Analysis
-
max time kernel
145s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2024 08:43
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://go-link.ru/mQLDX
Resource
win10v2004-20240226-en
General
-
Target
https://go-link.ru/mQLDX
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exepid process 1404 msedge.exe 1404 msedge.exe 1692 msedge.exe 1692 msedge.exe 1848 identity_helper.exe 1848 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
Processes:
msedge.exepid process 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1692 wrote to memory of 1752 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1752 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1776 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1404 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1404 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3984 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3984 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3984 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3984 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3984 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3984 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3984 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3984 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3984 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3984 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3984 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3984 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3984 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3984 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3984 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3984 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3984 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3984 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3984 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3984 1692 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-link.ru/mQLDX1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff850ad46f8,0x7ff850ad4708,0x7ff850ad47182⤵PID:1752
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,7416479315297123916,4879692438540980710,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:22⤵PID:1776
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,7416479315297123916,4879692438540980710,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1404 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,7416479315297123916,4879692438540980710,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:82⤵PID:3984
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7416479315297123916,4879692438540980710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:12⤵PID:3928
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7416479315297123916,4879692438540980710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3644 /prefetch:12⤵PID:2112
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7416479315297123916,4879692438540980710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:12⤵PID:1212
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,7416479315297123916,4879692438540980710,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:82⤵PID:1208
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,7416479315297123916,4879692438540980710,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5640 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1848 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7416479315297123916,4879692438540980710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:12⤵PID:3392
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7416479315297123916,4879692438540980710,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:12⤵PID:1528
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7416479315297123916,4879692438540980710,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:12⤵PID:4644
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7416479315297123916,4879692438540980710,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:12⤵PID:3148
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3460
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4504
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5fd7944a4ff1be37517983ffaf5700b11
SHA1c4287796d78e00969af85b7e16a2d04230961240
SHA256b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74
SHA51228c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a774512b00820b61a51258335097b2c9
SHA138c28d1ea3907a1af6c0443255ab610dd9285095
SHA25601946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4
SHA512ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
192B
MD5596ddfff75c832c56d9543f241f6dce5
SHA1a1a3c5703474a62d0f64bb3bcbb2588486776ab1
SHA256333fe4ee5572e9441af7094a0ce0f2e701bbc49501a8fc701ce961ebe860fbbc
SHA5120704c2e0b265d8e937d53393d4dfcdefdb1d33371d51ef723734007815a0c965264e6f55d7962de745d82e227d1fa94d0147e7cfdea443f80e5a952c1d7051bd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
168B
MD560ddcf2c6dd129153985357a013880af
SHA12b22412f5b957a951e2d5a090618abb4516998fe
SHA2565d97ce231e46e3c1691c28dd94e928f2f7bded816cd0744bd60b859a290a623d
SHA512e4622eeb13843b8ce1873b8e61ae9bfc693dae3501016cffe77d5575e0f7511933e11e30aee6c4ce60dc9f85844726c2e0a95f73e5b631671b57348df729ea1b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
695B
MD59bdbde7aca33e456552f8de2d6d289b2
SHA1455ec7480e528ffe3ab9dedd870753575fe48b8e
SHA2565ef2b592dfdbdba345dcfb91f4d22f8adf5273e56974784afd7f88bbb634b193
SHA512048576973f16dc9ac131f6b51daf99146f1665212eadd68bfa3e08414fbdb866df706597e28c542ec2e7e57b636b15463392b9515ea160bc6ccecde51aa2dbd3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5c4d782e8c0162c54e9320c22e26c9e96
SHA13765558953ee161489b685d789be58813c314f35
SHA2566fb122e773dc5bb0b101ba73b6a3eecafe5733680a89cabc89872eb438cec0f4
SHA512482c16d1e3b3f04e466bd917db28f9ef38a39fa63f81c0b433ec18e5a14a5ffa517325662de6c78a8d54b3431a46530221d916e12d026e6a9720c54fef4f6e37
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD522fac158b7f6a76d357d3eaacb66399d
SHA13beb4287f7dcb54b4e7911daf13521d5cf8acc7d
SHA256d8631328a0928c39fa1606f387e87ee3cd4b9db1a525cde40bd0bada144eec9e
SHA512354b7227ba1ac062aad7fb23c0c3c4d84517d7c7482749dea526cfe08ef1b74e289ea7ee78270f8571071f4abc975c985683e4c4612abe9ed7a054ca6e226097
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD532647fa0f3da3c078d0f8a5203154c8b
SHA1edc67eaa04b34c9f2e8d1c6c348a672e8287d5f8
SHA25650044f61400b854a4183686536b9068aea0efdcf999db36da0e923fbd171dbee
SHA512fa1b26c98af888bb1399244edf24fb00e536a1e709fcf18d43558055b6cd5dc3f581ddc976b2ed84ae4a20b0b1784554791475cd496438a880fa890e6f3f0a31
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD56ea89bd8164e39813d73f0e8c2fc05b3
SHA1ff0eb4c1b18d3a56d7f573845c1b111fef5aa322
SHA256c1bb89b0bbe2e52c4d92948631ed30d97a770a21dc56809d5063683d59ad9303
SHA512c7b82d53e6f50adeaa66c672d35f23f784ba07a17be831553f67cd6d0d5c012e57dbae99236d83a7edc5f05ee90dd48f17c951bf63ea64043fe60a1ea47274f9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD58438fd4ccbad5a2a6f8b222ba7ca494e
SHA100993a5bd6a5a82300d513fc3b9f1ce66a996b99
SHA256235a546a0991c77be6574a893414f504504f558a431dc9fd9542bf4f99df3bc8
SHA5121b602c6a4bc561ef85fd264e50e28d7a2a2b00bbae57b924546b7633b408904c393fca06de54ab2f30f6e377095efb9497633d992af24100c7b00b87913a7081
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD53ac29ef567209d1ac88b8da855e8e3ce
SHA11a4a3ce5879f395b60520190ba78914aaef0b9e8
SHA256aa40f27f0cc628d43a9dc24190d328177f13d83351289a6136214c8d35f85a5b
SHA512783a1625dd3f6b90fc5b012cf75418e35e9f478543acfa497cda39ee5a940f4a511bcdfd3fda90bec430ba73839a6664e2be494521377c2e8dc5596c274c8ffe
-
\??\pipe\LOCAL\crashpad_1692_ZGLURVEYMRETZUVVMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e