hxxp://links[.]notification[.]intuit[.]com/ls/click?upn=u001[.]SkyGoo-2FemZT6Xc-2Fn1lGbnolA50y-2BF9TWqkK0lI1Lm8fNvXP5-2FxDdNExe3CY544wPZVOkx-2Bsb4ktfZUcbQ6XLB0umkYGUQHHILweKuKpYjdzhF0uPLuei0-2BVlMRjPRLAo1fCXOjfoFIpID1YHPjFt9X6YM6IErfqKEFBoo2pDesv3b1J6kPlpjElQuqu-2FVRouDnTCFSAej3YnsTJqAMSzBAVgxVv0vk98gmowvMrxtOvx10r9-2FdMZ10Xg71orxPeKfym7hmo-2F-2B8bdWu2rgTnSJg-3D-3DVaXj_16M6GKGeDmPkOzr09KdAzqmyxUJbZgaDi4h0RkPzCPHSbphs600vF4t7eTVtxwS81PfmMEj5-2B9tPYTYr1Ra0wbm5UiruOjcBoWIgXfGuGH9tYP7xbxDMmjL9fkKZ4JfvCaNg-2Bys0zwPgn1fZOvnimj7qQPgls-2BFE6-2B5lNgqa6ubH5FQuQScBxeXRncgLx1el6VmKkrsx8CwJMsDYo1QdvvV1U7tkDk9vEy-2BEpH-2B-2BDs7y0BUutgYGzeZNK3L-2B5p4IRl2q-2Fds96PBYof6Iza0UehShNwZBUgBnCgrBJs2D8eidHnQw9B4gNCTAMX95itPs-2FhdD3ibREGfkU0WvmEqO-2B6aR7VniPP84QyRY1wFlZtD4YEsT9HTzA6TPgrAG8HiQZbLEKycscoYOl1Alrk-2BAIbW1T-2FIQa-2B2-2BGacg9tBNszXEPnQ4VJ9hFgYvamk4fr047D0vYGonXeLPdjKE-2Fr32SvZ98KaPiPYd3PV5DQAYLyujoYWhbMs1WDsg05e4-2BCQFmhaTtxUOUSgzCI0H2q-2FpCvNF-2FDBW8uzSk1ZjmFr7pvLCZgehH7uMQryCx30DMfVqgH4WWJeEMepIYaFLiAHouUzsePnUwcN8lQO6e07eBY3MZEmTXmQfrmtobpFjjqD5wgVvngxFPIHJMccdcSQK8qTAEMLqO5n1nTGGOnvchLJuqpB6CWZi1Q5kPhnV3WdJ1jairAGFHhadrWuN-2BFVUlAyBAtDyAjTQbEtCP-2BzmMkJfvOX7gdv0ElvRu3zKl11uKVOdRb69sUAvPgYEqjVh2ZTDN-2Ffot6W-2F7Vt1XmrU-2BcJU6TGCpSu-2Be2AYQLdIRhFuN9MvxXRET5OuHWdBBO79iG-2FKEq8rfeU-2Fixrg6-2Ba0UONX6zX0IH-2B3BwXI-2BI-2FPQ5WEr2iu9eyHXYoQKu-2B06glKnQYBi-2FtxI7JpewOjeeGU-2BjMgQBRkXBw4BIfXe816CsgPLOwQvz-2BdYCl3VAW4zocoXS-2BOANK6Cr06mswoUxSy1BKiWlvxO0cJyviRvPEJtc5jIKLddyBymMOokvQcUZswQWCUc03WUmBzGkTyGKn2xYw8m9Q82en00yWk9zUB47Uv7ijKzlrp7083t3-2B-2FnAZ0oSq1a1LfrHZr90VYaqorgJXRDiuhju1j-2BvQWgSjX2Tymc4xOTv-2B7GYwywbSm-2BVZrWx7ZLPEI9CKlTJ2NGMcSBv-2BtA7uk-2FnARbK0v5rJy-2FJpkdgOXXSKaLtLhMABoYMgdURFnIBP3S5ykqzX1mt2m4UDyiZQ0Xk-2Bca7aMj2cFDq-2FoonQ-2FhxjwG6nMIhLxeaaxP1F2S10fVKX7JdiMYcOyowt-2F6DbwN6LCEq2xf2iwVUGYriFY7GGfxrg9Dil0s-2FUqHEOiyTLLgXDvkbA2IwFPv6VGvPeBzdQ9klMs2fpxcADpkM21jYdFPVLZy13-2BdyYyhLhZagGhYVHIrXLXQUq-2FSS6hO2wsXItAithp-2BoB0Msq-2BEDQMaSaAyauZvE-2FfHY3weg-3D-3D

