hxxps://go-link[.]ru/o060M

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-04-2024 08:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://go-link.ru/o060M

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3712	msedge.exe
3712	msedge.exe
4836	msedge.exe
4836	msedge.exe
4348	identity_helper.exe
4348	identity_helper.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

4836 msedge.exe
4836 msedge.exe
4836 msedge.exe
4836 msedge.exe
4836 msedge.exe
4836 msedge.exe
4836 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4836 wrote to memory of 2228	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 2228	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3352	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3712	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3712	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe
PID 4836 wrote to memory of 3764	4836	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go-link.ru/o060M
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8d6c46f8,0x7ffa8d6c4708,0x7ffa8d6c4718
2⤵
PID:2228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,2527460234584408803,4911757070261703475,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2348 /prefetch:2
2⤵
PID:3352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,2527460234584408803,4911757070261703475,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,2527460234584408803,4911757070261703475,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2428 /prefetch:8
2⤵
PID:3764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,2527460234584408803,4911757070261703475,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
2⤵
PID:2248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,2527460234584408803,4911757070261703475,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
2⤵
PID:5020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,2527460234584408803,4911757070261703475,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
2⤵
PID:1900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,2527460234584408803,4911757070261703475,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
2⤵
PID:3908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,2527460234584408803,4911757070261703475,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
2⤵
PID:1664

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,2527460234584408803,4911757070261703475,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
2⤵
PID:448

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,2527460234584408803,4911757070261703475,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,2527460234584408803,4911757070261703475,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
2⤵
PID:1388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,2527460234584408803,4911757070261703475,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
2⤵
PID:4112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,2527460234584408803,4911757070261703475,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
cbec32729772aa6c576e97df4fef48f5

SHA1
6ec173d5313f27ba1e46ad66c7bbe7c0a9767dba

SHA256
d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e

SHA512
425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
279e783b0129b64a8529800a88fbf1ee

SHA1
204c62ec8cef8467e5729cad52adae293178744f

SHA256
3619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932

SHA512
32730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
168B

MD5
f32e9ba6f93f7b84cf872e358fd17786

SHA1
4168ab95b018d49585e440ea789dcfcbc731307f

SHA256
de82238727b893930a96570b5e3cc6e75f1c70fd82333cc31d4c74d05db43acc

SHA512
be2a560d4798d80c42386ca8be5d35c65292636f04d1f5bc713d96ce6fa54b6ac3c29ba51435b7086b8d200bcb147d86b06c5c2db4fafa1625f2a60ee535e23e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
694B

MD5
570a7d1350c051f541f045df74347b49

SHA1
3ce3e73f08f3fc22f3294a3713569543378d16f2

SHA256
31192cd454010d69b958fc89288f34b7f845bbcd44e012d6b3055189017ec183

SHA512
df6aca0e329486277fbd26da454197e4f87d53b77daaf6b64faeab81f7c0ef1696c4a7c62a0781122583a5d01f8546e07e7dce19886242b9528dfaa69a834d15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
9b592cea99c79ac4b6ffe5e372e3d148

SHA1
3ea8f58f4df39bae8ee9898dfb046e7b150e971b

SHA256
a6e5ccf365ae8675f200742affd9a5a2bc057e78b1c6f3ea8f60ce319cf4e7a1

SHA512
c604ed157b0bb6c5a7cec546146f5e868566bfc5bd7ec578af4f351f354afefceca85bb96ee8662c5aca4ebdc47b377273e293c100cc52fce49b95d0375d21d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
1503c32fc197f66462ed9201799aef7b

SHA1
85ed323494f5a5f9583a30282d6d16b6393c1291

SHA256
34c0afb819414d05f2608036a2c3b4083d2951b77449a7689af4286603abf2d5

SHA512
4463f1b3bad06f24f1dabacbe16564f2db940c061b7236e0c13dca2a2bf8a8d53020d53c2302920cd0127576a01a2e2090259c1be7781c9668af6a79b800c1cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
abd72cec442abb98e8b8d71111751870

SHA1
0c54da8a2402104eae79263b49ce7d766070a970

SHA256
89d4489e1b6586bf482f451e46c0bd794ecd1285404599712f31c5ceb239f401

SHA512
a78a450bdc97ce4b06a2befd66f83a1945b885788ed3c2648de5c366f467542308339d8fc3af7e5c99f283914a6f1d48872c4e650c02a2d6a478fa9c59bb0694

Download Submit
\??\pipe\LOCAL\crashpad_4836_KHGQWIWTCOVNCPWM
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit