Analysis
-
max time kernel
50s -
max time network
47s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 20:03
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://drive.google.com/uc?id=1FGuSAhMQWohE3xqCTTFp5PxDUnpGYiN5&export=download&authuser=0
Resource
win10v2004-20240426-en
General
-
Target
https://drive.google.com/uc?id=1FGuSAhMQWohE3xqCTTFp5PxDUnpGYiN5&export=download&authuser=0
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Modifies registry class 2 IoCs
Processes:
msedge.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings msedge.exe Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 2476 msedge.exe 2476 msedge.exe 536 msedge.exe 536 msedge.exe 1148 identity_helper.exe 1148 identity_helper.exe 2720 msedge.exe 2720 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe -
Suspicious use of FindShellTrayWindow 33 IoCs
Processes:
msedge.exepid process 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 3760 OpenWith.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 536 wrote to memory of 4548 536 msedge.exe msedge.exe PID 536 wrote to memory of 4548 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 3000 536 msedge.exe msedge.exe PID 536 wrote to memory of 2476 536 msedge.exe msedge.exe PID 536 wrote to memory of 2476 536 msedge.exe msedge.exe PID 536 wrote to memory of 3928 536 msedge.exe msedge.exe PID 536 wrote to memory of 3928 536 msedge.exe msedge.exe PID 536 wrote to memory of 3928 536 msedge.exe msedge.exe PID 536 wrote to memory of 3928 536 msedge.exe msedge.exe PID 536 wrote to memory of 3928 536 msedge.exe msedge.exe PID 536 wrote to memory of 3928 536 msedge.exe msedge.exe PID 536 wrote to memory of 3928 536 msedge.exe msedge.exe PID 536 wrote to memory of 3928 536 msedge.exe msedge.exe PID 536 wrote to memory of 3928 536 msedge.exe msedge.exe PID 536 wrote to memory of 3928 536 msedge.exe msedge.exe PID 536 wrote to memory of 3928 536 msedge.exe msedge.exe PID 536 wrote to memory of 3928 536 msedge.exe msedge.exe PID 536 wrote to memory of 3928 536 msedge.exe msedge.exe PID 536 wrote to memory of 3928 536 msedge.exe msedge.exe PID 536 wrote to memory of 3928 536 msedge.exe msedge.exe PID 536 wrote to memory of 3928 536 msedge.exe msedge.exe PID 536 wrote to memory of 3928 536 msedge.exe msedge.exe PID 536 wrote to memory of 3928 536 msedge.exe msedge.exe PID 536 wrote to memory of 3928 536 msedge.exe msedge.exe PID 536 wrote to memory of 3928 536 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/uc?id=1FGuSAhMQWohE3xqCTTFp5PxDUnpGYiN5&export=download&authuser=01⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbbb1b46f8,0x7ffbbb1b4708,0x7ffbbb1b47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,9711684805719031407,1793320173331624416,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,9711684805719031407,1793320173331624416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,9711684805719031407,1793320173331624416,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9711684805719031407,1793320173331624416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9711684805719031407,1793320173331624416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,9711684805719031407,1793320173331624416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,9711684805719031407,1793320173331624416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2208,9711684805719031407,1793320173331624416,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5344 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9711684805719031407,1793320173331624416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2208,9711684805719031407,1793320173331624416,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5716 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9711684805719031407,1793320173331624416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9711684805719031407,1793320173331624416,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9711684805719031407,1793320173331624416,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,9711684805719031407,1793320173331624416,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:12⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD51ac52e2503cc26baee4322f02f5b8d9c
SHA138e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA256f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
SHA5127670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5b2a1398f937474c51a48b347387ee36a
SHA1922a8567f09e68a04233e84e5919043034635949
SHA2562dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
SHA5124a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD56fd044a01cf415a2a09b7cfc8f1e69ce
SHA13c8420078f1f8e96323d545fb09c1fc44e99a866
SHA256a08151bc6bc195b0db5e6b5598df92a4eedfc349479f367752f61f66e2f8147e
SHA51227101fe9a0859179f8a213eb6374ff9511e16175d4e349231179b1eda13722f30153978c43fcd454b774a7bba76577d149bcb47819c6b7b231c6b83bf3aa03f3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5505fde1105452d5d0b4f19ff00818f4c
SHA16b24c2d9742b0b1d5c9fd41e33cafebb7d5ecbf4
SHA256afd39a77c12441955260a2c47ee90ada6d222e188dadf5d77dc81ecb427323e3
SHA51229c59d24a61ad92edb40582153f041a63c525a4adb9fea70f72d847dc62f5792726e57f8f8cee0b56cd2453aa4230bb3918ab7b3c210d52bfa9d270ed3760d76
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD554124b758b7ee549e1217f8c08ee4325
SHA16e601345413f63209ed6db1d2d5c077401d5fdde
SHA256c3550cd6c29fb7d17091d46f4fe7f5c960102d8cdcf4472202c4ebe121126cef
SHA512bc776ad494b3edecd44d3f7e4a58dbe48cd312d1de50773a1d65516f44b33fd6522b3c1f038623b91a2eaa4291d284f2a098622204a91c520880126b3bc1d924
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD529adeee3b2eabb1f4f782320fd896e4f
SHA13c0d92b394920125731b506076c2a8df62d4731b
SHA25614678212e8dcf458765155b422e5b8c24219ada28e5b56fe45cf22b31f3c8b19
SHA5120d4876aca0d7eced45a9017d551ccd58568310b223a65478b58efbd73c63262c1c5a86fadcfbd73c95291ddd39da3a43f69cedac25cfd4bebe02b3c3c23682c2
-
C:\Users\Admin\Downloads\NOTIFICACION PROCESO PERSUASIVO EN SU CONTRA JUZGADO TERCERO DE EJECUCIÓN DE PENAS.REVFilesize
2.4MB
MD5a34cb6ea733e75cf143bd05d79d221d2
SHA1f0ff5cb01d24c8c9a6d077cee3b5755ffc2136a1
SHA25683f2f89d3a57817dc4ba2d543df43ff73deabf38ea9b7f214176ddb885ad2152
SHA5123b00832b84e2d4345e24aae49380c1f70d8889e8a6c4e6944c4addaa7bcf55deda08c23f80aba84cb681c0c28a76da12b31d18ef323ce12bfa0f8dde80065a6d
-
\??\pipe\LOCAL\crashpad_536_IJXDHOATRRFLCGTHMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e