hxxps://tinyurl[.]com/344fczr9

Analysis

max time kernel
1794s
max time network
1796s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
14-05-2024 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://tinyurl.com/344fczr9

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe
4628	msedge.exe
4628	msedge.exe
1792	identity_helper.exe
1792	identity_helper.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 4644	4628	msedge.exe	77
PID 4628 wrote to memory of 4644	4628	msedge.exe	77
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 4324	4628	msedge.exe	78
PID 4628 wrote to memory of 3736	4628	msedge.exe	79
PID 4628 wrote to memory of 3736	4628	msedge.exe	79
PID 4628 wrote to memory of 3820	4628	msedge.exe	80
PID 4628 wrote to memory of 3820	4628	msedge.exe	80
PID 4628 wrote to memory of 3820	4628	msedge.exe	80
PID 4628 wrote to memory of 3820	4628	msedge.exe	80
PID 4628 wrote to memory of 3820	4628	msedge.exe	80
PID 4628 wrote to memory of 3820	4628	msedge.exe	80
PID 4628 wrote to memory of 3820	4628	msedge.exe	80
PID 4628 wrote to memory of 3820	4628	msedge.exe	80
PID 4628 wrote to memory of 3820	4628	msedge.exe	80
PID 4628 wrote to memory of 3820	4628	msedge.exe	80
PID 4628 wrote to memory of 3820	4628	msedge.exe	80
PID 4628 wrote to memory of 3820	4628	msedge.exe	80
PID 4628 wrote to memory of 3820	4628	msedge.exe	80
PID 4628 wrote to memory of 3820	4628	msedge.exe	80
PID 4628 wrote to memory of 3820	4628	msedge.exe	80
PID 4628 wrote to memory of 3820	4628	msedge.exe	80
PID 4628 wrote to memory of 3820	4628	msedge.exe	80
PID 4628 wrote to memory of 3820	4628	msedge.exe	80
PID 4628 wrote to memory of 3820	4628	msedge.exe	80
PID 4628 wrote to memory of 3820	4628	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://tinyurl.com/344fczr9
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb0f573cb8,0x7ffb0f573cc8,0x7ffb0f573cd8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1724,11907441378395314581,12814245267692983397,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1724,11907441378395314581,12814245267692983397,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1952 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1724,11907441378395314581,12814245267692983397,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,11907441378395314581,12814245267692983397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,11907441378395314581,12814245267692983397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,11907441378395314581,12814245267692983397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1724,11907441378395314581,12814245267692983397,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,11907441378395314581,12814245267692983397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,11907441378395314581,12814245267692983397,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,11907441378395314581,12814245267692983397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,11907441378395314581,12814245267692983397,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1724,11907441378395314581,12814245267692983397,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1724,11907441378395314581,12814245267692983397,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5428 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
046d49efac191159051a8b2dea884f79

SHA1
d0cf8dc3bc6a23bf2395940cefcaad1565234a3a

SHA256
00dfb1705076450a45319666801a3a7032fc672675343434cb3d68baccb8e1f7

SHA512
46961e0f0e4d7f82b4417e4aac4434e86f2130e92b492b53a194255bd3bba0855069524cd645f910754d4d2dbf3f1dc467bcc997f01dc6b1d8d6028e2d957236

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d22039bc7833a3a27231b8eb834f70

SHA1
79c4290a2894b0e973d3c4b297fad74ef45607bb

SHA256
402defe561006133623c2a4791b2baf90b92d5708151c2bcac6d02d2771cd3d6

SHA512
c69ee22d8c52a61e59969aa757d58ab4f32492854fc7116975efc7c6174f5d998cc236bbf15bce330d81e39a026b18e29683b6d69c93d21fea6d14e21460a0a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
bb11b4549d7a1188d52910dfc1feb4e7

SHA1
1ad5de313d07daa16de152cb8afcffb6d97d3604

SHA256
b16471ccc9535d04b952c8ca6bce129d40941251e78e2e6874652b31310269d5

SHA512
e789961bc9f1335a547857a7380ae25039e7657cc5fb41bd23110777d6045cdbbb470102b98f67897286e0ec6c9dd1a5946d33ecf647d70456b8075065cb9041

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
0dc20cc02efe6d0798b9922d09350b86

SHA1
d8fc049f718e6ac27737f49be2a89973113b9762

SHA256
18caaa402f9cec44a1f0bc6e19df1e8a393821c37941a97a0b1d9740a8ec6ed8

SHA512
0d3294c1331ea902106519b444c828e901dc3295c6cbf2b45a3c49cd962b7bdd761a736913c074b8318f4b0eb9692fa8d789fd3bbbaddeddd096fc8f5d4285be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
72491b593b5ead9e1c2d5b3df9268a2b

SHA1
0c5212f2bb3a70ff8bf3e4808336455aea2ec57e

SHA256
4755ffacc5276af9ccd9583b5e64267a173957849aa89ad5d0cb543256191279

SHA512
c8705dd92ea4f188fc905a93e1595224099cf94fa06bb53654fb46eda89acb27523647e7e39fe444d4ab482a4fe93f61f61bfbb1d1bb070437c83c5f7de7acea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2a22c867e197de3f75e8be4611e5de44

SHA1
fff735a6a8b1332a96ffe70fd4a103be2d2fd577

SHA256
559e17c7e355b056d910e30b8add970cf946e28cb1fdb120c0538d0895a9265c

SHA512
0273021763942a0f36d44e6e12727a9bb5408db69193b03112158e27a4b3215f9eba524d0882b08324bc06f88e8b77f9a35b77a32ca4dd029ccf15114cda4702

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9f89a90fb418a2267b4a90fe0b06f47b

SHA1
fc8a932d26c204c69795a54c390f98a6b3e1b44d

SHA256
a40238bccc66bb36c9d7d21b1bac3dd2fa57750c08123010bec9d567fb3f3543

SHA512
ebc26ca66ba74cf4e9dd4792938857dcd02f8f5dd5387f34217f7f338920f29d8ad79f891f2cb83641802c28ffbcdbc32de92fc995361fb163264fd93f6e9a7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5b2c8ef896713b54e6d0f7aa2819ff43

SHA1
4b5c3e59673a3028180ad607bb98ba5ac5ecf66b

SHA256
049d33491e6ef3891b91056429216aaa20e4c6cf7cce29a4783da6ca2cc953e1

SHA512
d2c5fd92e682a9f9fd6411ba0a2d39d1584aae272ae826494505be0e4d3d0756c502a09f1a3d9f37e83cbc363e92cddd5ebd4a2722d419a81b021e031152758e

Download Submit