hxxps://go-link[.]ru/P2YXa

General

Target

https://go-link.ru/P2YXa

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4132	msedge.exe
4132	msedge.exe
3876	msedge.exe
3876	msedge.exe
2296	identity_helper.exe
2296	identity_helper.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe
332	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3876 wrote to memory of 4872	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 4872	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 3584	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 4132	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 4132	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 468	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 468	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 468	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 468	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 468	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 468	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 468	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 468	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 468	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 468	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 468	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 468	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 468	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 468	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 468	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 468	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 468	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 468	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 468	3876	msedge.exe	msedge.exe
PID 3876 wrote to memory of 468	3876	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-link.ru/P2YXa
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8bf7e46f8,0x7ff8bf7e4708,0x7ff8bf7e4718
2⤵
PID:4872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,17178654608554047245,14831765124052975320,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,17178654608554047245,14831765124052975320,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
2⤵
PID:3584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1992,17178654608554047245,14831765124052975320,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
2⤵
PID:468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,17178654608554047245,14831765124052975320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
2⤵
PID:4564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,17178654608554047245,14831765124052975320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
2⤵
PID:1544

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,17178654608554047245,14831765124052975320,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4816 /prefetch:8
2⤵
PID:4780

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,17178654608554047245,14831765124052975320,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4816 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,17178654608554047245,14831765124052975320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
2⤵
PID:2076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,17178654608554047245,14831765124052975320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3708 /prefetch:1
2⤵
PID:4048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,17178654608554047245,14831765124052975320,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
2⤵
PID:1844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,17178654608554047245,14831765124052975320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4488 /prefetch:1
2⤵
PID:3508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,17178654608554047245,14831765124052975320,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
2⤵
PID:4136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,17178654608554047245,14831765124052975320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
2⤵
PID:916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,17178654608554047245,14831765124052975320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
2⤵
PID:3552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,17178654608554047245,14831765124052975320,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5904 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,17178654608554047245,14831765124052975320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4372 /prefetch:1
2⤵
PID:3208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3064

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
343e73b39eb89ceab25618efc0cd8c8c

SHA1
6a5c7dcfd4cd4088793de6a3966aa914a07faf4c

SHA256
6ea83db86f592a3416738a1f1de5db00cd0408b0de820256d09d9bee9e291223

SHA512
54f321405b91fe397b50597b80564cff3a4b7ccb9aaf47cdf832a0932f30a82ed034ca75a422506c7b609a95b2ed97db58d517089cd85e38187112525ca499cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
d4c957a0a66b47d997435ead0940becf

SHA1
1aed2765dd971764b96455003851f8965e3ae07d

SHA256
53fa86fbddf4cdddab1f884c7937ba334fce81ddc59e9b2522fec2d19c7fc163

SHA512
19cd43e9756829911685916ce9ac8f0375f2f686bfffdf95a6259d8ee767d487151fc938e88b8aada5777364a313ad6b2af8bc1aa601c59f0163cbca7c108fbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
5796d56a8d85ba8e748e5a747ee1d306

SHA1
533720ac59db0ea33c61a5735f4c827eb8ff72e4

SHA256
1c33d0199669de266f234f78785597ad4627ef1b3bc733ea60cb08cceffe277b

SHA512
d684f48efcf79b1e7a092e242f4011a4a9c7aa6ef880605c41834feaf0c00ab69be7a99b219fb01e0b0618b7fc80701094aa740ea0ba4f9de5559b56740ed097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
ef19ffa7d43f7e504a71e3a2e86ccca7

SHA1
10836f106fee52b86c1e990a8e6236ea7132a8ef

SHA256
d723bc532ab7b4de8ae566cc2c285b5b0e513b6141511d73c1fe7c32a7869746

SHA512
1610e310c41e641a551565bd5051c51ee876b840c979e50e1ef39c1a4e7f1a23b78fb73277e6c72c8c2c228ef399db2b95267c812f05cf429bc3b74cacb15a49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
9KB

MD5
a58dfb815908d200f5f150c8a9bf5b8d

SHA1
fb200db798910691fa285f46b18b750a1b8b3b4a

SHA256
5c7a9810a0d4733dd54b28fedaca23c4d1ed4d0e772fda1ccce061870d24b3e4

SHA512
0d121f40f779bc5009baf7ae4e4d9c8bc5ac6c0ee977fdd2d944e5061e154725cb30c6aed5d6c55c958ac778ebe0290d1e1bd2b4080a399691e42617f505007e

Download Submit
\??\pipe\LOCAL\crashpad_3876_YUPGKHSAQKNYOLMG
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads