hxxps://u[.]to/LfFhIA

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-02-2024 19:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://u.to/LfFhIA

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2340	msedge.exe
2340	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
4012	identity_helper.exe
4012	identity_helper.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

380 msedge.exe
380 msedge.exe
380 msedge.exe
380 msedge.exe
380 msedge.exe
380 msedge.exe
380 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 380 wrote to memory of 5052	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 5052	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2044	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2340	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2340	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2864	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2864	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2864	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2864	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2864	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2864	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2864	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2864	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2864	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2864	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2864	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2864	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2864	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2864	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2864	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2864	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2864	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2864	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2864	380	msedge.exe	msedge.exe
PID 380 wrote to memory of 2864	380	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://u.to/LfFhIA
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec85f46f8,0x7ffec85f4708,0x7ffec85f4718
2⤵
PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,6383935115360008607,5092306130063215930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,6383935115360008607,5092306130063215930,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
2⤵
PID:2044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,6383935115360008607,5092306130063215930,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
2⤵
PID:2864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6383935115360008607,5092306130063215930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
2⤵
PID:2204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6383935115360008607,5092306130063215930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
2⤵
PID:2676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6383935115360008607,5092306130063215930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
2⤵
PID:1972

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,6383935115360008607,5092306130063215930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
2⤵
PID:3780

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,6383935115360008607,5092306130063215930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6383935115360008607,5092306130063215930,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
2⤵
PID:1088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6383935115360008607,5092306130063215930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
2⤵
PID:784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6383935115360008607,5092306130063215930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
2⤵
PID:3256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6383935115360008607,5092306130063215930,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
2⤵
PID:3084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,6383935115360008607,5092306130063215930,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4840 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3116

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
cbec32729772aa6c576e97df4fef48f5

SHA1
6ec173d5313f27ba1e46ad66c7bbe7c0a9767dba

SHA256
d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e

SHA512
425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
279e783b0129b64a8529800a88fbf1ee

SHA1
204c62ec8cef8467e5729cad52adae293178744f

SHA256
3619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932

SHA512
32730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
216B

MD5
db45dd3a5d459cee9c7d1b95aa318f5a

SHA1
f78f294775a9ffd55e065e447def5c3f8a3aa999

SHA256
a4d3b47c5769551f59a96876aee75f630fd3f6cf99f691d92daaa9f972f286e3

SHA512
6a0ce9a44af9e88a6225609dff2f72b3cbd162f9406ed40a3e78cf5076faba9bd573a43e162e3c08f20c788979ec5b48128709f0c198d665f0f39a536c37b041

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
d45faa7ce82cb5c9dd9cf319d109cd08

SHA1
a4228f172b1e97aa3dfcaa501725734b3adad40c

SHA256
6dc870541557b1bde2798f3d405fa4faf998b92cc776be56d2d0d3a832181f29

SHA512
75c0b64f0fb1579cb30a677a2f43dc6d4436b6344851b8378361228864e43ab54122424c85b5c23047d0f53891307135d702e45c41915e10d6af37eaf856a8bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
7a417796afe322d22d3e542391339a67

SHA1
aec78e81954ffac08413e962b9d135a759d57b0d

SHA256
bad67216accff8e02b6945a1fb6f0f3caf0de7ad052c4431c6016e8972afb2ba

SHA512
abedf8ce6c7c5c5c83fe8a8598a184d42f8c06b6c0bf8606a144e8742a2b39d4347c3a28fa4dc5bb84186cc43340464d7823b577cc81b4a1e806829204cf56cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
b6683ebcb29802748cb5fa65f2b4c7f2

SHA1
216ab67c88b61abfd8e323a7c8405bb17c5dc904

SHA256
28c391f2567aab4d38829b1cc43b7580f04b49c938e3abc3451daf5d7a66cb5f

SHA512
f8ba3bb6992ca126c0697449115086632d4ab19e1386a9dcc58e171ad093f7d754899c21b85b96dddcf21d1a6a4b661ba8abbf00887d22e60b3229fe833ab22b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
eabac17ed8cf153b4dcb1de02aacc6d9

SHA1
90b88e47e37bd6db817d33887a02eb7d3fe278f7

SHA256
412464e964bae3603c4b9488fefc603ca9ffa9b100d32d8d0cd560f51dc50135

SHA512
3adb059ddf618ec332985509ca99262ad998b9c936140a7fdc9758a3a0c762ad806904ed4dcda7befcca663d6ae3ebaeeeeacc0d52608dda3783ecf5e9332e6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
6b7fb7b0c30ec3df1e96e5471ba9ee6b

SHA1
f27c52c1a1517a33c5d40f22ceeef7d8e2ee0104

SHA256
c92c0964d140c535a0bba25b097e89bec614ee85586f768916959999acd9a3a9

SHA512
e067306a6cc65e2c732d70f80f3dd8aa90bcbb093e0bb8daba1650f69add743a238b6d2972534a6a1fe7d609233656c9bba310bf5c2757b843f927ef6b5528de

Download Submit
\??\pipe\LOCAL\crashpad_380_FWLLHHAIGOXVGGJK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit