hxxps://t[.]ly/zEbHV

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2024, 20:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://t.ly/zEbHV

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1476	msedge.exe
1476	msedge.exe
3156	msedge.exe
3156	msedge.exe
3724	identity_helper.exe
3724	identity_helper.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 4396	3156	msedge.exe	84
PID 3156 wrote to memory of 4396	3156	msedge.exe	84
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 2388	3156	msedge.exe	85
PID 3156 wrote to memory of 1476	3156	msedge.exe	86
PID 3156 wrote to memory of 1476	3156	msedge.exe	86
PID 3156 wrote to memory of 2404	3156	msedge.exe	87
PID 3156 wrote to memory of 2404	3156	msedge.exe	87
PID 3156 wrote to memory of 2404	3156	msedge.exe	87
PID 3156 wrote to memory of 2404	3156	msedge.exe	87
PID 3156 wrote to memory of 2404	3156	msedge.exe	87
PID 3156 wrote to memory of 2404	3156	msedge.exe	87
PID 3156 wrote to memory of 2404	3156	msedge.exe	87
PID 3156 wrote to memory of 2404	3156	msedge.exe	87
PID 3156 wrote to memory of 2404	3156	msedge.exe	87
PID 3156 wrote to memory of 2404	3156	msedge.exe	87
PID 3156 wrote to memory of 2404	3156	msedge.exe	87
PID 3156 wrote to memory of 2404	3156	msedge.exe	87
PID 3156 wrote to memory of 2404	3156	msedge.exe	87
PID 3156 wrote to memory of 2404	3156	msedge.exe	87
PID 3156 wrote to memory of 2404	3156	msedge.exe	87
PID 3156 wrote to memory of 2404	3156	msedge.exe	87
PID 3156 wrote to memory of 2404	3156	msedge.exe	87
PID 3156 wrote to memory of 2404	3156	msedge.exe	87
PID 3156 wrote to memory of 2404	3156	msedge.exe	87
PID 3156 wrote to memory of 2404	3156	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.ly/zEbHV
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ff8540646f8,0x7ff854064708,0x7ff854064718
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,8969521246182573414,8188794644971547065,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,8969521246182573414,8188794644971547065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,8969521246182573414,8188794644971547065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8969521246182573414,8188794644971547065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8969521246182573414,8188794644971547065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8969521246182573414,8188794644971547065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,8969521246182573414,8188794644971547065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,8969521246182573414,8188794644971547065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8969521246182573414,8188794644971547065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8969521246182573414,8188794644971547065,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8969521246182573414,8188794644971547065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8969521246182573414,8188794644971547065,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,8969521246182573414,8188794644971547065,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
be0bed7cc669d12353448e57e7ad9809

SHA1
bc84c6ef7897efeb2f3c256c937a42848623cbb8

SHA256
21310860f3a82f3535e993ffa5e865ef3d31085c1c32794694a67297eabeb62f

SHA512
e1aca38f1fde0c4396d4c148bd8540668b7f9713cf9e9e0f562555d86257153444fc601a5a908cb991efd60dca5ff83658bc32048ec80ade7079c9b6a241d8fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b9bca8b62b2bf9ac02fe8aba9bf502fe

SHA1
90aa8a0cc203a61fee290c3edc8c67e11102cabb

SHA256
5713065948a831a4ca752404d34c2d6ff57bf1753c537b0969cfac8d2910e317

SHA512
4d2f7610ce83a0f7a28a248c55b86bc9dce13b8e05e19f27b0f6b8d4967d6285506a88501ac86b6051a049f1609fec1e9836a6605c5dc2b815806f6dc6576aba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
957B

MD5
6b002f88cc7f03965e34b1a46c9c153d

SHA1
d9ac173b226d8915789035b5d3a90724b654739f

SHA256
6f0402ecd422efc697449cdbdb8ac8cb4696ebe90edf062e0e31467543489178

SHA512
63d44c85b5acfc9d7d71f0fe79d5050e833dbf125bb3a9161a9e88a98eb5afc88418d2cc04114c1186ffe0e2c932bee14d27a02fd964a62556dfe16bbb6b6286

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8a7404afe00b747aabe72f9e8b0f9aa9

SHA1
f9afb0f694b306dca6e1107c7959d3c283ef7c2a

SHA256
b8bfa75976ac1e7edf0b053a90f3b63917afd63b9579c9b96bd363a9cd963b07

SHA512
2213c9964643b17d5de22d7e07aa500746b8ec0f7368db1c71f34d76688462ae8149938e84fe5ebb7bdaa54174e86c94dd7b76dcf97edd2d0250d3165899d846

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e1d9622d474401fca371f2aff319d66e

SHA1
8570fc82fd632b80cdf4f2f75c72f842d8b073f5

SHA256
60b76003ee1bf2e01b6f1c9b20438b4b4143175d77adcb6576863468a45e4fa0

SHA512
b28fe03663dbc48a884b02d0e398c97c3d61cd73158c230ea24e9430334c39ba6c7d7f7c6eea9ab078d9d2ca453d19c2e9edbf2a68692602a7cb76422326acfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bbbda3dc6e7901b1396026f60d3cc2ac

SHA1
d600d435928714ac41486d6fbb6b1ac45efd5aba

SHA256
6a869d327326e57a4119c4bb6935254234d8d32c385e634762605757e1e9f16e

SHA512
87ac39a00e868413027445a29a2c5564d53c9b4b9cee56813c7d719d4461d7499392e16a12c9ace4392450ce0b395175084173e91f85423c0ba89e893f244dcd

Download Submit