hxxps://snip[.]ly/fscx58

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 02:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://snip.ly/fscx58

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2764	msedge.exe
2764	msedge.exe
3524	msedge.exe
3524	msedge.exe
3032	identity_helper.exe
3032	identity_helper.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 4572	3524	msedge.exe	83
PID 3524 wrote to memory of 4572	3524	msedge.exe	83
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 4964	3524	msedge.exe	84
PID 3524 wrote to memory of 2764	3524	msedge.exe	85
PID 3524 wrote to memory of 2764	3524	msedge.exe	85
PID 3524 wrote to memory of 2160	3524	msedge.exe	86
PID 3524 wrote to memory of 2160	3524	msedge.exe	86
PID 3524 wrote to memory of 2160	3524	msedge.exe	86
PID 3524 wrote to memory of 2160	3524	msedge.exe	86
PID 3524 wrote to memory of 2160	3524	msedge.exe	86
PID 3524 wrote to memory of 2160	3524	msedge.exe	86
PID 3524 wrote to memory of 2160	3524	msedge.exe	86
PID 3524 wrote to memory of 2160	3524	msedge.exe	86
PID 3524 wrote to memory of 2160	3524	msedge.exe	86
PID 3524 wrote to memory of 2160	3524	msedge.exe	86
PID 3524 wrote to memory of 2160	3524	msedge.exe	86
PID 3524 wrote to memory of 2160	3524	msedge.exe	86
PID 3524 wrote to memory of 2160	3524	msedge.exe	86
PID 3524 wrote to memory of 2160	3524	msedge.exe	86
PID 3524 wrote to memory of 2160	3524	msedge.exe	86
PID 3524 wrote to memory of 2160	3524	msedge.exe	86
PID 3524 wrote to memory of 2160	3524	msedge.exe	86
PID 3524 wrote to memory of 2160	3524	msedge.exe	86
PID 3524 wrote to memory of 2160	3524	msedge.exe	86
PID 3524 wrote to memory of 2160	3524	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://snip.ly/fscx58
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80fb846f8,0x7ff80fb84708,0x7ff80fb84718
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,7307143401850857501,6653817795231367231,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,7307143401850857501,6653817795231367231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,7307143401850857501,6653817795231367231,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7307143401850857501,6653817795231367231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7307143401850857501,6653817795231367231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7307143401850857501,6653817795231367231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,7307143401850857501,6653817795231367231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3476 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,7307143401850857501,6653817795231367231,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3476 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7307143401850857501,6653817795231367231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7307143401850857501,6653817795231367231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7307143401850857501,6653817795231367231,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7307143401850857501,6653817795231367231,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,7307143401850857501,6653817795231367231,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2948 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
aabb4bc5f1e1b5cf5524f6aec1b28396

SHA1
25a03f4349b865e3fdb789b1c03dfcd37f9c9e68

SHA256
086e4247cdedde6fad9342e8e5115aca97aeb3778a55eecb956333c41d93d3af

SHA512
ef76b41b4007233139641a096f5790cc8a6b3e0dd0e47846463da99689210efbe539b3b1ed8de4530c411607d1724b14881963bc24f3be2460f55ae341c9f491

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
540B

MD5
286499bdfe2fff826a6c2b6bb2dfa16f

SHA1
9ebe680d5682e48e320d8e73095eb8bc6e6c3939

SHA256
849126d0ea1f9faaad1b58e1492343faa37026c1784d76d93a4c366cf5a66ffe

SHA512
447cd84db89591451fcc72b564a275ac9261d0109cbda9930a7c66ff6f92796e9ee0c81509dfadd6bd7c96ad9e0624ebbb109b56f7774ebc1c555ce101a5dd59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
70391d61c4ac2bf24645c4db917be656

SHA1
a54cd8a42bf53157ca17e151a9cdaf6586dede8c

SHA256
1d69a1c40cf239ff0bea808f285cb70d267d25285ab115162b9322fb1349be05

SHA512
cd40911b97543284aa8da40d48bf53b7f8d0b5e10305c0d4f8be00acaf87379cfd49111ac072f37f1e8f2a3296de6d92c44aa3fa9eb77591fd7f6439095bce86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5318e9ad1912724fd4e5ae1a905993a6

SHA1
9b0e99cba56a91efa3208718036f1b96295f99d5

SHA256
dcf67c1d23f0997ad658703a03f6f4a80fdb72f5add0a2fb1448ca176154b42a

SHA512
cda96b96dbc2f61b56a8330987f5e0c9da2de6e1cd06ab19bbd917c9cc280e1a970006fdd4acf88bc462f260d3a51d11d410e487abef48017b374caaa3422896

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9a2be6712a8eaee3138bedde3a944a5a

SHA1
d7812fe9a29d615e092ac7c28201bf684ca6699f

SHA256
081a20b00fc81a588baa83a7e99474c7126a0389f27cbdaa8e9af3adbce5b786

SHA512
50eea175330cee076743715dee050807a83a76b5cd80e15996904aad79b6189db75dd0fb3caee98a449d551dab9309681f3e571fcee4433b7e6cc60bf768f3c4

Download Submit