Resubmissions

11-07-2024 19:21

240711-x2q4fashme 1

11-07-2024 19:08

240711-xtkaxsserd 1

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-07-2024 19:08

General

  • Target

    https://lnkd.in/ey8ryKDm

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://lnkd.in/ey8ryKDm
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:412
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc508a46f8,0x7ffc508a4708,0x7ffc508a4718
      2⤵
        PID:3056
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,9892640472146569392,8947139280579601805,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
        2⤵
          PID:624
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,9892640472146569392,8947139280579601805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3744
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,9892640472146569392,8947139280579601805,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
          2⤵
            PID:3920
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9892640472146569392,8947139280579601805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
            2⤵
              PID:220
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9892640472146569392,8947139280579601805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
              2⤵
                PID:4332
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9892640472146569392,8947139280579601805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
                2⤵
                  PID:2772
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9892640472146569392,8947139280579601805,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
                  2⤵
                    PID:984
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2096,9892640472146569392,8947139280579601805,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=3436 /prefetch:6
                    2⤵
                      PID:1532
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,9892640472146569392,8947139280579601805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
                      2⤵
                        PID:5100
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,9892640472146569392,8947139280579601805,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1820
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9892640472146569392,8947139280579601805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
                        2⤵
                          PID:4756
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9892640472146569392,8947139280579601805,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
                          2⤵
                            PID:3432
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9892640472146569392,8947139280579601805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
                            2⤵
                              PID:2744
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9892640472146569392,8947139280579601805,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
                              2⤵
                                PID:1888
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9892640472146569392,8947139280579601805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
                                2⤵
                                  PID:1064
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,9892640472146569392,8947139280579601805,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
                                  2⤵
                                    PID:4364
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,9892640472146569392,8947139280579601805,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4948 /prefetch:2
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:4896
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:1092
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:5080

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      18fceb24adc103177d70fb5f42a53ebc

                                      SHA1

                                      715757a30e169f33e1df51b01b31da002cacf4c4

                                      SHA256

                                      964316ee529a193638290c744e4a771c2789c2cc7741f7cd9a8ca3538125e41f

                                      SHA512

                                      62f4d42d257209b2e8e5a2ca1cb7679f91d76ce0325e7832f0d446c68a0ecbd6cdaf6bfccb3da1b2740209b970f5ae10cce9ead82bcd47eb4dc6e1c7a5163fb2

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      1773fe4957a1e9c2f453d49f87f5492f

                                      SHA1

                                      2a7a5da6049d116a517f8c6d69cb8ac9850474b8

                                      SHA256

                                      e0e0ce9851eb8dd04ec3ff654376beed233af832fe519e91fc205e5048bb05df

                                      SHA512

                                      5228af30ed154c1a084ab58e4f08a419b836d76c918008bc1f07d58e31cd59a6bbc9818451a943396ff0f6246b3a81656c40e04102477e86b3067365aee463a7

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      216B

                                      MD5

                                      abc52dd27c9567282c0488b0ab430051

                                      SHA1

                                      922e01a98bcecc76c0453aa781f40f9b8fc6cdf7

                                      SHA256

                                      f8923be9e02528e0246f12fc50227709adfe641b3c2eac26ec3448026c84b359

                                      SHA512

                                      74a486f10b2408ee8193557f31a2e4be82b7bcdd29e51360e552e4394654db3a74ea920092f89be20f05406b35369ed5734fd6b74d6474447f65f4421114c2b3

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      641B

                                      MD5

                                      74853545c1c1cfa70a148e6aeb68b7b5

                                      SHA1

                                      7d7c24dbad7b13030e7183f45889686a9a849a3f

                                      SHA256

                                      202340c84c8eab7f852076b4828eabc4ce0527c039dba188bd7c8ac0e3e1620a

                                      SHA512

                                      7e327da902bd8af2d5c5df170a3084edbf8f055ee351c8ae52788abbe564813ceb38b3c30665b979767953bae5c700061e85d5577265c07ae81d98be204b3fe7

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      79e52fd45e7ab6a99639513413d2592e

