Resubmissions

22/02/2024, 08:42

240222-kl6gzafd65 1

Analysis

  • max time kernel
    146s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/02/2024, 08:42

General

  • Target

    https://gofile.io/d/LOwIP7

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/LOwIP7
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5032
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9526f46f8,0x7ff9526f4708,0x7ff9526f4718
      2⤵
        PID:1612
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,1481026579218053359,18381018453390804314,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
        2⤵
          PID:5024
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,1481026579218053359,18381018453390804314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1148
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,1481026579218053359,18381018453390804314,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
          2⤵
            PID:2108
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,1481026579218053359,18381018453390804314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
            2⤵
              PID:1704
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,1481026579218053359,18381018453390804314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
              2⤵
                PID:4904
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,1481026579218053359,18381018453390804314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
                2⤵
                  PID:4740
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,1481026579218053359,18381018453390804314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4168 /prefetch:8
                  2⤵
                    PID:4540
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,1481026579218053359,18381018453390804314,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4168 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2112
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,1481026579218053359,18381018453390804314,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
                    2⤵
                      PID:3840
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,1481026579218053359,18381018453390804314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
                      2⤵
                        PID:3352
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,1481026579218053359,18381018453390804314,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
                        2⤵
                          PID:4428
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,1481026579218053359,18381018453390804314,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
                          2⤵
                            PID:4324
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,1481026579218053359,18381018453390804314,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5436 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1940
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:628
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:4372

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              1af9fbc1d4655baf2df9e8948103d616

                              SHA1

                              c58d5c208d0d5aab5b6979b64102b0086799b0bf

                              SHA256

                              e83daa7b2af963dbb884d82919710164e2337f0f9f5e5c56ee4b7129d160c135

                              SHA512

                              714d0ff527a8a24ec5d32a0a2b74e402ee933ea86e42d3e2fb5615c8345e6c09aa1c2ddf2dea53d71c5a666483a3b494b894326fea0cc1d8a06d3b32ec9397d3

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              aa6f46176fbc19ccf3e361dc1135ece0

                              SHA1

                              cb1f8c693b88331e9513b77efe47be9e43c43b12

                              SHA256

                              2f5ba493c7c4192e9310cea3a96cfec4fd14c6285af6e3659627ab177e560819

                              SHA512

                              5d26fdffebeb1eb5adde9f7da19fe7069e364d3f68670013cb0cc3e2b40bf1fbcb9bdebbfe999747caf141c88ccd53bd4acf2074283e4bde46b8c28fbae296f5

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

                              Filesize

                              30KB

                              MD5

                              14714a5bc8bbcc1bfa05219e80a410b9

                              SHA1

                              692d05a0ccb9f98590f68a66f57b8f751291d44c

                              SHA256

                              05a43f3e84b7439b3d5e193079c665dd46ba639a69f4ba8c5819c89294e5e6a5

                              SHA512

                              9b493790caa175fe72b477f7cb4fbdaea0c4eaf03f41abe6498ee54fd0368e66a454703918d84bfccc2eca2f40182d7440eba7ca8b018695a6c4e1d110dc361b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              288B

                              MD5

                              1ebc5da6399f7ff954f1e681c3833c30

                              SHA1

                              924ca3338863e0498868cca0e468d540c52f7d79

                              SHA256

                              abba233cfb8768ff57863b0e78e728ab21968e7939dc70205c45f525613e83fc

                              SHA512

                              b12242c1ab5bf435edc843df8df43c91f36ca16cc39092a6b042481e6ab2494579a5f414dd697e1aed4d4f70320b669efb83dfebd98a49e9d3505bc01cf06c1f

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              360B

                              MD5

                              41939e17a3d0d09d3807c762e464a487

                              SHA1

                              4813ed14ba364461c68acc707d6842e8ebe4c95c

                              SHA256

                              2d3afff01ee8d8affc7ab44e4b82bc647b47ad7b9ee55ee8998761fb84b8ff65

                              SHA512

                              3931c50c0378be883d1d43339d7ce68c01889fc3ba84d4e44a450e2f040be53701c48afdd81bea752f99255e5277bd16e448b1553f342ca414da56fc1a22ad3e

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              144B

                              MD5

                              6a1151cded447ac06958e15d5abc4e8a

                              SHA1

                              899a76c67472b518e55d214373c16a64cb3367d6

                              SHA256

                              26a32c5e98b68ee6f5f9ea883f06ce51b074de52d1b693f04947dfb1e79b251d

                              SHA512

                              fdb147c7c81bb3d4a3819fed70a1d0ac9ebe6ee0b43b2c845afb3486aca6cc6a35e4db2449393e0418b19291366d5ef0b1ef63b2a839126b840ab99cf925c126

