f5b050
SHA1cbe34c1b41c0d86e1dff1a0bd82b6c803085a39f
SHA2563f534bb6f67e07afe3baf85bf750122c2e00b86df6aa258e5752dc6c946fc2d2
SHA5121600ed7fb809d9f4fd571b99e606ac92f0054f684b6b7a3b72ede39d5edaf458cf551c568ca1bf967326bfbdaf2f7178906fb8d15d82c52049fb6c74205c9f92
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
72B
MD547df168639a882c845a144a76c8cb40d
SHA1564233b9ceac54632d444abc61732b08720a6317
SHA256eb6da481596e83823f6567165046cfdb21636f26490aff2768d0513948188873
SHA51293de98a1a0eb03c78330d67592d5b476923f7cd4211e33a4830d51fb832d6d482eedd6350100c60b3677d49404a4bb24436047c1bdbafbf4575d294a05e1c46c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
540B
MD58b1cf484e1b93c2bc31997c67d7b6c9b
SHA125680bb0453d24747b1be6f9dca1f33b202a3a92
SHA2561803ada638e1d03c4235b4103d97b38182f67e3ef12838108abe4146e92c4fe1
SHA512d959d146faaebb50e7480c2837ebad362c52b3bf2eef68a6c132ae376afb1eadc95122c2ab0e122bf47994e4ab88563819c915b278907a45ef841b0a7930c9fb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD55ccdaaa70a7ad7f46a3cdef0dfe7dd98
SHA1bdab9778c92900683c8c9cb580b6a39eee409204
SHA2567544494a5ed54cf19e6d58af44148abee11202d6b7bfb3d05d4a7bb3c7bd4dc8
SHA512bdc5ee2dc553d116d16422d44119c6159122f4f49aa4d4de88bc871647e9cfcc4b2683bca4cceaada63c031ce8f12e90bec17d09e80e97e4eafe4904e0b67898
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5e659e460e98032d3683d18d4be4645d6
SHA1cb2d9d252dfccb80e4875681a6190888687f9631
SHA256869f851ae2fe6069f0b56498d161c45d922685da18429f7366bf35dd4438655f
SHA512797a791aef92c9724f273e42b6bbb17a1c5f9ae175138ab7703d3520d7c4a97c4d97de612d18e4d411946596a961c75f41ad6a67ee656b1195debc7cfd9599ed
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD5bc31f9c58322cd1b8eb8a246be508c80
SHA1a2ddff1b61ec55b2b0a0286525d56602f94ee208
SHA2563e48d1f92eac300ee1a79ab17d281f11c0a9c41380a53a884daf73bc6de7aebd
SHA5129c7e769a2d32855510b374e00d5ee8414db7efe547907747c8c3e2756376ad829e0f284d665b8e28df77ba58fcc84c3fae49c8af775abde3ae1c75b02883fccb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD539322cc520f708abf1fd19deccb00996
SHA12f12ac66d4917317b3dc3bde7fa54c76beb20aa0
SHA256e80de434678e6e71affcbb79f47704236bb45db28fe8ead436e268342a9af322
SHA5120d75bd0e988dd0e0326d5c4ba295295ecce0be4dbae0cc802da5565018ac30d7b9ae122dbb96e4169f374938b1a5828c7319db40bda99597608ee1119b137f0a
-
\??\pipe\LOCAL\crashpad_4064_ALMLYUKJFKAYXLJOMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e