                                      SHA1

                                      f693a877d92a5a9ec6d2d09a9655dea9f355cd48

                                      SHA256

                                      ce7c06e6d85731e110a1a74445933aa25cb9b5544965eb221b0292afa8666d3b

                                      SHA512

                                      6f3e456b3e981dd4377c1271521609ff16a975135094a7c3e3ab3d159ad8e87017ce26ad3880d1f91eb0195daac0e46207c6c503a1671e3a182898d800ca87c3

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      5KB

                                      MD5

                                      343aa24df4eed3c408f460d0a97bebba

                                      SHA1

                                      543ab8950d6f2af674ad35ca23e9178f1d712670

                                      SHA256

                                      1d33a091d9ffb274c4c0ebdd1c0dfc05d43933261407b08e72d56fb9d8dc7836

                                      SHA512

                                      c77acac8383c055b415e88805cb6c0159749e75e157336768b7723ae604b36939c1d4ccf79e07c1dc5cae48f55aa164440c8bed3174efa503a3a6f284f788847

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      7KB

                                      MD5

                                      eeb8eff53385aa3c28207ef7c5af9b08

                                      SHA1

                                      2cfdf8eb67f026e001dfb6b7851c185de6d7e86f

                                      SHA256

                                      a97591d3213489ee648adb43d1e86fa1ece770a51e3af0d0890c53fd52547fc4

                                      SHA512

                                      4eb6199bb322ad8837a5687cf980f943f9fb4f0162fc790fac6199b198feb035ab8e83b3c3947fa8d1534832b98843787f1eb6d3683bbb2229eb731a34510a3d

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                      Filesize

                                      24KB

                                      MD5

                                      75cf1868de866d4f4b19b02d22178e5b

                                      SHA1

                                      06eb2d6682078869f44c026a470bd7fd951500c3

                                      SHA256

                                      9c57764d45b2d191f6a73cb819ab5bb996c55d3f9a84ae5a63f9f58de66e1a0a

                                      SHA512

                                      450ed1d7012c87ed8ee06c317f35c823f6872e0af1cef238763384259d64f30d8ad532ca70394707678b1f5f5eabff0b5b1a9511e79c54d7ee9450d61e936305

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      704B

                                      MD5

                                      61afee4e2befc93909891b24712029f6

                                      SHA1

                                      22a0ef0a9ba1d0a4a583cf07047163ae47317e39

                                      SHA256

                                      d45f35d7c35500dbfacdb6bc957729cfbefa284958bb9868a830865bfad3351a

                                      SHA512

                                      d36bd3a07b963ed198f3c15c5f47d11073bc0ca6400f25857aef32f739a70ef8d1638821400d9848cd271361df1e4d9aa4f97e6a008314764415ef38f691a89c

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588066.TMP

                                      Filesize

                                      203B

                                      MD5

                                      36b204aebc0e29c5a30aa09cd70e42ad

                                      SHA1

                                      c6838dd67d21eec3dcf543f80b01f69dbd85a333

                                      SHA256

                                      b62072d5477e359842f1c6f5d22c48b72a510dbb6d7bd139d498617168e00f06

                                      SHA512

                                      32a99f821952f37808e037d27f237a4f886f883f20511eac3b62535fde7380e6de42b35954e73b50d574a6aeed2682f4bf433ecfd56513fd6f88bee957e08f80

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      6752a1d65b201c13b62ea44016eb221f

                                      SHA1

                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                      SHA256

                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                      SHA512

                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      10KB

                                      MD5

                                      e3c2f3918a77f05c2d665ba4c00d99b5

                                      SHA1

                                      3b8dbb9028e6c85165f99133a96bc97f61234ca3

                                      SHA256

                                      7eb5a6bd89546d6496f2777bcc683761d2bebd92d949ddec994f93381a52451c

                                      SHA512

                                      568997a0118cda0a49b668fec951ea147331581e976f42410f54228da84b9dfdd701061c634bf2906ddcd1744288ec0b89f226562cbe002f74cfb93297ee121e

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

                                      Filesize

                                      2B

                                      MD5

                                      f3b25701fe362ec84616a93a45ce9998

                                      SHA1

                                      d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                      SHA256

                                      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                      SHA512

                                      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84