hxxp://rb[.]gy/b1i8je

Resubmissions

11/03/2024, 12:59

240311-p8ae9sfd72 4

11/03/2024, 12:58

240311-p7k6dafd59 1

11/03/2024, 12:56

240311-p6sh3abb9t 1

Analysis

max time kernel
47s
max time network
51s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
11/03/2024, 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://rb.gy/b1i8je

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
1276	msedge.exe
1276	msedge.exe
2384	identity_helper.exe
2384	identity_helper.exe
2248	msedge.exe
2248	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 3964	1276	msedge.exe	79
PID 1276 wrote to memory of 3964	1276	msedge.exe	79
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 708	1276	msedge.exe	80
PID 1276 wrote to memory of 4788	1276	msedge.exe	81
PID 1276 wrote to memory of 4788	1276	msedge.exe	81
PID 1276 wrote to memory of 3108	1276	msedge.exe	82
PID 1276 wrote to memory of 3108	1276	msedge.exe	82
PID 1276 wrote to memory of 3108	1276	msedge.exe	82
PID 1276 wrote to memory of 3108	1276	msedge.exe	82
PID 1276 wrote to memory of 3108	1276	msedge.exe	82
PID 1276 wrote to memory of 3108	1276	msedge.exe	82
PID 1276 wrote to memory of 3108	1276	msedge.exe	82
PID 1276 wrote to memory of 3108	1276	msedge.exe	82
PID 1276 wrote to memory of 3108	1276	msedge.exe	82
PID 1276 wrote to memory of 3108	1276	msedge.exe	82
PID 1276 wrote to memory of 3108	1276	msedge.exe	82
PID 1276 wrote to memory of 3108	1276	msedge.exe	82
PID 1276 wrote to memory of 3108	1276	msedge.exe	82
PID 1276 wrote to memory of 3108	1276	msedge.exe	82
PID 1276 wrote to memory of 3108	1276	msedge.exe	82
PID 1276 wrote to memory of 3108	1276	msedge.exe	82
PID 1276 wrote to memory of 3108	1276	msedge.exe	82
PID 1276 wrote to memory of 3108	1276	msedge.exe	82
PID 1276 wrote to memory of 3108	1276	msedge.exe	82
PID 1276 wrote to memory of 3108	1276	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://rb.gy/b1i8je
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc93ee3cb8,0x7ffc93ee3cc8,0x7ffc93ee3cd8
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1808,4716775349677236725,13670912699973428354,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1808,4716775349677236725,13670912699973428354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1808,4716775349677236725,13670912699973428354,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,4716775349677236725,13670912699973428354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,4716775349677236725,13670912699973428354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,4716775349677236725,13670912699973428354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1808,4716775349677236725,13670912699973428354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,4716775349677236725,13670912699973428354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,4716775349677236725,13670912699973428354,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1808,4716775349677236725,13670912699973428354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4576 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,4716775349677236725,13670912699973428354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1808,4716775349677236725,13670912699973428354,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:2908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c65e704fc47bc3d9d2c45a244bb74d76

SHA1
3e7917feebea866e0909e089e0b976b4a0947a6e

SHA256
2e5d6a5eeb72575f974d5fa3cdff7ad4d87a361399ffdd4b03f93cdbdec3a110

SHA512
36c3be0e5fbc23c5c0ad2e14cfb1cf7913bea9a5aeb83f9f6fcf5dbc52a94d8ccb370cef723b0cda82b5fba1941b6a9ff57f77ff0076a2c5cf4250711e3dd909

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c3ea95e17becd26086dd59ba83b8e84

SHA1
7943b2a84dcf26240afc77459ffaaf269bfef29f

SHA256
a241c88bb86182b5998d9818e6e054d29b201b53f4f1a6b9b2ee8ba22dd238dc

SHA512
64c905e923298528783dc64450c96390dc5edbda51f553c04d88ee944b0c660b05392dc0c823d7fb47f604b04061390b285f982dfcc767c8168ccb00d7e94e21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
63c0079003416e812cfe4429b3da87df

SHA1
d774470e2525f9defd70a84d9443a7cdc89f0348

SHA256
c11529a71f6ef7d4905bc5c53fbb450ddf5ba814f1982930b53ab752567c035d

SHA512
e4ccd246cd1c1f32b1163bfb70d5edc6a16d0da9b65da56587cd0357930a0d072ccb4af84af6946fce944c8d0ce6af4594a0939c26badef1278c966b731a6394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b246264876651ccea730c5f1b697b7c7

SHA1
8737720393c11dbb9f69ad781f1d67cb298ab792

SHA256
31dea4df6b3fcb98d42f54cc33c9d0a01b2f5b4d51dcfecce002e0b023988f7f

SHA512
7bf16abfb0ae0b694a89bf7968112f01049f71ef1133a46b2f613adc34a1494bea10f3b4c109dc8616c5dc3ac51a8b1f83122b968004d3d99536fb51a36b2843

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1c303db2839d0e34b409720d4ea2a669

SHA1
969df40cc54c47bc7212cc24c2dc47e40db27430

SHA256
454d3582f7fdeeaf4d1e730e93e1d63326cdb726bb7c3c9b995a4a2191a9f21b

SHA512
bb880f8fbee1acf88732a410edb55fab750127a2c7c2c1adadbf5c1c41a45d294365d68e1741140b9527d269e629c1e58704d88a16f1331528d158d111e510bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
46f3fe8d57367cd24765c3fa1c1e4e6f

SHA1
79518252bd8f49617b4bb7e73f579ec484d5192e

SHA256
6b84370b5ed4eef433ee876c1355f006e33a26c9203de2694afbbb4d1aff3774

SHA512
3a5316e49c71d66ae113b8fe34aeca37e32512e45ea5ac9ee129c49009e8d11d595fd7599a0f7960aafa8b57fccbb15cddde958b665866891cc96c983a7e25eb

Download Submit