Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 14:49
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://sc.link/JLifB
Resource
win10v2004-20240426-en
General
-
Target
https://sc.link/JLifB
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 2636 msedge.exe 2636 msedge.exe 3640 msedge.exe 3640 msedge.exe 3360 identity_helper.exe 3360 identity_helper.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe 4960 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3640 wrote to memory of 2540 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 2540 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 1164 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 2636 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 2636 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 532 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 532 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 532 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 532 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 532 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 532 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 532 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 532 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 532 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 532 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 532 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 532 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 532 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 532 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 532 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 532 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 532 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 532 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 532 3640 msedge.exe msedge.exe PID 3640 wrote to memory of 532 3640 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sc.link/JLifB1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc8b8946f8,0x7ffc8b894708,0x7ffc8b8947182⤵PID:2540
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,14011813866548009732,3503637540849445607,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:1164
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,14011813866548009732,3503637540849445607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2636 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,14011813866548009732,3503637540849445607,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:82⤵PID:532
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14011813866548009732,3503637540849445607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵PID:4108
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14011813866548009732,3503637540849445607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:12⤵PID:4492
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14011813866548009732,3503637540849445607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:12⤵PID:456
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,14011813866548009732,3503637540849445607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:82⤵PID:3112
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,14011813866548009732,3503637540849445607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3360 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14011813866548009732,3503637540849445607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:12⤵PID:3212
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14011813866548009732,3503637540849445607,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:12⤵PID:4896
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14011813866548009732,3503637540849445607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:12⤵PID:916
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14011813866548009732,3503637540849445607,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:12⤵PID:4524
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,14011813866548009732,3503637540849445607,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4972 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4960
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2476
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1528
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD51ac52e2503cc26baee4322f02f5b8d9c
SHA138e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA256f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
SHA5127670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5b2a1398f937474c51a48b347387ee36a
SHA1922a8567f09e68a04233e84e5919043034635949
SHA2562dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
SHA5124a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
216B
MD5002fe59a189f05dbe9dea3bc7473b78e
SHA1d0212f204809adcc048b54e7d427175e604b3a08
SHA256847bbf1b054739be9b4176d633b3a2a84025cdffd320b1bb1fef3feb2ce12dcb
SHA512222cd0e785149e8e5d937b051677d48d24fea2b176da65545875314acd98dfb59d51e1ce7bd02e292ce462501daed77705f0e11d335170546475df9032c45561
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
822B
MD5b33f5c6e5753e2efe9e7f889b96d0f21
SHA10ec0868ffdc66561d3c4fa75a45aab2d1e2874fd
SHA2568250ee6fdf30b57e9b43ffe635c15150dfbfca2d9dd31c6ddefa6f9f877bd88f
SHA512ea448598168146fecc321d526efda6627c033061546d6d14660e70673e1ef7490e00e98e021bc408f6ac4a54fc4a1554d1b0806a5e4aa9d5fb0f5a847ca6bcb8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD51583a08f7b848f25d94c5fa74ee8c467
SHA14ac950797272e18d95181797b013d2a03676da34
SHA256c884a7f9ce9549e4c6869b7f5a25e56aabfb4af0d9affb2c87ffb5bf3618af41
SHA512b60176cff19a2429e244cea60b166a82204b098f302c3200107299c29baeab33663932e9800a82d3eecd4b7beeb4c93687f113894cab43845f5a82ee53be3d64
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD565fb2d277735f8f0e651eaa8523eb2d9
SHA19f7eab5a6f4992767d556d1c317c8cf2881d50c2
SHA256ca5e2eb1cde91e1ae0261a825354f0f467a3724df0c65e9924746b9a5f1bf41d
SHA51235adc8ee1531921b02e2cc05043a52d12eda415b07ef81083ca6a67ef8f946849ee23f0ad35e50dfa5220a10f2b3758ee4054a1d50395072f5b285697120a90d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD59aede830faef9ae3efdef039b1a89136
SHA1d827c89f763425e3ae43afe6837b978db74409df
SHA256ff5aa6987e44683e98afb6bf4a53984eff564df0cc8be8abb947547c3ad9ff8b
SHA512920acd521dcd5fb2d21de6514ed8a7ea38fe84bc3b8dc0525468cfd328aaf1de99601cd9934a54241fbfc82193b5067bbba1d87e184393e4124e2a1c8eae3f7b
-
\??\pipe\LOCAL\crashpad_3640_QJVZDVDYVHEJKNBNMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e