hxxps://raw[.]githubusercontent[.]com/onx/ILOVEYOU/master/LOVE-LETTER-FOR-YOU[.]TXT[.]vbs

Analysis

max time kernel
33s
max time network
12s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
05-07-2024 12:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://raw.githubusercontent.com/onx/ILOVEYOU/master/LOVE-LETTER-FOR-YOU.TXT.vbs

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
3	raw.githubusercontent.com
4	raw.githubusercontent.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1952	msedge.exe
1952	msedge.exe
848	msedge.exe
848	msedge.exe
2228	msedge.exe
2228	msedge.exe
1012	identity_helper.exe
1012	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe
848	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 1332	848	msedge.exe	79
PID 848 wrote to memory of 1332	848	msedge.exe	79
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 752	848	msedge.exe	81
PID 848 wrote to memory of 1952	848	msedge.exe	82
PID 848 wrote to memory of 1952	848	msedge.exe	82
PID 848 wrote to memory of 2700	848	msedge.exe	83
PID 848 wrote to memory of 2700	848	msedge.exe	83
PID 848 wrote to memory of 2700	848	msedge.exe	83
PID 848 wrote to memory of 2700	848	msedge.exe	83
PID 848 wrote to memory of 2700	848	msedge.exe	83
PID 848 wrote to memory of 2700	848	msedge.exe	83
PID 848 wrote to memory of 2700	848	msedge.exe	83
PID 848 wrote to memory of 2700	848	msedge.exe	83
PID 848 wrote to memory of 2700	848	msedge.exe	83
PID 848 wrote to memory of 2700	848	msedge.exe	83
PID 848 wrote to memory of 2700	848	msedge.exe	83
PID 848 wrote to memory of 2700	848	msedge.exe	83
PID 848 wrote to memory of 2700	848	msedge.exe	83
PID 848 wrote to memory of 2700	848	msedge.exe	83
PID 848 wrote to memory of 2700	848	msedge.exe	83
PID 848 wrote to memory of 2700	848	msedge.exe	83
PID 848 wrote to memory of 2700	848	msedge.exe	83
PID 848 wrote to memory of 2700	848	msedge.exe	83
PID 848 wrote to memory of 2700	848	msedge.exe	83
PID 848 wrote to memory of 2700	848	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://raw.githubusercontent.com/onx/ILOVEYOU/master/LOVE-LETTER-FOR-YOU.TXT.vbs
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffe8313cb8,0x7fffe8313cc8,0x7fffe8313cd8
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,9281020645382103927,17962038318175209390,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,9281020645382103927,17962038318175209390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,9281020645382103927,17962038318175209390,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9281020645382103927,17962038318175209390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9281020645382103927,17962038318175209390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,9281020645382103927,17962038318175209390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,9281020645382103927,17962038318175209390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9281020645382103927,17962038318175209390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9281020645382103927,17962038318175209390,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9281020645382103927,17962038318175209390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,9281020645382103927,17962038318175209390,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1904,9281020645382103927,17962038318175209390,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:2844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:32

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b1f20c797906f82fd003270485ceaef

SHA1
51ee0859382d77aba329e0ec2dad81b383c534ed

SHA256
7980e988f80ffc29a79b2d13c0d4160ad1d1f77fb6ddd95b7ec263b7421a0c91

SHA512
7b8f859ffa55759a1e90540754bc80a4218ddf2ee953736865ba4c5c9aa33556bd8ac45da1dce7426c75c5d754268c450054f875927cbba800ad665f09941cde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
11b22949a84a750056bef0aa6ea4fc45

SHA1
c3d49da0344a2bb3cebbce6569b1fd223aa2ebd8

SHA256
59db861ff42f39a5f777bd9b8a167b7b15c96e60ed148ea875a9f1f0d4caaa6f

SHA512
01bbc38a4b8fb8a53c3897d63d3362c8a980fcb395986671cfd13e0fa893a68ab3e45379127da69565e0b1e4125a41834c62b06b8d9b852c6b71a1ec68a930b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d21a94db1ce8aa6b7aa6432c3129fee7

SHA1
90b64c9ee0bcc305ec1667e8da7ead11427aa0ec

SHA256
f61e72ab5bdb21432f7bc51bb325824d71560941e989a027955283802f8bc420

SHA512
39598618747990ced79ad64afa8711f5b0c6f5ce17f3852f9f9c933918907a175b1261fd9580ed09a2d7d626f972a793408b8679c389b178655fbec144ea047d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d370d4694ab13e1b695cc614bb40e1cd

SHA1
c3147d3bcb41014589e72e710f36d1aaa1c584bf

SHA256
73c6010735ff61fc0216cfde65f08f285183c2811aebeccd2b2e3dd67192428b

SHA512
b35f4282e79e9e5f64d755c6165ab11bb3f39e3dc14b66f8844aaea3ed48f0e006fb20725be3e70af95d8426edba83a3d5b8cb30126613ed239ae1b4e98b49b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f5732c3e-0b2d-4542-a746-bc413c6444c6.tmp

Filesize
5KB

MD5
d13a79be122fc9991fad8395cadbd976

SHA1
c1a30ec0ec148e47b180c9625fb47a4f4472f84a

SHA256
7973141b15e5a3e1611604040dae0132f59b36449b0b3131d6d6c4bf5add5f73

SHA512
7d015fd99c44e618ba24b50ddc388c1fb887af9600519b25910e8cc30c34a205ca28dea5e32c78e22379f66404bd47d29ab19a156d14ffe0b2156a67bac39b9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a16196089b3d0398062318e8d382011c

SHA1
9f6d0668755bcdaacd06490c1e19cde243d84c2b

SHA256
60e7c0a566699c7e2314bfd240d73d462bd695717a06690cfc29b544b913b2b1

SHA512
2b9204c6f2437a6f971874ccefd58ab75d4a65f50a7c14767a25ddc1ca06663f7294ca2eac39db97b366696afe4ce0b5114d19188e70686629fd7ba0f149b33c

Download Submit