Analysis
-
max time kernel
39s -
max time network
47s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13-03-2024 20:35
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://mega.nz/file/9edxwAyS#itYXxq8bUfnvI4n098BEhvU9Rv2UX01q7AcboVpxwbU
Resource
win10v2004-20240226-en
General
-
Target
https://mega.nz/file/9edxwAyS#itYXxq8bUfnvI4n098BEhvU9Rv2UX01q7AcboVpxwbU
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2108 msedge.exe 2108 msedge.exe 2140 msedge.exe 2140 msedge.exe 2916 msedge.exe 2916 msedge.exe 2468 identity_helper.exe 2468 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe -
Suspicious use of FindShellTrayWindow 51 IoCs
pid Process 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2140 wrote to memory of 3892 2140 msedge.exe 91 PID 2140 wrote to memory of 3892 2140 msedge.exe 91 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 4764 2140 msedge.exe 93 PID 2140 wrote to memory of 2108 2140 msedge.exe 94 PID 2140 wrote to memory of 2108 2140 msedge.exe 94 PID 2140 wrote to memory of 5012 2140 msedge.exe 95 PID 2140 wrote to memory of 5012 2140 msedge.exe 95 PID 2140 wrote to memory of 5012 2140 msedge.exe 95 PID 2140 wrote to memory of 5012 2140 msedge.exe 95 PID 2140 wrote to memory of 5012 2140 msedge.exe 95 PID 2140 wrote to memory of 5012 2140 msedge.exe 95 PID 2140 wrote to memory of 5012 2140 msedge.exe 95 PID 2140 wrote to memory of 5012 2140 msedge.exe 95 PID 2140 wrote to memory of 5012 2140 msedge.exe 95 PID 2140 wrote to memory of 5012 2140 msedge.exe 95 PID 2140 wrote to memory of 5012 2140 msedge.exe 95 PID 2140 wrote to memory of 5012 2140 msedge.exe 95 PID 2140 wrote to memory of 5012 2140 msedge.exe 95 PID 2140 wrote to memory of 5012 2140 msedge.exe 95 PID 2140 wrote to memory of 5012 2140 msedge.exe 95 PID 2140 wrote to memory of 5012 2140 msedge.exe 95 PID 2140 wrote to memory of 5012 2140 msedge.exe 95 PID 2140 wrote to memory of 5012 2140 msedge.exe 95 PID 2140 wrote to memory of 5012 2140 msedge.exe 95 PID 2140 wrote to memory of 5012 2140 msedge.exe 95
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/9edxwAyS#itYXxq8bUfnvI4n098BEhvU9Rv2UX01q7AcboVpxwbU1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xdc,0xe0,0xe4,0xd8,0x108,0x7ff8131946f8,0x7ff813194708,0x7ff8131947182⤵PID:3892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,18152446330178564868,15429612968711021220,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:22⤵PID:4764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,18152446330178564868,15429612968711021220,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,18152446330178564868,15429612968711021220,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:82⤵PID:5012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,18152446330178564868,15429612968711021220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:12⤵PID:4080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,18152446330178564868,15429612968711021220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:12⤵PID:2556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,18152446330178564868,15429612968711021220,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4528 /prefetch:12⤵PID:392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,18152446330178564868,15429612968711021220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:12⤵PID:3136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,18152446330178564868,15429612968711021220,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:12⤵PID:4860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,18152446330178564868,15429612968711021220,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5700 /prefetch:82⤵PID:4416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,18152446330178564868,15429612968711021220,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5700 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,18152446330178564868,15429612968711021220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:12⤵PID:4600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,18152446330178564868,15429612968711021220,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:12⤵PID:4632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8131946f8,0x7ff813194708,0x7ff8131947181⤵PID:2420
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,12206379592144506626,17683317855412447251,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:31⤵
- Suspicious behavior: EnumeratesProcesses
PID:2916
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3496
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4940
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD573c8d54f775a1b870efd00cb75baf547
SHA133024c5b7573c9079a3b2beba9d85e3ba35e6b0e
SHA2561ce86be0476a2a9e409fcb817126285bc4ad83efd03ee06a2f86910fe18d4d94
SHA512191344f5830cfea68499bd49073ffa7215a42265a9629d203d07849b2417c0ffdbdbf288bf2c669e91009a0d7e8bd6a6b378c92fc283049141231ca7bf4da3b8
-
Filesize
152B
MD54b206e54d55dcb61072236144d1f90f8
SHA1c2600831112447369e5b557e249f86611b05287d
SHA25687bf9a4c3564eb3d8bef70450da843ae6003271222734c4d28d9961c52782e0b
SHA512c9e8d2452368873e0622b002a0c2f8a2714b5897a09475738a9f9740122d716a9f0d3841725230d58e039564c820d32a6f3a675a7bb04bd163bab53dcb4e22f2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
6KB
MD55ed1f48e5e256eec7b9a1966406f7828
SHA1021807d530ccd2e68c98ce150c01b2af5d46100e
SHA256de5baddc30e824a7933146fce8a7abb6942f3d87a117664aeb59084df26b3f96
SHA512e28ccfd09e287e3eaf0b3aecb99782154daa59ac94bfca124cea6bb0ada912db3b47a543978eb8486e33250bc81eecf47a26f812ee1c260de70ae493bb5e8048
-
Filesize
6KB
MD57e19c61b77402784fb32d3c8703638ad
SHA1ab6a3dc8145f4e1613444641d42a0e96194ca1a2
SHA256d658be1efdaf251319e9707696ad27c42cfa4fef924e960e6d80ba0e99788a67
SHA51218af34f27ddfc636caa53c625dfa95b74e6da1a6bcd2e52196b3c23322102b94e11e258247c23b1379f58443a7e0fd5915b338b9821e99daca4d1c7f88282f93
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5f092ee552d8f2b4e0ad890d5c79284e4
SHA1fb8b8e3aee88494bb797de69cfd10c57df4dc404
SHA25679671c9cccaf7437986c09d5b147612b96a61ebc4de16eea7dcb6d0a702f6a07
SHA5121eeee8fd03de80d343d25436251bdb4a531880dfe0435b1a24f9b6fd621d4685ce03cb433061dc62a8e42e9a7b1296d00d780cbbcfc1842237d93b952c78d9ba