hxxps://bitly[.]cx/EVFV

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
18-05-2024 19:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bitly.cx/EVFV

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3244	msedge.exe
3244	msedge.exe
548	msedge.exe
548	msedge.exe
4984	identity_helper.exe
4984	identity_helper.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

548 msedge.exe
548 msedge.exe
548 msedge.exe
548 msedge.exe
548 msedge.exe
548 msedge.exe
548 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 548 wrote to memory of 1468	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1468	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 1676	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 3244	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 3244	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 872	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 872	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 872	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 872	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 872	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 872	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 872	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 872	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 872	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 872	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 872	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 872	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 872	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 872	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 872	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 872	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 872	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 872	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 872	548	msedge.exe	msedge.exe
PID 548 wrote to memory of 872	548	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bitly.cx/EVFV
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe8a946f8,0x7fffe8a94708,0x7fffe8a94718
2⤵
PID:1468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,9496641684403444341,13640617060375519264,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
2⤵
PID:1676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,9496641684403444341,13640617060375519264,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,9496641684403444341,13640617060375519264,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
2⤵
PID:872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9496641684403444341,13640617060375519264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
2⤵
PID:2976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9496641684403444341,13640617060375519264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
2⤵
PID:3260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9496641684403444341,13640617060375519264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
2⤵
PID:3672

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,9496641684403444341,13640617060375519264,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
2⤵
PID:3036

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,9496641684403444341,13640617060375519264,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9496641684403444341,13640617060375519264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
2⤵
PID:2800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9496641684403444341,13640617060375519264,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
2⤵
PID:1624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9496641684403444341,13640617060375519264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
2⤵
PID:1256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9496641684403444341,13640617060375519264,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
2⤵
PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,9496641684403444341,13640617060375519264,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4752 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4620

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
456B

MD5
76f693dff488bdf91751f19bf86b9fd7

SHA1
1125dca0509e648ec602805c33fc545b08245f93

SHA256
1ac8497287e959fda614b340642234ea109e2ab1379e4bd39d7daa1f608e216a

SHA512
371fc062d21ce5f643eda7f5c481b6f196bdb06e5d0c87b186b59f10a00f34dc38a0ec621ec1b6abf6cce55a4b7a6ac3793106297e5cdb5e29d0f1b5446ed680

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
aaa65364c2a2b71bcd06f8eb47668852

SHA1
0f5f114b36b7c1106df20e63c4e3bf75274e9891

SHA256
c96f6e187847e3c87b18a649ac2672f3abdae990b010355da459dd251972596b

SHA512
14ff415c9a340eda2f6ea711f1623beb2f2de11daf9385674a536b9064f4aa8bf97bd90253e4c57101a29ccc4c6c9eb5dcbbe929b972a4cab46cd50c4731015e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
3fad8a51e01ba0569d3bdd31092f83ed

SHA1
39fbc4dedef08bcd5508e648fd6ff950dab99def

SHA256
991b333c9566463b0639e24cb569c909635f6365758dc8a7f04b203928ea40a1

SHA512
925c235710e188c96628c9f3f56a4afd0e828327edf620d948e0a87f3718cb52addd7c5ed8e6c3df3b7e7e8fa0f7bbe252e709e35c957762196198646fc2e60b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
ce1bff67f7d83bf2edb32f96d563e7e4

SHA1
d89373e26e90e71ffb7b173804b9f40997356c88

SHA256
e1c7bb9ea05ff23510c1388a5f8dd1f9c92ab956f6c3b37f52f36139b00bcf75

SHA512
56458d08ef7a5306f54823735048392a7e319dceff37a169a5396ada4c1760c5b162494f5c2e2a401413b7e310580dd9d2c03cb96ef7e2717fd8784a759e8c1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
09369d1b788cb3ba8ef53e076a5e1c23

SHA1
43f8fe1a830b78176d9be8f73327d6ef084d173a

SHA256
458424874fb819f19475fb1e002755b68726e6a53361b77ae62a98966710b046

SHA512
5f32a0dde201ac2b275858cf98a08af1235770177b37d1e39d7b6fd1be22912667140e1495d23feec419fc52bdaad5f136c16ddd24e83f4a2cf16937f0769710

Download Submit
\??\pipe\LOCAL\crashpad_548_VFVZOBJHGITBNLOI
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit