hxxps://t[.]co/tlOmVHnFNU

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://t.co/tlOmVHnFNU

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
828	msedge.exe
828	msedge.exe
4268	msedge.exe
4268	msedge.exe
2072	identity_helper.exe
2072	identity_helper.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 3644	4268	msedge.exe	84
PID 4268 wrote to memory of 3644	4268	msedge.exe	84
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 3860	4268	msedge.exe	85
PID 4268 wrote to memory of 828	4268	msedge.exe	86
PID 4268 wrote to memory of 828	4268	msedge.exe	86
PID 4268 wrote to memory of 3092	4268	msedge.exe	87
PID 4268 wrote to memory of 3092	4268	msedge.exe	87
PID 4268 wrote to memory of 3092	4268	msedge.exe	87
PID 4268 wrote to memory of 3092	4268	msedge.exe	87
PID 4268 wrote to memory of 3092	4268	msedge.exe	87
PID 4268 wrote to memory of 3092	4268	msedge.exe	87
PID 4268 wrote to memory of 3092	4268	msedge.exe	87
PID 4268 wrote to memory of 3092	4268	msedge.exe	87
PID 4268 wrote to memory of 3092	4268	msedge.exe	87
PID 4268 wrote to memory of 3092	4268	msedge.exe	87
PID 4268 wrote to memory of 3092	4268	msedge.exe	87
PID 4268 wrote to memory of 3092	4268	msedge.exe	87
PID 4268 wrote to memory of 3092	4268	msedge.exe	87
PID 4268 wrote to memory of 3092	4268	msedge.exe	87
PID 4268 wrote to memory of 3092	4268	msedge.exe	87
PID 4268 wrote to memory of 3092	4268	msedge.exe	87
PID 4268 wrote to memory of 3092	4268	msedge.exe	87
PID 4268 wrote to memory of 3092	4268	msedge.exe	87
PID 4268 wrote to memory of 3092	4268	msedge.exe	87
PID 4268 wrote to memory of 3092	4268	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.co/tlOmVHnFNU
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6b7d46f8,0x7ffd6b7d4708,0x7ffd6b7d4718
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,13039682695240446873,7992817877965995596,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,13039682695240446873,7992817877965995596,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,13039682695240446873,7992817877965995596,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13039682695240446873,7992817877965995596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13039682695240446873,7992817877965995596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13039682695240446873,7992817877965995596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,13039682695240446873,7992817877965995596,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,13039682695240446873,7992817877965995596,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13039682695240446873,7992817877965995596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13039682695240446873,7992817877965995596,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13039682695240446873,7992817877965995596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,13039682695240446873,7992817877965995596,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,13039682695240446873,7992817877965995596,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
2b6677e646d6ad3aba0e3e34a47f5164

SHA1
341b1cb2b39d8a54c3c281da93fda98fe36d7db4

SHA256
bd2d81c380dc9d3949ac2f3f3a1558edc3cfa06220a53505ff52128c58f51467

SHA512
99e11dadfb0cfb83cb337b7668934add795726fde40db8b9cf9f7eba0a75751cd965ec7cd46e65daa6cb8e0fe3b2c7e44772a6c8c443756bd8f59ad0497f3ef3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
601B

MD5
dafb9b4fc7b7ffb2339bb6b2c95a9eb3

SHA1
568757373d255225a736a320a148cc360b491500

SHA256
854205697197236e8dfb2582e9439219b4ad1fc277f6c587c840fb1b4fca8f21

SHA512
aa6696eb1e85e0e4f87372302d4aa76d7884ce4ec84b182caea7e9eec2924b266d5c60c07cc94d5c6a26dc0922cd7bacc1a98d78c1f3bc66211be28c9a06ca79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f104cdd7220c0a5da9e2829297b442a9

SHA1
47e02cf4c0607e60f51e97ace0aa7289495a9d5d

SHA256
77bff52a895f34639a450b9f91595f195cea3fa316101ee335b865b57b96b034

SHA512
6665344523b93cdaead1b329fd8e2eb9281fcf36ae39097b6f104aeb17273a5e07ea99abdab028265ac4cd33004f492df5cbd5eab3ac7eedccf7a5d4cf68d814

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
524e50422a99c7b7048f08b2aee9dfd8

SHA1
6cb618c3ceaaa72850ae2d97ed229c4f7c76aa13

SHA256
05561bf4351d866cd4ee336106acf23a199ac29bdce70c17e69d06312f6657f7

SHA512
121d4cad6aae6f086e6f10b2c01245b9816caab1b44861cd060ef86673732f5d25dfde417445ccd21574a6995e101aff4e95847f1ed1b63f1ecc9ebe4aed6fcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
88c56132906bb881add5948016100209

SHA1
7865497f88dc2690a40226634203dbc4cbbd29f3

SHA256
af995610ab38ab8601094362e096e163d2fc67817bbfe05e1f3fb391bda52d38

SHA512
4ae5e277d7113140b8189d7662e666fff7e0e057dfa0aa5fc3f98852b353a742a0fe9d459f4c02f14771a697743bf5679430eac1e9e1fb6bd072b916fb03b674

Download Submit