f70e91127d5ac56e246fc6c972ddf58e324c2d9d6f2a9973c3f018c6179adcec

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 10:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

155ɫվ.lnk
Size

350B
MD5

2eefc9c46f6597c7b8e425f8c2130e64
SHA1

4dbcb7c15a8624c9054debd1261963a35ccf8d74
SHA256

7756423e3de11499438968c53aeb575285995045b33832d601612512dc9e2424
SHA512

2226a924ccebfa75d3e6927d64c58917e27b57ae2af3fc658126902f511c3ea3c4f362306a7eeb6073445d3de48b125453756121d1ed3e694b5e44a5fdc23efc

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1124	msedge.exe
1124	msedge.exe
2708	msedge.exe
2708	msedge.exe
4884	identity_helper.exe
4884	identity_helper.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe
456	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 2708	4688	cmd.exe	86
PID 4688 wrote to memory of 2708	4688	cmd.exe	86
PID 2708 wrote to memory of 2920	2708	msedge.exe	88
PID 2708 wrote to memory of 2920	2708	msedge.exe	88
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 2068	2708	msedge.exe	89
PID 2708 wrote to memory of 1124	2708	msedge.exe	90
PID 2708 wrote to memory of 1124	2708	msedge.exe	90
PID 2708 wrote to memory of 1928	2708	msedge.exe	91
PID 2708 wrote to memory of 1928	2708	msedge.exe	91
PID 2708 wrote to memory of 1928	2708	msedge.exe	91
PID 2708 wrote to memory of 1928	2708	msedge.exe	91
PID 2708 wrote to memory of 1928	2708	msedge.exe	91
PID 2708 wrote to memory of 1928	2708	msedge.exe	91
PID 2708 wrote to memory of 1928	2708	msedge.exe	91
PID 2708 wrote to memory of 1928	2708	msedge.exe	91
PID 2708 wrote to memory of 1928	2708	msedge.exe	91
PID 2708 wrote to memory of 1928	2708	msedge.exe	91
PID 2708 wrote to memory of 1928	2708	msedge.exe	91
PID 2708 wrote to memory of 1928	2708	msedge.exe	91
PID 2708 wrote to memory of 1928	2708	msedge.exe	91
PID 2708 wrote to memory of 1928	2708	msedge.exe	91
PID 2708 wrote to memory of 1928	2708	msedge.exe	91
PID 2708 wrote to memory of 1928	2708	msedge.exe	91
PID 2708 wrote to memory of 1928	2708	msedge.exe	91
PID 2708 wrote to memory of 1928	2708	msedge.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\155ɫվ.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.soft155.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xd4,0x128,0x7ffafc8146f8,0x7ffafc814708,0x7ffafc814718
    3⤵
    PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,12012329236373642805,3236766608661834716,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
    3⤵
    PID:2068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,12012329236373642805,3236766608661834716,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,12012329236373642805,3236766608661834716,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2468 /prefetch:8
    3⤵
    PID:1928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12012329236373642805,3236766608661834716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
    3⤵
    PID:1080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12012329236373642805,3236766608661834716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:3424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12012329236373642805,3236766608661834716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,12012329236373642805,3236766608661834716,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
    3⤵
    PID:1248
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,12012329236373642805,3236766608661834716,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12012329236373642805,3236766608661834716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
    3⤵
    PID:1264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12012329236373642805,3236766608661834716,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
    3⤵
    PID:1568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12012329236373642805,3236766608661834716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
    3⤵
    PID:3616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12012329236373642805,3236766608661834716,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
    3⤵
    PID:4168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,12012329236373642805,3236766608661834716,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2712 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bafce9e4c53a0cb85310891b6b21791b

SHA1
5d70027cc137a7cbb38f5801b15fd97b05e89ee2

SHA256
71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

SHA512
c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a499254d6b5d91f97eb7a86e5f8ca573

SHA1
03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

SHA256
fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

SHA512
d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
06c4a0d838528526968b1c5540e572d8

SHA1
9813419a443904e2eca7dae8f1aa64850d78490a

SHA256
9d791c0d053d6dae93359fb2234a47b7d775cc6fb92d9c0959f7fd2b2c048e30

SHA512
bb81efa0aa4b059823cc7623025551c8b432e49adbbf13ab4195559a2fd0604213ec0597440934f93edd62af356712a6a84b6fd1919be0a874d703b32ee7fca2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
250B

MD5
b2e0750ceb4d0b6276de759f1c8d6c07

SHA1
f9c7eac47a6870c8b13ef493731c27fa6cc43a0e

SHA256
f0700da49f577aa4928fe0b7d3f7e4d82809ecd75af282889c44286835d24b1e

SHA512
360113c41b4425e9ffd31b822eac2fd02c577cc99afff545241d28beb4c0e4c07235b8a19b822a2994acf531116f5aa6b782f5dff8c2dbf9632382112db1de23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a01d4278ace7a9b2d3fe9f3d18e7d619

SHA1
e275dac73c499350754626b547947aced1a36e38

SHA256
f2df72c2636187b33df0dde64f71591e88379d3e9c26b7e93f6fd27fbfc0e596

SHA512
20c8919b279fde2065140ca95168142d74f8c70ec5301c8cca46b7b34bb908144f7ef34c5f7b3c53b0f92ab89b42442e9c91518f9b5fe0d22f4a7e35b2c44f47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
546bf177117047e176aab9fcfdeb166b

SHA1
b2cc59336ced1dfbe99e12782ff255359621e6fc

SHA256
b692d55773b27865aac1e1fb481fb8ff5b081fd958e9009413f5cdb75b651080

SHA512
7f616e5f3a8a3766b4804ad35247bd20be0c7bf1c7b5fd4eb1a6dc344cfd974de8863afbb44151aa7db24a2771616dbeda72711830931ebab0fc291a71a448aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dc1faf71c5ce30d86382721330e113bc

SHA1
0c09c14bb300158ff19ee2b1fd85c88307418a66

SHA256
5db25906bbc468f1b93e84dc1965aa8e683f203adbdabee1936edb935494b8c9

SHA512
aa82d8dc91be801efb936a6f8706a4f5ae420d45c56a5695234ae89caa853f8a9721d2b67ec56a9dd8edd0ae92378c6b11d1f751be4522cb8337b061b60d45d0

Download Submit