hxxps://www[.]dropbox[.]com/l/AABfnjIRYXTcSQCwsT0CKcKvKjpjypb9mKQ

Analysis

max time kernel
146s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
24/01/2024, 09:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.dropbox.com/l/AABfnjIRYXTcSQCwsT0CKcKvKjpjypb9mKQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1768	msedge.exe
1768	msedge.exe
3348	msedge.exe
3348	msedge.exe
1052	identity_helper.exe
1052	identity_helper.exe
4724	msedge.exe
4724	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3348 wrote to memory of 796	3348	msedge.exe	28
PID 3348 wrote to memory of 796	3348	msedge.exe	28
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1404	3348	msedge.exe	82
PID 3348 wrote to memory of 1768	3348	msedge.exe	81
PID 3348 wrote to memory of 1768	3348	msedge.exe	81
PID 3348 wrote to memory of 2788	3348	msedge.exe	80
PID 3348 wrote to memory of 2788	3348	msedge.exe	80
PID 3348 wrote to memory of 2788	3348	msedge.exe	80
PID 3348 wrote to memory of 2788	3348	msedge.exe	80
PID 3348 wrote to memory of 2788	3348	msedge.exe	80
PID 3348 wrote to memory of 2788	3348	msedge.exe	80
PID 3348 wrote to memory of 2788	3348	msedge.exe	80
PID 3348 wrote to memory of 2788	3348	msedge.exe	80
PID 3348 wrote to memory of 2788	3348	msedge.exe	80
PID 3348 wrote to memory of 2788	3348	msedge.exe	80
PID 3348 wrote to memory of 2788	3348	msedge.exe	80
PID 3348 wrote to memory of 2788	3348	msedge.exe	80
PID 3348 wrote to memory of 2788	3348	msedge.exe	80
PID 3348 wrote to memory of 2788	3348	msedge.exe	80
PID 3348 wrote to memory of 2788	3348	msedge.exe	80
PID 3348 wrote to memory of 2788	3348	msedge.exe	80
PID 3348 wrote to memory of 2788	3348	msedge.exe	80
PID 3348 wrote to memory of 2788	3348	msedge.exe	80
PID 3348 wrote to memory of 2788	3348	msedge.exe	80
PID 3348 wrote to memory of 2788	3348	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.dropbox.com/l/AABfnjIRYXTcSQCwsT0CKcKvKjpjypb9mKQ
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff922b53cb8,0x7ff922b53cc8,0x7ff922b53cd8
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1832,3953155039299226794,4571881876678849879,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2332 /prefetch:8
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1832,3953155039299226794,4571881876678849879,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1832,3953155039299226794,4571881876678849879,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1856 /prefetch:2
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,3953155039299226794,4571881876678849879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,3953155039299226794,4571881876678849879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1832,3953155039299226794,4571881876678849879,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,3953155039299226794,4571881876678849879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,3953155039299226794,4571881876678849879,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,3953155039299226794,4571881876678849879,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,3953155039299226794,4571881876678849879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1832,3953155039299226794,4571881876678849879,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3928 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1832,3953155039299226794,4571881876678849879,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2444 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
92e040d7c1eeb7646714b53e4a95eb91

SHA1
4eaae5706d13b5f0ca9f2e4c994cfca63890dd7d

SHA256
5342d5a6f08451e0f1c54f8e3658dd91eeba2be804f3582ddf8d6a4e2d0c6468

SHA512
e5b4c0ee79b7536679bf2e54f865f91b4957d4f66e498a026b88a6c14a13163f897f54baa9da747c1523eaf20d29cca960b8949a08a7b0ab9b0bbe92478a34f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
183B

MD5
6d7b8b13aaf175eb6ece8fb8ec08a9ec

SHA1
9b887b3f36cd12adbd0bbb8a02cb3edde501932b

SHA256
9b161006418b048745d20c8f96851b7e73d9e53180d067789d54e11dc065116c

SHA512
35bb28c4cec078c9049c161bb1927acdee65e6b666cdce06c6bd42462ffeb50fe4fce0c1a109e3d063a070cb93620f23b4a9c82992970f4e4c473af1b6d3a7e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
51691838e9bae1e8e624b306f259fc8a

SHA1
9a8c2051f81c9941f58e2b2e90ca3185a2cff771

SHA256
2b4278d6777719e90e5dc65923893542dc6e091965511ed5a7e60ad6afaa7322

SHA512
f2f9a10c87d1eef58802cbc47651ead15ea5405b09438bb37c07f3bc966cdc9126f38312f8425165526103e0d2cc27b641c3f409a8a9c72bbb3f42c455c3891d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fd9083b2d50b0a4842f25f6622e900ac

SHA1
d31229fb93c6f297032a10a8634890b020fad6ec

SHA256
765a15bf14aabd584d117132e13510eea56557be77f0e2390e37aa4def7ae5f3

SHA512
5bc579824f81cc2d70fb46d26859958cc2d1e62221bc6ce28f0d42f27f561d99e95c5d9078216427f07417cf393bf0c9fa3bd23b27cfc67ad4396a96a6bd19a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
58e2b179dbb10d049fe23616966bfb2a

SHA1
b4f722b7e798fb6347837b51b05a4314a8219d84

SHA256
cb934e662ce5441a1fec40f63ddb8b828d7cf0f4a532712907064b377d2777c4

SHA512
ef3fbdd259151b0695369fae632106d190d2b9ac20b9854c5d2c23359ffde9469ea1736e7079264fd739ef3a214ac6ac8dbb9ab6c49184e5b5ebf9b8341c0c9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4397f024ba10e48fbbb3c2f4b8323965

SHA1
b0c92a551427f09718fbff16fcc4620efd389976

SHA256
e3dfdbf17f9282e8140d1a8a671092918beb719f85a21c4b68b911a018e85e6d

SHA512
15deeb525966680a667b7aff1d739b13d136654b5473235483b4e087272a4da0ab600024349e4af9c6ff91a5648e5555ab4e874c26e80923697fa63695a36f0a

Download Submit