Analysis
-
max time kernel
88s -
max time network
76s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 10:07
Static task
static1
Behavioral task
behavioral1
Sample
slinkyloader.exe.url
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
slinkyloader.exe.url
Resource
win10v2004-20240419-en
General
-
Target
slinkyloader.exe.url
-
Size
214B
-
MD5
004d3539eeb76a64787462b376373b13
-
SHA1
6a90527ced609174759421b2f65f318f2e57cc4a
-
SHA256
e9af7619ba69ebc26ff1d34c09a9dcbe75bebb9de4c74c196116c9e8726a90f7
-
SHA512
5e3fbd60d0ec0d7643701d1038e0e25db562b8381c0307cb560637cf569241a786e49ecc4fb65404877d644203b13cf076b43a2767b614128c421591fff0f74f
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exepid process 4520 msedge.exe 4520 msedge.exe 1916 msedge.exe 1916 msedge.exe 1988 identity_helper.exe 1988 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
Processes:
msedge.exepid process 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
msedge.exepid process 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
rundll32.exemsedge.exedescription pid process target process PID 740 wrote to memory of 1916 740 rundll32.exe msedge.exe PID 740 wrote to memory of 1916 740 rundll32.exe msedge.exe PID 1916 wrote to memory of 3320 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3320 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 3700 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 4520 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 4520 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 4428 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 4428 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 4428 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 4428 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 4428 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 4428 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 4428 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 4428 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 4428 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 4428 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 4428 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 4428 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 4428 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 4428 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 4428 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 4428 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 4428 1916 msedge.exe msedge.exe PID 1916 wrote to memory of 4428 1916 msedge.exe msedge.exe
Processes
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\slinkyloader.exe.url1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1228131383579381842/1228131643366314065/slinkyloader.exe?ex=662ee239&is=662d90b9&hm=85a33b9a36fe65fc8cee3f2c86b6aaab3d538524394808a294a1771414b043cd&2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc966f46f8,0x7ffc966f4708,0x7ffc966f47183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,15127520826906033539,15533125845063275360,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,15127520826906033539,15533125845063275360,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,15127520826906033539,15533125845063275360,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15127520826906033539,15533125845063275360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15127520826906033539,15533125845063275360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,15127520826906033539,15533125845063275360,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4780 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,15127520826906033539,15533125845063275360,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4780 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15127520826906033539,15533125845063275360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15127520826906033539,15533125845063275360,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15127520826906033539,15533125845063275360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4524 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15127520826906033539,15533125845063275360,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15127520826906033539,15533125845063275360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15127520826906033539,15533125845063275360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15127520826906033539,15533125845063275360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15127520826906033539,15533125845063275360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2208 /prefetch:13⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5dbac49e66219979194c79f1cf1cb3dd1
SHA14ef87804a04d51ae1fac358f92382548b27f62f2
SHA256f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562
SHA512bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a9e55f5864d6e2afd2fd84e25a3bc228
SHA1a5efcff9e3df6252c7fe8535d505235f82aab276
SHA2560f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452
SHA51212f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD53d2190dc8692456e5e9a4e4916551260
SHA14f6a59bcd1c52761ec00de7bcab6863a924e4f5b
SHA256c9438e6df7b09e7510d8d56453e7ab714a93d150c1be06425153279edd53d22a
SHA512c45799b008217529a631cc6a580ec94bf03371a1d0f70f3fa128cdfeafa10eaa80c3f9784767b44f6a8cecf55297bd65c9527368d9f5481f48f25695d4a3a6c3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5d2e6b3c890b1eeb16c538b26ba7a5b2c
SHA1b6e0025b8619a5b5fa417cf7b41dc6a1023aeae3
SHA256289437ba461637be8ba5b78710f2927ee89c5157212cedb4b41abedea70a9c20
SHA5127a5c5fdf4f8386d230bae5e1af93f6e771497bc66c0e802aba4c1f197d38ef2f7c62439acce85baca424a9bbccda5129bf0cedba2fadd34419ee4edb111db669
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
8KB
MD569970a02132a11fd3ff95df252cced96
SHA134b095c6a8bb76087a852d04b9669506816aaf1f
SHA2567018bbb2fbfc0c5610233dcf2437b689b3b462c9721fa5224320275a6ec7c938
SHA512ab7b38de9cfa93bdce383276e14e0cdb694d429fbd0e129e5bad90c1cf0661926ef23755404b350d10a7277c29d959657df1ce1ad73859c28af7baeb4397f297
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
9KB
MD503ea2730390a29fadff06a5f8f031ec4
SHA1045c111ef24273de971a54ec8a43541b2b0915cc
SHA256859c75d31157d764c40007c26013a81ef9473fb337e1061bbbf9f65bd7436e1e
SHA512a977a3b3135e7b3b1a65883feac4034b8a4e784b3e6f196f741df14b4add766a3e6ea83e8cdfeafcefbf86d4b33a9879dda5430d8150c67e895e166ae9933176
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1Filesize
264KB
MD5bf4ad6b50b06cbc728bf6187b4c809a7
SHA13b59a99f9c5b18cf97c518b545d1c26a2ab8174e
SHA256cb5f2f89786d6b4d36b9982d4fb64bb4d698d8f3acc6e9a3aa6339fd93ab8053
SHA512c57d74244f574e8771851c556442fccb509409c35eb454e552eb48b7d1fecb4331a3d42bb0ace68f222435dfa5bec7866704a09c8e396186c70c6d9c44a48468
-
\??\pipe\LOCAL\crashpad_1916_MMYBAMKUQZYKEJRPMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e