hxxps://sc[.]link/hBv6i

Analysis

max time kernel
43s
max time network
43s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
31-05-2024 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://sc.link/hBv6i

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid process

4980 msedge.exe
4980 msedge.exe
2672 msedge.exe
2672 msedge.exe
2204 identity_helper.exe
2204 identity_helper.exe
4680 msedge.exe
4680 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

2672 msedge.exe
2672 msedge.exe
2672 msedge.exe
2672 msedge.exe
2672 msedge.exe
2672 msedge.exe
2672 msedge.exe

pid	process
4980	msedge.exe
4980	msedge.exe
2672	msedge.exe
2672	msedge.exe
2204	identity_helper.exe
2204	identity_helper.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

msedge.exe

pid	process
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2672 wrote to memory of 456	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 456	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 2160	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 4980	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 4980	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 1144	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 1144	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 1144	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 1144	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 1144	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 1144	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 1144	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 1144	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 1144	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 1144	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 1144	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 1144	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 1144	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 1144	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 1144	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 1144	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 1144	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 1144	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 1144	2672	msedge.exe	msedge.exe
PID 2672 wrote to memory of 1144	2672	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sc.link/hBv6i
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9a35f3cb8,0x7ff9a35f3cc8,0x7ff9a35f3cd8
2⤵
PID:456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,14269478248705491385,1418333982751292752,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
2⤵
PID:2160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,14269478248705491385,1418333982751292752,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,14269478248705491385,1418333982751292752,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2520 /prefetch:8
2⤵
PID:1144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,14269478248705491385,1418333982751292752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
2⤵
PID:2120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,14269478248705491385,1418333982751292752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
2⤵
PID:2104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,14269478248705491385,1418333982751292752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
2⤵
PID:756

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,14269478248705491385,1418333982751292752,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,14269478248705491385,1418333982751292752,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,14269478248705491385,1418333982751292752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
2⤵
PID:4840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,14269478248705491385,1418333982751292752,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
2⤵
PID:4516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,14269478248705491385,1418333982751292752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
2⤵
PID:3352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,14269478248705491385,1418333982751292752,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
2⤵
PID:1708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
d56e8f308a28ac4183257a7950ab5c89

SHA1
044969c58cef041a073c2d132fa66ccc1ee553fe

SHA256
0bc24451c65457abc1e4e340be2f8faceae6b6ec7768a21d44bcd14636543bae

SHA512
fd5798559f4025ec3408f5550b8671d394b1ec83b85fdac8c005b0cc3e183272bdd07db15a156a572c9c5e5798badf235dc10aae62a052efa8dd9dfdbdca8189

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
8f2eb94e31cadfb6eb07e6bbe61ef7ae

SHA1
3f42b0d5a90408689e7f7941f8db72a67d5a2eab

SHA256
d222c8e3b19cda2657629a486faf32962e016fc66561ce0d17010afdb283c9de

SHA512
9f7f84149885b851e0bf7173c540e466a2b2eb9907d8b608f60360933328cc75d9d1b63640ea4ecc1e64ecc5dd7ee74d82903f96a8b4418ca56296641a8c0703

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
552B

MD5
cf791d9ed8ddecfe66fc4b16aaea06d5

SHA1
b8baeb57252edeb24e23bf57899511082ba5f862

SHA256
d826f84abf42915c5f5a9c4fcc4056f52c5067168db2972989bd6148578668fd

SHA512
c9ffe6a4cd1761e76d98aa69cb41a91b5999891dd3bbb47c9c22ebcbbc17c9784cbe02d4f1eebe499305df8e6a6b84042dc8c784a17c66ddad050510ccbb2a7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
de3da6465ef346a2df5b586b545c08c8

SHA1
3ed00c76effbf8836b65054ef588946e2c6338db

SHA256
49999c2a1098f4a6741ba8542c6c514732809ee9b0fc1d85587080485537619d

SHA512
51d083d5e655c1d30fa250d25104b7ee1e0356b3d57b74cc1ca3e16cc10bbf4f4fb81c1476b16f699803748820fdbac64e9ea2d7922b6779a2c1d195332717c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
dc355faaf2c528f0582c2068a0727a84

SHA1
6e4d921fff0aac158f47208443fa6700c5631fb4

SHA256
0b620062f455e21a50c170056afe08e5bab4ddc4e5d504b19abd827745efb992

SHA512
c0a50ef7cf524052b3458ecee604b21c40ab6cd887bdefbafd726fb9e20ff6b6366119e71e8222f0ff8d5ca3f9f47ed6b853f92bd4fce6a4cb762ede9b354874

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
157675167bc58e621aabe94754bd3981

SHA1
732aeec9b7cd2547e419681d5072db71e3ab02c4

SHA256
63d18be0e0bd0244ba54c50944866f802d75932dd14d5668dc216fc6efc2f9b5

SHA512
743adc38fbc974e09cc70bf01960a2195349ca94f59f5de686dcf8c7dd6d1780621d08b1767429956e738564e72a5aaea94d50d99bbc54c6421bd3f8e8f79c88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
4e9c604626c7245ac5f37e06d8e0a3dd

SHA1
e1e125d85d758ad077964a6682e87079dea90c78

SHA256
86be89ca913c385e14347eda711a035eab9aad511f2a65a67f83c21fe031106b

SHA512
4f1c5655c3a5353491359a0ebe2e3fcb45441d928cae6230a6a13d88058c36c1790a78ef3bbdb232c428c82adb42338af57cce5b401028390d59de666c8210b0

Download Submit
\??\pipe\LOCAL\crashpad_2672_QMIUPKGBBKRMBIRG
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit