hxxps://sendvid[.]com/73z9w0yn

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 01:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://sendvid.com/73z9w0yn

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3932	msedge.exe
3932	msedge.exe
2784	msedge.exe
2784	msedge.exe
4420	identity_helper.exe
4420	identity_helper.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 628	2784	msedge.exe	83
PID 2784 wrote to memory of 628	2784	msedge.exe	83
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 1572	2784	msedge.exe	84
PID 2784 wrote to memory of 3932	2784	msedge.exe	85
PID 2784 wrote to memory of 3932	2784	msedge.exe	85
PID 2784 wrote to memory of 3700	2784	msedge.exe	86
PID 2784 wrote to memory of 3700	2784	msedge.exe	86
PID 2784 wrote to memory of 3700	2784	msedge.exe	86
PID 2784 wrote to memory of 3700	2784	msedge.exe	86
PID 2784 wrote to memory of 3700	2784	msedge.exe	86
PID 2784 wrote to memory of 3700	2784	msedge.exe	86
PID 2784 wrote to memory of 3700	2784	msedge.exe	86
PID 2784 wrote to memory of 3700	2784	msedge.exe	86
PID 2784 wrote to memory of 3700	2784	msedge.exe	86
PID 2784 wrote to memory of 3700	2784	msedge.exe	86
PID 2784 wrote to memory of 3700	2784	msedge.exe	86
PID 2784 wrote to memory of 3700	2784	msedge.exe	86
PID 2784 wrote to memory of 3700	2784	msedge.exe	86
PID 2784 wrote to memory of 3700	2784	msedge.exe	86
PID 2784 wrote to memory of 3700	2784	msedge.exe	86
PID 2784 wrote to memory of 3700	2784	msedge.exe	86
PID 2784 wrote to memory of 3700	2784	msedge.exe	86
PID 2784 wrote to memory of 3700	2784	msedge.exe	86
PID 2784 wrote to memory of 3700	2784	msedge.exe	86
PID 2784 wrote to memory of 3700	2784	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sendvid.com/73z9w0yn
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc372046f8,0x7ffc37204708,0x7ffc37204718
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,12769579539005673076,6113349891934114220,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,12769579539005673076,6113349891934114220,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,12769579539005673076,6113349891934114220,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12769579539005673076,6113349891934114220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12769579539005673076,6113349891934114220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,12769579539005673076,6113349891934114220,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,12769579539005673076,6113349891934114220,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12769579539005673076,6113349891934114220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12769579539005673076,6113349891934114220,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12769579539005673076,6113349891934114220,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12769579539005673076,6113349891934114220,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,12769579539005673076,6113349891934114220,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4656 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
7dee60273734163ba78e8bbf07431dfa

SHA1
4430a2ba1ef659496b69aff2ae212abd066f306b

SHA256
d8f195d0a6fe984b8f65638a2b44062491ec19531b7b2be90b8a879598511f22

SHA512
5b0d1e2d4d02d9e08276cb58310cdc536291533ad7f9184b8eef00d969cd6eb93b3ce375bea62ae560d15cace7041c9b4570da2cd24daf4154e8642db525db3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
26974ebac4c8bd090f891f832079086b

SHA1
441c72fe3e98652016d3bd4fa3d0a32fbadbb763

SHA256
a404363c6ff754367721f6e38074b9c8fbbb9a6d7d9f05ef0f62d876d26248d7

SHA512
657f5ddaf8ff21fd762fa1ce2b63eb277841a8942b535b53131cf8f1e75958ca4c255597ce977dd00a0f87a49c459898bf3e87b30abba61887d338ec23abd716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8fd62a407949c8a0d1f658a6169409fa

SHA1
e20b5320c052ac1eeca32166dd134dfc022e64dd

SHA256
31b77f12a7ec4f397c4d11e44a22643c482fc477457116feacad22d59316daa8

SHA512
67285b801a1d6417b1a4077a823dc4ad49dc42b46353c2d91499a3372564a2efb022bc44591ec061ed13484cc05838eff9eb299d545b5dc2be279eeecb7ad1d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f55db3d1c13e9a2a30739bad0a70b999

SHA1
03638665a391f5283fc1009d5195fe34dd7ffead

SHA256
1d309eb2b68de1043b17265409c763b49cf30461549308f26d66c2f27168d5a7

SHA512
ad5cd8831c92ee40ae7da27eddcdd32dda42a4d616eca080e2acc6783a3193196bdd7a9601e9aa7692e6de4087168dd68bf82e401d21054f6bef3b88ec8b3bda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e163f79de23dbeb302680a23352bbc46

SHA1
95a5cfef4bd6700c1477c7221b0a277aaccb8871

SHA256
03068e040595daed1cac685f20ec51a628120c6600eb9772373117d2e2ea7486

SHA512
f2667f3509c1cde43fefe2241adf3a5aca9811f7e1f5d04762d071e1fab5022ed1347df5cf9f0997c05e28ca5171be842bae53556cbb83b47f9c3183b31fbd4f

Download Submit