hxxps://go-link[.]ru/PZ7bG

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22-02-2024 13:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://go-link.ru/PZ7bG

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2960	msedge.exe
2960	msedge.exe
348	msedge.exe
348	msedge.exe
4820	identity_helper.exe
4820	identity_helper.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

348 msedge.exe
348 msedge.exe
348 msedge.exe
348 msedge.exe
348 msedge.exe
348 msedge.exe
348 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe
348	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 348 wrote to memory of 5096	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 5096	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2864	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2960	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 2960	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 4984	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 4984	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 4984	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 4984	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 4984	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 4984	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 4984	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 4984	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 4984	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 4984	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 4984	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 4984	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 4984	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 4984	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 4984	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 4984	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 4984	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 4984	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 4984	348	msedge.exe	msedge.exe
PID 348 wrote to memory of 4984	348	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-link.ru/PZ7bG
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8bf7e46f8,0x7ff8bf7e4708,0x7ff8bf7e4718
2⤵
PID:5096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,14020429675203565754,7674083757760218169,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
2⤵
PID:2864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,14020429675203565754,7674083757760218169,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,14020429675203565754,7674083757760218169,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
2⤵
PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,14020429675203565754,7674083757760218169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
2⤵
PID:4644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,14020429675203565754,7674083757760218169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
2⤵
PID:2640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,14020429675203565754,7674083757760218169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
2⤵
PID:4740

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,14020429675203565754,7674083757760218169,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
2⤵
PID:2244

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,14020429675203565754,7674083757760218169,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,14020429675203565754,7674083757760218169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
2⤵
PID:1888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,14020429675203565754,7674083757760218169,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
2⤵
PID:2652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,14020429675203565754,7674083757760218169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
2⤵
PID:2344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,14020429675203565754,7674083757760218169,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
2⤵
PID:1212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,14020429675203565754,7674083757760218169,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1984 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1540

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
343e73b39eb89ceab25618efc0cd8c8c

SHA1
6a5c7dcfd4cd4088793de6a3966aa914a07faf4c

SHA256
6ea83db86f592a3416738a1f1de5db00cd0408b0de820256d09d9bee9e291223

SHA512
54f321405b91fe397b50597b80564cff3a4b7ccb9aaf47cdf832a0932f30a82ed034ca75a422506c7b609a95b2ed97db58d517089cd85e38187112525ca499cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
d4c957a0a66b47d997435ead0940becf

SHA1
1aed2765dd971764b96455003851f8965e3ae07d

SHA256
53fa86fbddf4cdddab1f884c7937ba334fce81ddc59e9b2522fec2d19c7fc163

SHA512
19cd43e9756829911685916ce9ac8f0375f2f686bfffdf95a6259d8ee767d487151fc938e88b8aada5777364a313ad6b2af8bc1aa601c59f0163cbca7c108fbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
624B

MD5
15f20881bde3c5ec4a75ef0de02027d6

SHA1
0328e0d0530532ce47fe5a2a043a03d4bac1a92e

SHA256
5c5962e04ad195dd5d66e27015b02f538daf9d44b17156abc778a592179fe62d

SHA512
f805f02cf542dd4fa5d83adc05dc1bc560657a142a290ee6f255bc56871721405cd016135254faa607ae1c4118fddb2d6ce5875a1fc0293269be02f9649fda17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
4f21d8030deb9120a1347a8c0c300c7d

SHA1
d57ea6566d8d7d0ab71a81bc798e9638c0e7826e

SHA256
59cb7a00ba2155c11c40e5cdb396594ba4218972bd022c22bf5e7626ddd7399d

SHA512
dd8e0be8c6dc4d8a48813ba24ca2395b71987b4d629f39620cc411fd565616d6ad418c8f01dfd3f1d5a740d24388b592be91deaf5135e5a23a39241d72920286

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
ab26687154cfc928ac43683006a001d9

SHA1
00a647a189a93ce8abde6b0a588d92f409caa767

SHA256
8ca4446a96e4b9df0065605dab0f8b7ec1500bb4ad78b06b94bca2f2e40a0ee1

SHA512
3f0ebc81ad9907db60fa48c9af7168c40a43df65e07ebb7b9bf5d9877f3397ccd8ff8ad842e3495dd2328633642e25c8f64832a7bfd3109685d3975a8ace700f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
2fa9053ef491a60892ee2e0164074c55

SHA1
63523191096232fbc7805864f9c922eac556d038

SHA256
bcb880683aa254da6f6389dce9acf45bf57828780ba3a004e67284f6bcc972a7

SHA512
9aa7415003e7be471b6447023479f2b8242fc8d7fa9e09922cf688d7035d722edf1aab6b5b17b302ca807a8a613de92793106656172a701ddd0c6932c195ad12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
a914836b71631a5a2144fac8d41a30bb

SHA1
3cabe1568bf33189d78c6f7fb6fd886cade0718e

SHA256
995d724ebd8615326adafaf333f2e5c99a47fc8a1e4546dded44fa4bb22d3135

SHA512
2ef711eae0532864f61ad03c9bdb06d0df80790fc0659129e75f113534a1be84db98c7a75767196b7bef2a1c7afb8d0ceb5e8513442d2d259bfa01d2f858e5d8

Download Submit
\??\pipe\LOCAL\crashpad_348_EUBFVRWENNGLLZPW
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit