hxxps://filetransfer[.]io/data-package/CIBoc80k/download

Analysis

max time kernel
160s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03-01-2024 11:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://filetransfer.io/data-package/CIBoc80k/download

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
4852	msedge.exe
4852	msedge.exe
960	identity_helper.exe
960	identity_helper.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe
600	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 3660	4852	msedge.exe	88
PID 4852 wrote to memory of 3660	4852	msedge.exe	88
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 2952	4852	msedge.exe	90
PID 4852 wrote to memory of 5040	4852	msedge.exe	89
PID 4852 wrote to memory of 5040	4852	msedge.exe	89
PID 4852 wrote to memory of 3992	4852	msedge.exe	91
PID 4852 wrote to memory of 3992	4852	msedge.exe	91
PID 4852 wrote to memory of 3992	4852	msedge.exe	91
PID 4852 wrote to memory of 3992	4852	msedge.exe	91
PID 4852 wrote to memory of 3992	4852	msedge.exe	91
PID 4852 wrote to memory of 3992	4852	msedge.exe	91
PID 4852 wrote to memory of 3992	4852	msedge.exe	91
PID 4852 wrote to memory of 3992	4852	msedge.exe	91
PID 4852 wrote to memory of 3992	4852	msedge.exe	91
PID 4852 wrote to memory of 3992	4852	msedge.exe	91
PID 4852 wrote to memory of 3992	4852	msedge.exe	91
PID 4852 wrote to memory of 3992	4852	msedge.exe	91
PID 4852 wrote to memory of 3992	4852	msedge.exe	91
PID 4852 wrote to memory of 3992	4852	msedge.exe	91
PID 4852 wrote to memory of 3992	4852	msedge.exe	91
PID 4852 wrote to memory of 3992	4852	msedge.exe	91
PID 4852 wrote to memory of 3992	4852	msedge.exe	91
PID 4852 wrote to memory of 3992	4852	msedge.exe	91
PID 4852 wrote to memory of 3992	4852	msedge.exe	91
PID 4852 wrote to memory of 3992	4852	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://filetransfer.io/data-package/CIBoc80k/download
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff055046f8,0x7fff05504708,0x7fff05504718
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,7585610896433554397,12390196696157234026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,7585610896433554397,12390196696157234026,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,7585610896433554397,12390196696157234026,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7585610896433554397,12390196696157234026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7585610896433554397,12390196696157234026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,7585610896433554397,12390196696157234026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,7585610896433554397,12390196696157234026,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7585610896433554397,12390196696157234026,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7585610896433554397,12390196696157234026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7585610896433554397,12390196696157234026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7585610896433554397,12390196696157234026,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7585610896433554397,12390196696157234026,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,7585610896433554397,12390196696157234026,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4648 /prefetch:8
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,7585610896433554397,12390196696157234026,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7a5862a0ca86c0a4e8e0b30261858e1f

SHA1
ee490d28e155806d255e0f17be72509be750bf97

SHA256
92b4c004a9ec97ccf7a19955926982bac099f3b438cd46063bb9bf5ac7814a4b

SHA512
0089df12ed908b4925ba838e07128987afe1c9235097b62855122a03ca6d34d7c75fe4c30e68581c946b77252e7edf1dd66481e20c0a9cccd37e0a4fe4f0a6fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
183B

MD5
ee26fb9b735bec4573bf5bf389449442

SHA1
d21b10b203b077e673d6bcf321b75d09c69dc478

SHA256
077851d21462f6dfab2ba1e067901347a1694ad2903fa396a7349b20673b9813

SHA512
4d3af915116ea7e40c9afa80778e9af8864627c804ccde31b0fb4536f5783c74cb55ab8b6dd36a4f7d37bf9dee296f4c027c6ec95dd35054cc65b78f2b5462b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a8d6c13e1404f08f0d6bf008130b940a

SHA1
eef53ca5e81ee1b8e0e61dfbd6e54cabd1107c3e

SHA256
2e7f1b4c61f819f12b6815b6874c74bdbbf9410381b8c77b3556e13af440c1e5

SHA512
10f10d0900e8f3c50f92aeab7d84064f14f751e099eb305f00a5f96cd0ace90c5c33f4051a1b5e02a1905a6426d2b19bd53f7fededad24f93c973ea99700f7e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
45b0b34a6ffd502bbc87a10fb07d549d

SHA1
2c64aeb437142907905acec05ade43dd4b8d1e09

SHA256
755f09474135db4af369c8b39a794a526bed3583f114e433afb7726091124a55

SHA512
313ffeb0d58be33968bd7da5269e1725cf7e2895575879c73b1feb304fff56ea4748763a6ad7a50ad31f2e5c7a8b4df4cdb7d046898c61704e4df7470a8db40c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
52826cef6409f67b78148b75e442b5ea

SHA1
a675db110aae767f5910511751cc3992cddcc393

SHA256
98fc43994599573e7181c849e5865f23b4f05f85c1115dff53c58764d80373fb

SHA512
f18df18cab6b5ecd71b79c81a2a1fdac42cc9960f62f06ac25f4d6487792705f2766ee3a10239eaac940d090186e6bc820e4eb7a5ee138f6e5c1c64f951b960c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b286bb94-2d75-47b4-95d6-ae5897653c8a.tmp

Filesize
5KB

MD5
f1762ac1eb6b8806691346b0d8286bb8

SHA1
08c06c9ce216be9d072a7023edda716c4affae24

SHA256
47601e6b4c98e1c2eb68f2c3b3b7761de26817c7e85ededd60ffa632ce3f974a

SHA512
c7152eea55b44a56f914ab80addd51677c13963a275a23d22a431bbeb2edd218620e80438a9ba164c0ad66395171f2420bc88d6f888a96e0af92c27cf331a90e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ed70cd49acdfd0e539d7bc46740a4ae7

SHA1
ada4a19c798fbf06b62673f4de5c1baa6c30d451

SHA256
9a49f58afba6bb3dc47645836f66ad6a5e38a63985e8b3ea59659b3b4ff4815f

SHA512
9bba18f3fa9991e63f83d80717b1836cbc38e1be65bb44123a7a5087995401642dfa59a8f28c3f6538564c380adacb5cac955cfcb8bae644555d7bc6fe2da632

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cc278b45d6f2252c3ff33564885bd1e1

SHA1
ddc38ef64345a316c3db3c1e940dfa72e15abdfc

SHA256
b63be45ed4850e84da869a20ecc30e7fc272b8f3632e2fcabe5cbf149220a3b0

SHA512
72aef7b55acd79d3f380ef2dcd8b773340b5171b26f19bf2a39171e5d0b0ccb4ee2f9a4ec02b5060d896b936f99d0b5ea1665f38b7166ecb9628bb54bcf4e6b7

Download Submit