hxxps://gofile[.]io/d/TLEFWg

Analysis

max time kernel
147s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 02:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/TLEFWg

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3744	msedge.exe
3744	msedge.exe
3028	msedge.exe
3028	msedge.exe
3620	identity_helper.exe
3620	identity_helper.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe
3440	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 4644	3028	msedge.exe	84
PID 3028 wrote to memory of 4644	3028	msedge.exe	84
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 4524	3028	msedge.exe	86
PID 3028 wrote to memory of 3744	3028	msedge.exe	87
PID 3028 wrote to memory of 3744	3028	msedge.exe	87
PID 3028 wrote to memory of 3172	3028	msedge.exe	88
PID 3028 wrote to memory of 3172	3028	msedge.exe	88
PID 3028 wrote to memory of 3172	3028	msedge.exe	88
PID 3028 wrote to memory of 3172	3028	msedge.exe	88
PID 3028 wrote to memory of 3172	3028	msedge.exe	88
PID 3028 wrote to memory of 3172	3028	msedge.exe	88
PID 3028 wrote to memory of 3172	3028	msedge.exe	88
PID 3028 wrote to memory of 3172	3028	msedge.exe	88
PID 3028 wrote to memory of 3172	3028	msedge.exe	88
PID 3028 wrote to memory of 3172	3028	msedge.exe	88
PID 3028 wrote to memory of 3172	3028	msedge.exe	88
PID 3028 wrote to memory of 3172	3028	msedge.exe	88
PID 3028 wrote to memory of 3172	3028	msedge.exe	88
PID 3028 wrote to memory of 3172	3028	msedge.exe	88
PID 3028 wrote to memory of 3172	3028	msedge.exe	88
PID 3028 wrote to memory of 3172	3028	msedge.exe	88
PID 3028 wrote to memory of 3172	3028	msedge.exe	88
PID 3028 wrote to memory of 3172	3028	msedge.exe	88
PID 3028 wrote to memory of 3172	3028	msedge.exe	88
PID 3028 wrote to memory of 3172	3028	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/TLEFWg
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf5e446f8,0x7ffbf5e44708,0x7ffbf5e44718
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1832,11454266650192172552,10670854606461279595,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1832,11454266650192172552,10670854606461279595,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1832,11454266650192172552,10670854606461279595,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,11454266650192172552,10670854606461279595,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,11454266650192172552,10670854606461279595,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,11454266650192172552,10670854606461279595,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,11454266650192172552,10670854606461279595,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1832,11454266650192172552,10670854606461279595,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3604 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1832,11454266650192172552,10670854606461279595,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3604 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,11454266650192172552,10670854606461279595,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,11454266650192172552,10670854606461279595,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,11454266650192172552,10670854606461279595,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1832,11454266650192172552,10670854606461279595,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1832,11454266650192172552,10670854606461279595,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4900 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
360dd5debf8bf7b89c4d88d29e38446c

SHA1
65afff8c78aeb12c577a523cb77cd58d401b0f82

SHA256
3d9debe659077c04b288107244a22f1b315bcf7495bee75151a9077e71b41eef

SHA512
0ee5b81f0acc82befa24a4438f2ca417ae6fac43fa8c7f264b83b4c792b1bb8d4cecb94c6cbd6facc120dc10d7e4d67e014cdb6b4db83b1a1b60144bb78f7542

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6fbbaffc5a50295d007ab405b0885ab5

SHA1
518e87df81db1dded184c3e4e3f129cca15baba1

SHA256
b9cde79357b550b171f70630fa94754ca2dcd6228b94f311aefe2a7f1ccfc7b6

SHA512
011c69bf56eb40e7ac5d201c1a0542878d9b32495e94d28c2f3b480772aa541bfd492a9959957d71e66f27b3e8b1a3c13b91f4a21756a9b8263281fd509c007b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
fba63bc369444ea65560923e3383cc88

SHA1
0d2ef6e1a39bf982360d3a0a44ef932b669b59cd

SHA256
66a0be1bde45fe997d33df8e7d8f68f11dfeda6f22e55345df8b0bffb1f6f0e5

SHA512
00089e9aa3474e116956f2992f382a508c8983bad550f8b2731e53fad167d103928fd2f51e0ba33448f1ebf25cc050fc1cc22e4d84acd4b0070d02a61f4948f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
782B

MD5
a8e7882215559e576b38d95132ac25ec

SHA1
b40ffca07ed1ba30332989d5c4e98eacb6c7ac9e

SHA256
6fcce675f699766fb83f4e72496f52af4d6d7b45cc7fbc29e0338d8deda9381b

SHA512
43f8f4f0efd5992d5d956af83703316f2ca1edaefcda985d79dc535180e2006d85e8887014525a1a2616c0648c3ea2b7645f7cab9a8c47998d05bccce4d48033

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2ac92be065134845a273bf90d7c24995

SHA1
a3376617ce3ddcc25b15b5ecbf276c99f5a686c9

SHA256
5cf8508d4772056f8e04834834252c3b0d3247a5813b9cbb2ec310fb3df91106

SHA512
e32c9971824639151b449b6a97f5865537759ac1b6c1550bcdc150c1f23709bc04a4b231f128aa5a287a1da0867f459844e6efd01a1755a7f78949651a640ea8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3332dcf0734ac40660ba2d49c596c7e9

SHA1
e98a68669de429017d64e48570782135c29433e4

SHA256
c59f033e231c85048954b0dea66e579a4d84a7e2d9bb9016a3cf2b07bbd07e32

SHA512
f11eca1e7d3b54b5c1a17f35418e10c15ed0ece4100ddb742f1908dd222c3056827a015d897d2cf85ef060487fdadfd27249b04ba62a775864d807df46b1838d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4791b0de2d3c1bc37c36a8c3d4a43dd8

SHA1
14408b2ed9d363c87ff9126388e9163d1a7c7b1b

SHA256
be0e3f5082ba26c725f8c727efc3d584a52c563c8b127fd5ee18a277e9b6a01b

SHA512
15ebd5b15d6ce51a06a6424c97a78ba6f0ebe306038d80e8ecbb255d6c74a605178d245bda8d74765446d2bee420d8f1331411e843180b6f72464de2a5b4aafc

Download Submit