e3697831bcd29abfaf0a2b7d74b5b42d0ebaef5625f45b617170bfeeade8af70

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

155ɫվ.lnk
Size

350B
MD5

2eefc9c46f6597c7b8e425f8c2130e64
SHA1

4dbcb7c15a8624c9054debd1261963a35ccf8d74
SHA256

7756423e3de11499438968c53aeb575285995045b33832d601612512dc9e2424
SHA512

2226a924ccebfa75d3e6927d64c58917e27b57ae2af3fc658126902f511c3ea3c4f362306a7eeb6073445d3de48b125453756121d1ed3e694b5e44a5fdc23efc

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1996	msedge.exe
1996	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
4496	identity_helper.exe
4496	identity_helper.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 1100	1572	cmd.exe	85
PID 1572 wrote to memory of 1100	1572	cmd.exe	85
PID 1100 wrote to memory of 452	1100	msedge.exe	87
PID 1100 wrote to memory of 452	1100	msedge.exe	87
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1772	1100	msedge.exe	88
PID 1100 wrote to memory of 1996	1100	msedge.exe	89
PID 1100 wrote to memory of 1996	1100	msedge.exe	89
PID 1100 wrote to memory of 228	1100	msedge.exe	90
PID 1100 wrote to memory of 228	1100	msedge.exe	90
PID 1100 wrote to memory of 228	1100	msedge.exe	90
PID 1100 wrote to memory of 228	1100	msedge.exe	90
PID 1100 wrote to memory of 228	1100	msedge.exe	90
PID 1100 wrote to memory of 228	1100	msedge.exe	90
PID 1100 wrote to memory of 228	1100	msedge.exe	90
PID 1100 wrote to memory of 228	1100	msedge.exe	90
PID 1100 wrote to memory of 228	1100	msedge.exe	90
PID 1100 wrote to memory of 228	1100	msedge.exe	90
PID 1100 wrote to memory of 228	1100	msedge.exe	90
PID 1100 wrote to memory of 228	1100	msedge.exe	90
PID 1100 wrote to memory of 228	1100	msedge.exe	90
PID 1100 wrote to memory of 228	1100	msedge.exe	90
PID 1100 wrote to memory of 228	1100	msedge.exe	90
PID 1100 wrote to memory of 228	1100	msedge.exe	90
PID 1100 wrote to memory of 228	1100	msedge.exe	90
PID 1100 wrote to memory of 228	1100	msedge.exe	90

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\155ɫվ.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.soft155.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9345a46f8,0x7ff9345a4708,0x7ff9345a4718
    3⤵
    PID:452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,5801323981975960860,11286634837776741235,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
    3⤵
    PID:1772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,5801323981975960860,11286634837776741235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,5801323981975960860,11286634837776741235,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
    3⤵
    PID:228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5801323981975960860,11286634837776741235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
    3⤵
    PID:1596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5801323981975960860,11286634837776741235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:2560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5801323981975960860,11286634837776741235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2060 /prefetch:1
    3⤵
    PID:2292
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,5801323981975960860,11286634837776741235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
    3⤵
    PID:4928
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,5801323981975960860,11286634837776741235,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5801323981975960860,11286634837776741235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
    3⤵
    PID:4192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5801323981975960860,11286634837776741235,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
    3⤵
    PID:4960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5801323981975960860,11286634837776741235,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
    3⤵
    PID:4028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5801323981975960860,11286634837776741235,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
    3⤵
    PID:2156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,5801323981975960860,11286634837776741235,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4828 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c00b0d6e0f836dfa596c6df9d3b2f8f2

SHA1
69ad27d9b4502630728f98917f67307e9dd12a30

SHA256
578481cd359c669455e24983b13723c25584f58925b47283cb580019ef3142b1

SHA512
0e098ab5f5772fec17880e228a0dccbbaa06dc1af14e0fd827f361599c61899fe07d612a7f7b049ff6661d27fdc495566dd20fc28ceed022b87c212bf00be5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
54f1b76300ce15e44e5cc1a3947f5ca9

SHA1
c978bfaa6ec6dae05464c6426eaa6cb3c3e2f3b7

SHA256
43dec5d87b7ee892a3d99cb61f772ba403882ac0772423f36034e84244c1ca24

SHA512
ac26e5676c675be329eb62b5d5a36a0e6014ab8a6366684b0fc2a59ae5f061f596f462b82eb4e9f135d2235a0cbd4af96680d234eecc873a8397fd81507d277a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5fd6f366-a5db-4d05-aa6a-47920eec05c2.tmp

Filesize
6KB

MD5
fba02369044f15bdc1a948d5d82dfbac

SHA1
cfde2a709f2cf78b29eabb5aefba60d364c3b948

SHA256
5dc5bb046650d8e86323e79ec73036467416964f7e0077f6a9e645d6de9a4d7d

SHA512
c18eac8fa3819f3321607726be297f2b4a0d48d101261c0638c8eba7ab0df6b2eecd58c7781591a0623b3a50873bdba7e555f604522616df57d4d0a779a0dd7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
5dcbe5458c0a84a475d452d688a2a2fd

SHA1
f83f81e06033ebec2c108f9578bd1c9c060fbbfc

SHA256
d92517d5a7d0abd0fd50fb85424d46fb1f9f89cc6807b67154928f9f72bb4e1f

SHA512
06ac2a4335e459f397c57ab2cd96d418699a1127c274b3792ad96d886bd3652aefc33845d3037d2e3853a331623e9842bfb020ed393c70020924f801b2f369e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
250B

MD5
b2e0750ceb4d0b6276de759f1c8d6c07

SHA1
f9c7eac47a6870c8b13ef493731c27fa6cc43a0e

SHA256
f0700da49f577aa4928fe0b7d3f7e4d82809ecd75af282889c44286835d24b1e

SHA512
360113c41b4425e9ffd31b822eac2fd02c577cc99afff545241d28beb4c0e4c07235b8a19b822a2994acf531116f5aa6b782f5dff8c2dbf9632382112db1de23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2a9dda1fb78d26dbb9dbc52eccf225b2

SHA1
6a151db1a9594ee4bd14290290100fba1a1ecbe0

SHA256
5f97eeda55d977b2503a930839de580cb137f1887391b924b4ff636be563f9ff

SHA512
6e7b056a2d6a849fe264a2e602250ef71fd1074485dcb998802b7f3b8f883e31ffcd9ba915fab4720ac1d68ea56b50b2171a175da42ef65d969c1205c0773d94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0fe51b0b47c3de2d7ccff0624d6a613f

SHA1
7b14d8af8e7b3b4e6a720f7e1147963a925d4a52

SHA256
3c795611d114978e642da75aecdb0042eaf2903cd8985b2463d95b1680cb1239

SHA512
bc5a23532794c1f34430193da6773b6247305a4370bb7f7f9099724427d011276fbecfa8a5489320c1e50c69508c8996b0702c0ce456d2b9682651b364b812f3

Download Submit