hxxps://go-link[.]ru/jAGQM

Analysis

max time kernel
40s
max time network
41s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-03-2024 04:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://go-link.ru/jAGQM

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

3768 msedge.exe
3768 msedge.exe
888 msedge.exe
888 msedge.exe
3300 identity_helper.exe
3300 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

888 msedge.exe
888 msedge.exe
888 msedge.exe
888 msedge.exe
888 msedge.exe
888 msedge.exe
888 msedge.exe

pid	process
3768	msedge.exe
3768	msedge.exe
888	msedge.exe
888	msedge.exe
3300	identity_helper.exe
3300	identity_helper.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 888 wrote to memory of 212	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 212	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 4756	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3768	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3768	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3548	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3548	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3548	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3548	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3548	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3548	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3548	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3548	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3548	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3548	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3548	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3548	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3548	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3548	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3548	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3548	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3548	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3548	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3548	888	msedge.exe	msedge.exe
PID 888 wrote to memory of 3548	888	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-link.ru/jAGQM
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfe0946f8,0x7ffcfe094708,0x7ffcfe094718
2⤵
PID:212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,17696507766204357789,5725286468576211618,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
2⤵
PID:4756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,17696507766204357789,5725286468576211618,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,17696507766204357789,5725286468576211618,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
2⤵
PID:3548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17696507766204357789,5725286468576211618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
2⤵
PID:1464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17696507766204357789,5725286468576211618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
2⤵
PID:2848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17696507766204357789,5725286468576211618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
2⤵
PID:3244

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,17696507766204357789,5725286468576211618,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
2⤵
PID:860

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,17696507766204357789,5725286468576211618,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17696507766204357789,5725286468576211618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
2⤵
PID:2292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17696507766204357789,5725286468576211618,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
2⤵
PID:4856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17696507766204357789,5725286468576211618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
2⤵
PID:4424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17696507766204357789,5725286468576211618,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
2⤵
PID:4432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2064,17696507766204357789,5725286468576211618,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5464 /prefetch:8
2⤵
PID:5544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2796

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
36bb45cb1262fcfcab1e3e7960784eaa

SHA1
ab0e15841b027632c9e1b0a47d3dec42162fc637

SHA256
7c6b0de6f9b4c3ca1f5d6af23c3380f849825af00b58420b76c72b62cfae44ae

SHA512
02c54c919f8cf3fc28f5f965fe1755955636d7d89b5f0504a02fcd9d94de8c50e046c7c2d6cf349fabde03b0fbbcc61df6e9968f2af237106bf7edd697e07456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1e3dc6a82a2cb341f7c9feeaf53f466f

SHA1
915decb72e1f86e14114f14ac9bfd9ba198fdfce

SHA256
a56135007f4dadf6606bc237cb75ff5ff77326ba093dff30d6881ce9a04a114c

SHA512
0a5223e8cecce77613b1c02535c79b3795e5ad89fc0a934e9795e488712e02b527413109ad1f94bbd4eb35dd07b86dd6e9f4b57d4d7c8a0a57ec3f7f76c7890a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
624B

MD5
851ec7e885e48625dce25e4c877fdc09

SHA1
82bee77ec5a4ad399d20138189f2eb2efa73a803

SHA256
ea252610b54a074cbc09be1a18050d490f11f4349f84a88b1ca40a0317cc2191

SHA512
995e7ba0562c32afe73685c869c7103eb459c5c209907d94ff9cbac2f792e6b1c0da275cd4cbda40d6dbb4be0265a2037e63add8e5b506857cf41b27417e6228

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
3d8d5dfe838ded390ff86c030c0a3bc6

SHA1
c456af556b4c8568a97e5bbddae095c3e2d2c21f

SHA256
33e660b765a0e85d65f184024b7e4cb772ba2cb742962a8bfb7ee6b296f2b5b4

SHA512
e539ccd3f588994a6f8fb91c58ad35882a01b90178a1baa9cd463f415725d34f1754ebbebce3ee97296d4200a97117575bbbfd2eb30ed32118c03c32563a0c98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
859a713c36ecf11e26863725ae36eb58

SHA1
68e671160a6a092b0bef48e91601473173bd291c

SHA256
4d2bc06ccd280a06af3fc728c1997e9289b44b4459e9f56777429685677aefb0

SHA512
61e0c53775cc9df41b7bb1a27230d39eeaa143c8dd1c3000b86e99b191bef493314a2d64a29a75936643104586273bd4c80d83728ff2b09603b2f724c3b1119e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
312b04b7144edeb7e8ef6dcdf59ac691

SHA1
980d295ef898842ad5c50154f27def42fb3ef86b

SHA256
83096854fab02bad54c37a109ca138819db97b06f794506a6abc97594cc3c1cd

SHA512
c827140e79f66536d58b33749c49d7a48300b1a7ec64ed725ecc3c638d638dd6c517542204e6d7cd18096e5643d62b94aa5fb3d8834536d24f21caba9c6efc03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
ad9237f3387a06ba00c447e41b0a8af0

SHA1
d2a7e098b4c44dbb25e8b11de2f43e725a4125f4

SHA256
a1c5e3cd9f11cabaf9d04ca6a8bd68dc2be65a4ade4c22f74600f028adb02381

SHA512
e8080b5f681d6e010878441c4280f35b71195f673f3f58cbb79403bcfb057b5f868350c7df514dd6637ab0063b33160b6ff40804f870fc3f25eed40d73fbf365

Download Submit
\??\pipe\LOCAL\crashpad_888_ZMNPNMVGENVDUKSJ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit