Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05-03-2024 00:04
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://go-link.ru/jAGQM
Resource
win10v2004-20240226-en
General
-
Target
http://go-link.ru/jAGQM
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 3308 msedge.exe 3308 msedge.exe 4964 msedge.exe 4964 msedge.exe 3068 identity_helper.exe 3068 identity_helper.exe 5804 msedge.exe 5804 msedge.exe 5804 msedge.exe 5804 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4964 wrote to memory of 1480 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 1480 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 2352 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 3308 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 3308 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 3028 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 3028 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 3028 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 3028 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 3028 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 3028 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 3028 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 3028 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 3028 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 3028 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 3028 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 3028 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 3028 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 3028 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 3028 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 3028 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 3028 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 3028 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 3028 4964 msedge.exe msedge.exe PID 4964 wrote to memory of 3028 4964 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go-link.ru/jAGQM1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9208146f8,0x7ff920814708,0x7ff9208147182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,1549364307157114280,10205299593053819355,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,1549364307157114280,10205299593053819355,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,1549364307157114280,10205299593053819355,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2472 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1549364307157114280,10205299593053819355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1549364307157114280,10205299593053819355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1549364307157114280,10205299593053819355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,1549364307157114280,10205299593053819355,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,1549364307157114280,10205299593053819355,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1549364307157114280,10205299593053819355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1549364307157114280,10205299593053819355,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1549364307157114280,10205299593053819355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,1549364307157114280,10205299593053819355,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,1549364307157114280,10205299593053819355,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2680 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5fd7944a4ff1be37517983ffaf5700b11
SHA1c4287796d78e00969af85b7e16a2d04230961240
SHA256b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74
SHA51228c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a774512b00820b61a51258335097b2c9
SHA138c28d1ea3907a1af6c0443255ab610dd9285095
SHA25601946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4
SHA512ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
624B
MD5db35db0ddd69ff9f0a92944e1540b307
SHA147a4def99787281de3fbf55a4d89a07aa0824441
SHA256061bbcb062193e37d514a5c4fef0c4b58f5fdfb59bc8cbbdcae849e0feb11d6e
SHA5123dc4bf1cd8aa64e17b01d1496f047eb615c1ad41949f72866efad7c41c8c74b2a8a5ecdbcc9fcd0e9ae94c232738caaecf7b6631ce7b9da409e71b989c1e3395
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
1KB
MD54a0953aaf05c6b9ea4f8091086b35364
SHA16d0503f6e20b1a471b4de89beb3effbac4d488b5
SHA256f27f7125e2291cd05a01850c2f68a04b4d734831823178c23562ac6d3e7beda6
SHA51208b110ddaa7cea1e9714061b03a424b951adb858f16057aa3bdaba7b8699b998d5f543bb87a1926dce740dc31679b713b646cd1d79cadaf0a4f1f68cfd254ed9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD549b8c01e6127fab0af294d8be9fe5f34
SHA14692057776195c6218860087f8e729c7411d89a4
SHA256ebe1e86ccb53bb731eff93dc235f71cc1ecce1fe83035a3dd1bfc2ad89cdf894
SHA512c88753d24355fca6bd9efbbecc6b6c9c9df5a8ab4d11a5e232e6dbdf6ab15ac0e1a0864ae95b4e40468c32691d9b2f218c826abf426f5410016f60ebcf73085e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5f585ff5a35eb3301e464feed4766be75
SHA11a9f44932dda558f468b36394b337b9bfa36926b
SHA256d7d4f02b25fcdd4ebdb10ff41f9f08e72dc1457934f58d91a90de955a4fda602
SHA5128c49c31b9925d8013217fa884e0aab32bcc605c0b0525a0c8739507236b215f9cb23d4b0d2eac1f0fe852fa34b97f3130eed82018fc5c76dd2926d3073ec00c8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5a0fed6188fbfe2b597c5357b32fb5153
SHA177896043d86bf2eae3bf4e59c1a80146b647efd7
SHA256166f0a85687d92046a016e991f491561663ad363bd6ae77ec7c7e48be871ba8c
SHA51241a65b148a8e71725cbbb621cf79b2dba8dbf6275c9993a37b73260fb2c84f5f01c0cdb1abe8bc979baf3cd10aafb8f95b2aa7934925fbee24cddd17dd7d1c3d
-
\??\pipe\LOCAL\crashpad_4964_RKNGXKYILFEIRGEHMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e