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              387B

                              MD5

                              7645fc5c32beccaa350961b2c8e04ce5

                              SHA1

                              ae63daff67e2feb9914ea88e7dc7d5b7f239b133

                              SHA256

                              b2f37263788480abc966e02c0df4556a113ef90f836aa798d86702ad8c4abb79

                              SHA512

                              cee3d43642f7b2d1bee7b71524af776b98c0a7f9182b8487ce27b925e406d5eb311ae1da981723edb44a9dbc39f460d5e2b3dfd19b393c48cccaf1ac365e8cf4

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              96ef2842819d772467751dd9bad06522

                              SHA1

                              4d48451457826195f79b8bd7662d653a4998a1c3

                              SHA256

                              79d8758f4d66a332de5a61a9647095dd90b36ff8f07b0dbbb0e260f71a559b25

                              SHA512

                              8183053f6a0306277daf0c7a0305685d8d51a6643ef3711b3fbe181306caa5ff541c171993ed6718a217c80dfa6529c6d08ed19c69dc6d90bb684ffb75cca402

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              3d512aff23422067ac323b3d4b90fd73

                              SHA1

                              8fabfdff6835ea5c0974f068afc85629cbd6c8d4

                              SHA256

                              6775c6c27fc64a81ace00276275cfd9074e59b048e23ee81bf58a89c43a3496b

                              SHA512

                              87d84d6d654f0d40b4a3519a0800f98d8c707ada7aad074efe53d14407430b24341519f73b01db992e2ab3eb5c0214f1cb2b124d981838ea9d24932207270e08

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              b1bcc6dce7a2388fb3aaae185fd01356

                              SHA1

                              b37dd58c5d22ff630d151b07f858fcd34bbc9728

                              SHA256

                              940a69b6340dc4f2208942ca71d78c965f6ea3584b482605d7580588ae592467

                              SHA512

                              ac56441066a9d65f0bd3c1eb4a6bcad1eee0b62ae94376f0ca3988541b4f0fa907785bce7c46215fa391337e26a0736ce7a31a5e0448a3b435f01ae70b35494c

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                              Filesize

                              370B

                              MD5

                              16495708de29115fd1dcecaec886c65f

                              SHA1

                              568fbfb126baa38b5f5108e494934eaf0d5ec43b

                              SHA256

                              d088040aea5735522cec9fe4ac72690abe7acef85ef3180638a6795ecb1a519d

                              SHA512

                              c8f88d9ba519c17ffe221fa718bd62317a9ba168bf1d9b8728cb3198d505d24d0185c5071a45b70c84db6f960a1fac218a114b0480982222bfc351abf0d4074d

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                              Filesize

                              368B

                              MD5

                              62704d6089cfec9da03ac14ba7faf9f5

                              SHA1

                              6e7a10fd6d3102c74a9296e1c130b626075cb43e

                              SHA256

                              92bd77275c8952f2155fe453c93c4897ea49919cc9ae818045bd616eb137307f

                              SHA512

                              3bab742b229510dcdf93ad2c9e788bafef287869a05743230a52ddc7a09d3a3b242689fba1f76c25650bf9690ec8b32f3d6e6ad8ffc095b299084c0fd26d1577

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580c11.TMP

                              Filesize

                              370B

                              MD5

                              a94879f273ce2c582379d5a046cc96fb

                              SHA1

                              9494c0cc3a3fe452228177a9191ca85688272d42

                              SHA256

                              a4d3451e3440a224ea65847209a211daee8c5b80ec090bb6a2ec30998dc3bdb8

                              SHA512

                              d3a8ff787ebec6784b1626f4466e17b804098c92ccf27877bf9373ac97d5fac1849896dad2b30c6425a63ba33ba27e4b7b1c66f8f5b827522293936aa13da461

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              6752a1d65b201c13b62ea44016eb221f

                              SHA1

                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                              SHA256

                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                              SHA512

                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                              Filesize

                              11KB

                              MD5

                              a6bc2c915ba64bbba2eb20d1fb0c4d53

                              SHA1

                              549f2a09b592b70d774ac6c81d15a7714989bc65

                              SHA256

                              34c9094e69c5efebf7af3b219b7b525e84b9198c7fc405970140b8ecdb4edf74

                              SHA512

                              82fa2d5a70060eb72a99a74d56efa2711af6013a46b3bf7ecdb2ff28cf2ee67de735cd2867fccf622471f5d74bbbadb0fc8da1c3338e07e228e58686637e4c8a