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/08/2024, 15:21

Sharing

Behavioral task

behavioral1

Sample

http://links.notification.intuit.com/ls/click?upn=u001.SkyGoo-2FemZT6Xc-2Fn1lGbnolA50y-2BF9TWqkK0lI1Lm8fNvXP5-2FxDdNExe3CY544wPZVOkx-2Bsb4ktfZUcbQ6XLB0umkYGUQHHILweKuKpYjdzhF0uPLuei0-2BVlMRjPRLAo1fCXOjfoFIpID1YHPjFt9X6YM6IErfqKEFBoo2pDesv3b1J6kPlpjElQuqu-2FVRouDnTCFSAej3YnsTJqAMSzBAVgxVv0vk98gmowvMrxtOvx10r9-2FdMZ10Xg71orxPeKfym7hmo-2F-2B8bdWu2rgTnSJg-3D-3DVaXj_16M6GKGeDmPkOzr09KdAzqmyxUJbZgaDi4h0RkPzCPHSbphs600vF4t7eTVtxwS81PfmMEj5-2B9tPYTYr1Ra0wbm5UiruOjcBoWIgXfGuGH9tYP7xbxDMmjL9fkKZ4JfvCaNg-2Bys0zwPgn1fZOvnimj7qQPgls-2BFE6-2B5lNgqa6ubH5FQuQScBxeXRncgLx1el6VmKkrsx8CwJMsDYo1QdvvV1U7tkDk9vEy-2BEpH-2B-2BDs7y0BUutgYGzeZNK3L-2B5p4IRl2q-2Fds96PBYof6Iza0UehShNwZBUgBnCgrBJs2D8eidHnQw9B4gNCTAMX95itPs-2FhdD3ibREGfkU0WvmEqO-2B6aR7VniPP84QyRY1wFlZtD4YEsT9HTzA6TPgrAG8HiQZbLEKycscoYOl1Alrk-2BAIbW1T-2FIQa-2B2-2BGacg9tBNszXEPnQ4VJ9hFgYvamk4fr047D0vYGonXeLPdjKE-2Fr32SvZ98KaPiPYd3PV5DQAYLyujoYWhbMs1WDsg05e4-2BCQFmhaTtxUOUSgzCI0H2q-2FpCvNF-2FDBW8uzSk1ZjmFr7pvLCZgehH7uMQryCx30DMfVqgH4WWJeEMepIYaFLiAHouUzsePnUwcN8lQO6e07eBY3MZEmTXmQfrmtobpFjjqD5wgVvngxFPIHJMccdcSQK8qTAEMLqO5n1nTGGOnvchLJuqpB6CWZi1Q5kPhnV3WdJ1jairAGFHhadrWuN-2BFVUlAyBAtDyAjTQbEtCP-2BzmMkJfvOX7gdv0ElvRu3zKl11uKVOdRb69sUAvPgYEqjVh2ZTDN-2Ffot6W-2F7Vt1XmrU-2BcJU6TGCpSu-2Be2AYQLdIRhFuN9MvxXRET5OuHWdBBO79iG-2FKEq8rfeU-2Fixrg6-2Ba0UONX6zX0IH-2B3BwXI-2BI-2FPQ5WEr2iu9eyHXYoQKu-2B06glKnQYBi-2FtxI7JpewOjeeGU-2BjMgQBRkXBw4BIfXe816CsgPLOwQvz-2BdYCl3VAW4zocoXS-2BOANK6Cr06mswoUxSy1BKiWlvxO0cJyviRvPEJtc5jIKLddyBymMOokvQcUZswQWCUc03WUmBzGkTyGKn2xYw8m9Q82en00yWk9zUB47Uv7ijKzlrp7083t3-2B-2FnAZ0oSq1a1LfrHZr90VYaqorgJXRDiuhju1j-2BvQWgSjX2Tymc4xOTv-2B7GYwywbSm-2BVZrWx7ZLPEI9CKlTJ2NGMcSBv-2BtA7uk-2FnARbK0v5rJy-2FJpkdgOXXSKaLtLhMABoYMgdURFnIBP3S5ykqzX1mt2m4UDyiZQ0Xk-2Bca7aMj2cFDq-2FoonQ-2FhxjwG6nMIhLxeaaxP1F2S10fVKX7JdiMYcOyowt-2F6DbwN6LCEq2xf2iwVUGYriFY7GGfxrg9Dil0s-2FUqHEOiyTLLgXDvkbA2IwFPv6VGvPeBzdQ9klMs2fpxcADpkM21jYdFPVLZy13-2BdyYyhLhZagGhYVHIrXLXQUq-2FSS6hO2wsXItAithp-2BoB0Msq-2BEDQMaSaAyauZvE-2FfHY3weg-3D-3D

