hxxps://gofile[.]io/d/wKpnL6

Analysis

max time kernel
1749s
max time network
1684s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 15:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/wKpnL6

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2764	msedge.exe
2764	msedge.exe
1720	msedge.exe
1720	msedge.exe
4376	identity_helper.exe
4376	identity_helper.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2752	1720	msedge.exe	80
PID 1720 wrote to memory of 2752	1720	msedge.exe	80
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 564	1720	msedge.exe	81
PID 1720 wrote to memory of 2764	1720	msedge.exe	82
PID 1720 wrote to memory of 2764	1720	msedge.exe	82
PID 1720 wrote to memory of 4104	1720	msedge.exe	83
PID 1720 wrote to memory of 4104	1720	msedge.exe	83
PID 1720 wrote to memory of 4104	1720	msedge.exe	83
PID 1720 wrote to memory of 4104	1720	msedge.exe	83
PID 1720 wrote to memory of 4104	1720	msedge.exe	83
PID 1720 wrote to memory of 4104	1720	msedge.exe	83
PID 1720 wrote to memory of 4104	1720	msedge.exe	83
PID 1720 wrote to memory of 4104	1720	msedge.exe	83
PID 1720 wrote to memory of 4104	1720	msedge.exe	83
PID 1720 wrote to memory of 4104	1720	msedge.exe	83
PID 1720 wrote to memory of 4104	1720	msedge.exe	83
PID 1720 wrote to memory of 4104	1720	msedge.exe	83
PID 1720 wrote to memory of 4104	1720	msedge.exe	83
PID 1720 wrote to memory of 4104	1720	msedge.exe	83
PID 1720 wrote to memory of 4104	1720	msedge.exe	83
PID 1720 wrote to memory of 4104	1720	msedge.exe	83
PID 1720 wrote to memory of 4104	1720	msedge.exe	83
PID 1720 wrote to memory of 4104	1720	msedge.exe	83
PID 1720 wrote to memory of 4104	1720	msedge.exe	83
PID 1720 wrote to memory of 4104	1720	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/wKpnL6
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80afd46f8,0x7ff80afd4708,0x7ff80afd4718
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,11284497838826267199,15918032652273483428,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,11284497838826267199,15918032652273483428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,11284497838826267199,15918032652273483428,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11284497838826267199,15918032652273483428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11284497838826267199,15918032652273483428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11284497838826267199,15918032652273483428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,11284497838826267199,15918032652273483428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3468 /prefetch:8
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,11284497838826267199,15918032652273483428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11284497838826267199,15918032652273483428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11284497838826267199,15918032652273483428,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11284497838826267199,15918032652273483428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,11284497838826267199,15918032652273483428,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,11284497838826267199,15918032652273483428,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2452 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
737ca6b32ced062e8531135937061dea

SHA1
f383d3f3e94b592c8c82e56d9bce0109111129b3

SHA256
277f5bd11bd733513f359a678d5f6185b2a46f451f7931457d9d784b2209a963

SHA512
130fa198b903016b47e3c378cd2929201898b09c9ff4266a64ea9ad58aedee2f4c656a85d3a86dc9b24eca1afc99f8ed8d2a9e12254263674d202c12dc3564d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
317B

MD5
afc6cddd7e64d81e52b729d09f227107

SHA1
ad0d3740f4b66de83db8862911c07dc91928d2f6

SHA256
b5e81a7c7d80feaaa10ee7bc8aaef9f21a5c1e4b03b3823ed115022311d674a0

SHA512
844edb69585153c378a7c97709983776fc9303a32fb5ef8122ecca32adfc0b265f5ef7118ee07814da5c020ac7ba1bf2a2f66d46312e4d8e6df99aab2e5f9b2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
05adecbf93326b17e4ae05add7f242cb

SHA1
5c6e71707ce205bb703ea6aadd2a4a085b0db99c

SHA256
d83a3c940b95b279a9bcc7d3fcba7d9181e7b5d8a3cc0cf897f4b82bcfbf3fc8

SHA512
d976c3d235a4d906636c723a54a626cc125240b2edc09456c9484c704bee16351b873b9dfb61f6c0bbb52041d4c92c3c4d1d3219808fcb772c60ad40116a8963

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bc64d735516359812dbd717353090cec

SHA1
c4d4bc62ea53ba397266e5610811e6dda60866db

SHA256
8097f3a2b2a9fff87b9850e202ea810aac19f7eb2d4d15762d16266ca69c481d

SHA512
4f5d8c831d4d5e612e4c52210563263e3e534b5d42149640c5c6bf69874ccdde447f7fab2e43244a3c936b9a17687c449bc8944258df4e4f89f85f87746cd077

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
13eeffc5e1f37a4b00aac19ff6bd1fe4

SHA1
067af763ce7ea3683ad355c7941ec6967a0019c7

SHA256
7973da088c80e4d781dd10f4f4a1117c7792ff66a6904fc7c7323e2e96f9b176

SHA512
9e0f2312192bd404cadb8650b51d51b6dcc59ea03f5cf91d1d390179915144129110843a703d1c08f907a92b25a184228f004d74c263e8bb1de31e3fa145cbf1

Download Submit