Analysis
-
max time kernel
17s -
max time network
34s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
10-03-2024 15:37
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://u.to/R0Z1IA
Resource
win11-20240221-en
General
-
Target
https://u.to/R0Z1IA
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
msedge.exemsedge.exemsedge.exeidentity_helper.exepid process 4832 msedge.exe 4832 msedge.exe 1468 msedge.exe 1468 msedge.exe 4304 msedge.exe 4304 msedge.exe 4684 identity_helper.exe 4684 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
msedge.exepid process 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe 1468 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1468 wrote to memory of 1664 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 1664 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3392 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 4832 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 4832 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3292 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3292 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3292 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3292 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3292 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3292 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3292 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3292 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3292 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3292 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3292 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3292 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3292 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3292 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3292 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3292 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3292 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3292 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3292 1468 msedge.exe msedge.exe PID 1468 wrote to memory of 3292 1468 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://u.to/R0Z1IA1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc3b873cb8,0x7ffc3b873cc8,0x7ffc3b873cd82⤵PID:1664
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1752,6595764958651752165,16955177493528342435,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:22⤵PID:3392
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1752,6595764958651752165,16955177493528342435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4832 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1752,6595764958651752165,16955177493528342435,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:82⤵PID:3292
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1752,6595764958651752165,16955177493528342435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:3724
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1752,6595764958651752165,16955177493528342435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:1152
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1752,6595764958651752165,16955177493528342435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:12⤵PID:4252
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1752,6595764958651752165,16955177493528342435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4304 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1752,6595764958651752165,16955177493528342435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:12⤵PID:2068
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1752,6595764958651752165,16955177493528342435,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:12⤵PID:1516
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1752,6595764958651752165,16955177493528342435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5880 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4684 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1752,6595764958651752165,16955177493528342435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:12⤵PID:4848
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1752,6595764958651752165,16955177493528342435,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:12⤵PID:2240
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3812
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1908
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5caaacbd78b8e7ebc636ff19241b2b13d
SHA14435edc68c0594ebb8b0aa84b769d566ad913bc8
SHA256989cc6f5cdc43f7bac8f6bc10624a47d46cbc366c671c495c6900eabc5276f7a
SHA512c668a938bef9bbe432af676004beb1ae9c06f1ba2f154d1973e691a892cb39c345b12265b5996127efff3258ebba333847df09238f69e95f2f35879b5db7b7fc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57c194bbd45fc5d3714e8db77e01ac25a
SHA1e758434417035cccc8891d516854afb4141dd72a
SHA256253f8f4a60bdf1763526998865311c1f02085388892f14e94f858c50bf6e53c3
SHA512aca42768dcc4334e49cd6295bd563c797b11523f4405cd5b4aeb41dec9379d155ae241ce937ec55063ecbf82136154e4dc5065afb78d18b42af86829bac6900d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5a060b9d3b2afc35adb3003f337b0b82f
SHA1075bf9070b07da3114acde425164ba02337ca980
SHA25660d9f2ae24a6a82698d3259590760e1a79e877a2a91dfa08bffd0b4784bd4fee
SHA5123c418d5529606668a9b7690fe9da14d932d84ea784f07b963f89e8b2994cac80a6e0a1d21ee0f69d6a0fc4f1fed71c596b30f785550283f120dde5fb0ce5db86
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5a491e71b8834712b869bafb364082ceb
SHA1a3b1d0c2735eeb4b983776dace9e6837dcc986ac
SHA256ccb73fe93927154ba428353931e4401bf480a0bde72785eca9bc199237fb3a18
SHA512acea2db8c65738f36758d890c7c497e6d702aa11442bb51c6108027be14b2627f736515ec70fefd7495aa22c0e1570ab20c6317b55e524e5d8b4f610e26f48c6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5c8c7e46593ec44b2755090922df29791
SHA17578c66e272927bd07e46616c0261bd504656825
SHA256187cf228910e3366fc490523c883794eff9c62b75dd8867176b3b095e56def60
SHA51294f070e837fbcde1e12de6e20b1914264cf2af36476462991b1192b76c10f30ac796010e5e767abd2c3cdcfd13deb1ef2826dcbda7d255c78b1db718910c12eb
-
\??\pipe\LOCAL\crashpad_1468_JQEUHXITUFHVLSSOMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e