Analysis
-
max time kernel
15s -
max time network
15s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
25-04-2024 20:43
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://drive.google.com/file/d/1tzgLFk_NoPXB5XjGG9h_hDb1ipmhDNhi/view?usp=sharing
Resource
win10v2004-20240412-en
General
-
Target
https://drive.google.com/file/d/1tzgLFk_NoPXB5XjGG9h_hDb1ipmhDNhi/view?usp=sharing
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exepid process 1304 msedge.exe 1304 msedge.exe 2196 msedge.exe 2196 msedge.exe 3768 identity_helper.exe 3768 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe 2196 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 2196 wrote to memory of 4932 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4932 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 4864 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 1304 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 1304 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 2656 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 2656 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 2656 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 2656 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 2656 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 2656 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 2656 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 2656 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 2656 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 2656 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 2656 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 2656 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 2656 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 2656 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 2656 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 2656 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 2656 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 2656 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 2656 2196 msedge.exe msedge.exe PID 2196 wrote to memory of 2656 2196 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1tzgLFk_NoPXB5XjGG9h_hDb1ipmhDNhi/view?usp=sharing1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8273846f8,0x7ff827384708,0x7ff8273847182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,6285435109339382211,1663659575106666970,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,6285435109339382211,1663659575106666970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1992,6285435109339382211,1663659575106666970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,6285435109339382211,1663659575106666970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,6285435109339382211,1663659575106666970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,6285435109339382211,1663659575106666970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,6285435109339382211,1663659575106666970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,6285435109339382211,1663659575106666970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,6285435109339382211,1663659575106666970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,6285435109339382211,1663659575106666970,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,6285435109339382211,1663659575106666970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,6285435109339382211,1663659575106666970,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:12⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a9519bc058003dbea34765176083739e
SHA1ef49b8790219eaddbdacb7fc97d3d05433b8575c
SHA256e034683bc434a09f5d0293cb786e6a3943b902614f9211d42bed47759164d38b
SHA512a1b67ccf313173c560ead25671c64de65e3e2599251926e33ce8399fde682fce5cb20f36ee330fcd8bb8f7a9c00ef432da56c9b02dfd7d3f02865f390c342b53
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5cb138796dbfb37877fcae3430bb1e2a7
SHA182bb82178c07530e42eca6caf3178d66527558bc
SHA25650c55ba7baeebe1fa4573118edbca59010d659ea42761148618fb3af8a1c9bdd
SHA512287471cccbe33e08015d6fc35e0bcdca0ec79bebc3a58f6a340b7747b5b2257b33651574bc83ed529aef2ba94be6e68968e59d2a8ef5f733dce9df6404ad7cc5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5b54e3f70f797ff5ed94ed90e9f83983e
SHA10ee9343ca0854c343118d93025b12a2800ca0f82
SHA256236c7bc9a6924b2d321e04f5128db08e8a4e95be348726e7aa9f4c2a5f3e227b
SHA512105abf3947708d3ae5abaa0dfe008a976dfc2054fe89504167b3edefae86bdcbeee0b3b2ce38d56b5db530c038cd26d1de89cbc648ed8f74a1a9c7d200d4a922
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD50daca12ec4861a91e45b292c5b2058d4
SHA1e0092a846c5a0c2ad9d85d93bdb406190f955a83
SHA256f5b9cbb5ac1a639f0534d63e2d80f406ecdd66f656b977189025e8e7e0e1b079
SHA5124ca6bcb0dfe485e4d982da6615ff28ad962a75eacbd5e2e0c309320805bc39c2ba080f24581ebfbab743245b00738352867bd201becc7a1fc381b8170ee1aaff
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD541ec0566c7da338c96d58b44f5e9d9da
SHA1baea410be9b94d6389fba4ba09c19fcde3d5d93f
SHA2561bb1dd99ad2a3d2cd2d5e33296869d6c83a80fb1cc65250a4925d5a11cad4939
SHA51206a64761e3fc06e5771de680995aac67fce41c919e9b532b74b3132af0c05417f251b66655ae5402f6e8d9d2756e8bd1650135711e6002bec94413e88d39c8fb
-
\??\pipe\LOCAL\crashpad_2196_CMKSIJQTKAYRWQOGMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e