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

7 signatures

150 seconds

Report Analysis Logs

General

Target

http://links.notification.intuit.com/ls/click?upn=u001.SkyGoo-2FemZT6Xc-2Fn1lGbnolA50y-2BF9TWqkK0lI1Lm8fNvXP5-2FxDdNExe3CY544wPZVOkx-2Bsb4ktfZUcbQ6XLB0umkYGUQHHILweKuKpYjdzhF0uPLuei0-2BVlMRjPRLAo1fCXOjfoFIpID1YHPjFt9X6YM6IErfqKEFBoo2pDesv3b1J6kPlpjElQuqu-2FVRouDnTCFSAej3YnsTJqAMSzBAVgxVv0vk98gmowvMrxtOvx10r9-2FdMZ10Xg71orxPeKfym7hmo-2F-2B8bdWu2rgTnSJg-3D-3DVaXj_16M6GKGeDmPkOzr09KdAzqmyxUJbZgaDi4h0RkPzCPHSbphs600vF4t7eTVtxwS81PfmMEj5-2B9tPYTYr1Ra0wbm5UiruOjcBoWIgXfGuGH9tYP7xbxDMmjL9fkKZ4JfvCaNg-2Bys0zwPgn1fZOvnimj7qQPgls-2BFE6-2B5lNgqa6ubH5FQuQScBxeXRncgLx1el6VmKkrsx8CwJMsDYo1QdvvV1U7tkDk9vEy-2BEpH-2B-2BDs7y0BUutgYGzeZNK3L-2B5p4IRl2q-2Fds96PBYof6Iza0UehShNwZBUgBnCgrBJs2D8eidHnQw9B4gNCTAMX95itPs-2FhdD3ibREGfkU0WvmEqO-2B6aR7VniPP84QyRY1wFlZtD4YEsT9HTzA6TPgrAG8HiQZbLEKycscoYOl1Alrk-2BAIbW1T-2FIQa-2B2-2BGacg9tBNszXEPnQ4VJ9hFgYvamk4fr047D0vYGonXeLPdjKE-2Fr32SvZ98KaPiPYd3PV5DQAYLyujoYWhbMs1WDsg05e4-2BCQFmhaTtxUOUSgzCI0H2q-2FpCvNF-2FDBW8uzSk1ZjmFr7pvLCZgehH7uMQryCx30DMfVqgH4WWJeEMepIYaFLiAHouUzsePnUwcN8lQO6e07eBY3MZEmTXmQfrmtobpFjjqD5wgVvngxFPIHJMccdcSQK8qTAEMLqO5n1nTGGOnvchLJuqpB6CWZi1Q5kPhnV3WdJ1jairAGFHhadrWuN-2BFVUlAyBAtDyAjTQbEtCP-2BzmMkJfvOX7gdv0ElvRu3zKl11uKVOdRb69sUAvPgYEqjVh2ZTDN-2Ffot6W-2F7Vt1XmrU-2BcJU6TGCpSu-2Be2AYQLdIRhFuN9MvxXRET5OuHWdBBO79iG-2FKEq8rfeU-2Fixrg6-2Ba0UONX6zX0IH-2B3BwXI-2BI-2FPQ5WEr2iu9eyHXYoQKu-2B06glKnQYBi-2FtxI7JpewOjeeGU-2BjMgQBRkXBw4BIfXe816CsgPLOwQvz-2BdYCl3VAW4zocoXS-2BOANK6Cr06mswoUxSy1BKiWlvxO0cJyviRvPEJtc5jIKLddyBymMOokvQcUZswQWCUc03WUmBzGkTyGKn2xYw8m9Q82en00yWk9zUB47Uv7ijKzlrp7083t3-2B-2FnAZ0oSq1a1LfrHZr90VYaqorgJXRDiuhju1j-2BvQWgSjX2Tymc4xOTv-2B7GYwywbSm-2BVZrWx7ZLPEI9CKlTJ2NGMcSBv-2BtA7uk-2FnARbK0v5rJy-2FJpkdgOXXSKaLtLhMABoYMgdURFnIBP3S5ykqzX1mt2m4UDyiZQ0Xk-2Bca7aMj2cFDq-2FoonQ-2FhxjwG6nMIhLxeaaxP1F2S10fVKX7JdiMYcOyowt-2F6DbwN6LCEq2xf2iwVUGYriFY7GGfxrg9Dil0s-2FUqHEOiyTLLgXDvkbA2IwFPv6VGvPeBzdQ9klMs2fpxcADpkM21jYdFPVLZy13-2BdyYyhLhZagGhYVHIrXLXQUq-2FSS6hO2wsXItAithp-2BoB0Msq-2BEDQMaSaAyauZvE-2FfHY3weg-3D-3D

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1132	msedge.exe
1132	msedge.exe
3424	msedge.exe
3424	msedge.exe
2216	identity_helper.exe
2216	identity_helper.exe
5644	msedge.exe
5644	msedge.exe
5644	msedge.exe
5644	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 2420	3424	msedge.exe	84
PID 3424 wrote to memory of 2420	3424	msedge.exe	84
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 2608	3424	msedge.exe	85
PID 3424 wrote to memory of 1132	3424	msedge.exe	86
PID 3424 wrote to memory of 1132	3424	msedge.exe	86
PID 3424 wrote to memory of 1020	3424	msedge.exe	87
PID 3424 wrote to memory of 1020	3424	msedge.exe	87
PID 3424 wrote to memory of 1020	3424	msedge.exe	87
PID 3424 wrote to memory of 1020	3424	msedge.exe	87
PID 3424 wrote to memory of 1020	3424	msedge.exe	87
PID 3424 wrote to memory of 1020	3424	msedge.exe	87
PID 3424 wrote to memory of 1020	3424	msedge.exe	87
PID 3424 wrote to memory of 1020	3424	msedge.exe	87
PID 3424 wrote to memory of 1020	3424	msedge.exe	87
PID 3424 wrote to memory of 1020	3424	msedge.exe	87
PID 3424 wrote to memory of 1020	3424	msedge.exe	87
PID 3424 wrote to memory of 1020	3424	msedge.exe	87
PID 3424 wrote to memory of 1020	3424	msedge.exe	87
PID 3424 wrote to memory of 1020	3424	msedge.exe	87
PID 3424 wrote to memory of 1020	3424	msedge.exe	87
PID 3424 wrote to memory of 1020	3424	msedge.exe	87
PID 3424 wrote to memory of 1020	3424	msedge.exe	87
PID 3424 wrote to memory of 1020	3424	msedge.exe	87
PID 3424 wrote to memory of 1020	3424	msedge.exe	87
PID 3424 wrote to memory of 1020	3424	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://links.notification.intuit.com/ls/click?upn=u001.SkyGoo-2FemZT6Xc-2Fn1lGbnolA50y-2BF9TWqkK0lI1Lm8fNvXP5-2FxDdNExe3CY544wPZVOkx-2Bsb4ktfZUcbQ6XLB0umkYGUQHHILweKuKpYjdzhF0uPLuei0-2BVlMRjPRLAo1fCXOjfoFIpID1YHPjFt9X6YM6IErfqKEFBoo2pDesv3b1J6kPlpjElQuqu-2FVRouDnTCFSAej3YnsTJqAMSzBAVgxVv0vk98gmowvMrxtOvx10r9-2FdMZ10Xg71orxPeKfym7hmo-2F-2B8bdWu2rgTnSJg-3D-3DVaXj_16M6GKGeDmPkOzr09KdAzqmyxUJbZgaDi4h0RkPzCPHSbphs600vF4t7eTVtxwS81PfmMEj5-2B9tPYTYr1Ra0wbm5UiruOjcBoWIgXfGuGH9tYP7xbxDMmjL9fkKZ4JfvCaNg-2Bys0zwPgn1fZOvnimj7qQPgls-2BFE6-2B5lNgqa6ubH5FQuQScBxeXRncgLx1el6VmKkrsx8CwJMsDYo1QdvvV1U7tkDk9vEy-2BEpH-2B-2BDs7y0BUutgYGzeZNK3L-2B5p4IRl2q-2Fds96PBYof6Iza0UehShNwZBUgBnCgrBJs2D8eidHnQw9B4gNCTAMX95itPs-2FhdD3ibREGfkU0WvmEqO-2B6aR7VniPP84QyRY1wFlZtD4YEsT9HTzA6TPgrAG8HiQZbLEKycscoYOl1Alrk-2BAIbW1T-2FIQa-2B2-2BGacg9tBNszXEPnQ4VJ9hFgYvamk4fr047D0vYGonXeLPdjKE-2Fr32SvZ98KaPiPYd3PV5DQAYLyujoYWhbMs1WDsg05e4-2BCQFmhaTtxUOUSgzCI0H2q-2FpCvNF-2FDBW8uzSk1ZjmFr7pvLCZgehH7uMQryCx30DMfVqgH4WWJeEMepIYaFLiAHouUzsePnUwcN8lQO6e07eBY3MZEmTXmQfrmtobpFjjqD5wgVvngxFPIHJMccdcSQK8qTAEMLqO5n1nTGGOnvchLJuqpB6CWZi1Q5kPhnV3WdJ1jairAGFHhadrWuN-2BFVUlAyBAtDyAjTQbEtCP-2BzmMkJfvOX7gdv0ElvRu3zKl11uKVOdRb69sUAvPgYEqjVh2ZTDN-2Ffot6W-2F7Vt1XmrU-2BcJU6TGCpSu-2Be2AYQLdIRhFuN9MvxXRET5OuHWdBBO79iG-2FKEq8rfeU-2Fixrg6-2Ba0UONX6zX0IH-2B3BwXI-2BI-2FPQ5WEr2iu9eyHXYoQKu-2B06glKnQYBi-2FtxI7JpewOjeeGU-2BjMgQBRkXBw4BIfXe816CsgPLOwQvz-2BdYCl3VAW4zocoXS-2BOANK6Cr06mswoUxSy1BKiWlvxO0cJyviRvPEJtc5jIKLddyBymMOokvQcUZswQWCUc03WUmBzGkTyGKn2xYw8m9Q82en00yWk9zUB47Uv7ijKzlrp7083t3-2B-2FnAZ0oSq1a1LfrHZr90VYaqorgJXRDiuhju1j-2BvQWgSjX2Tymc4xOTv-2B7GYwywbSm-2BVZrWx7ZLPEI9CKlTJ2NGMcSBv-2BtA7uk-2FnARbK0v5rJy-2FJpkdgOXXSKaLtLhMABoYMgdURFnIBP3S5ykqzX1mt2m4UDyiZQ0Xk-2Bca7aMj2cFDq-2FoonQ-2FhxjwG6nMIhLxeaaxP1F2S10fVKX7JdiMYcOyowt-2F6DbwN6LCEq2xf2iwVUGYriFY7GGfxrg9Dil0s-2FUqHEOiyTLLgXDvkbA2IwFPv6VGvPeBzdQ9klMs2fpxcADpkM21jYdFPVLZy13-2BdyYyhLhZagGhYVHIrXLXQUq-2FSS6hO2wsXItAithp-2BoB0Msq-2BEDQMaSaAyauZvE-2FfHY3weg-3D-3D
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0a3d46f8,0x7ffa0a3d4708,0x7ffa0a3d4718
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,12244259781003756187,12377361901667727485,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,12244259781003756187,12377361901667727485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,12244259781003756187,12377361901667727485,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12244259781003756187,12377361901667727485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12244259781003756187,12377361901667727485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12244259781003756187,12377361901667727485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12244259781003756187,12377361901667727485,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2124,12244259781003756187,12377361901667727485,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=5276 /prefetch:6
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,12244259781003756187,12377361901667727485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,12244259781003756187,12377361901667727485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12244259781003756187,12377361901667727485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12244259781003756187,12377361901667727485,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12244259781003756187,12377361901667727485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12244259781003756187,12377361901667727485,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,12244259781003756187,12377361901667727485,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4120 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
d810c66073d4931de1ef5dab38583bba

SHA1
260ec22ad491a7655a1972022e4fc06960be96dd

SHA256
d792d2cf0b1ecab3e566854c59216c2f85c16c8917eca70c28eff61eb5e07006

SHA512
1e839e7c5f133d2fa0041afd3284c1d850c19069b882c3459e0b25e903e0907ecf9fd826e1f13bdeb8a71c056dfd56248abee8e36c6d3cbe2e65f7089df8a038

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\85654631-c1d1-4420-a2ed-153569b1e668.tmp

Filesize
6KB

MD5
7c609639c97b6e7ee26cbb98a6a77638

SHA1
6a3b2aa9a2dbd094cb7c0621e743bd90effe6d7f

SHA256
c4d1aca7b5c36b04c92d3c0873edbad5150e3406d21a3af0d1e5fea071ab0dd0

SHA512
44de89a49dbe073699bcce66c0b97d1a64c7a1efb6b5682d5aa43203b72b4cfa5cad00a48a82d660fdd958f715ca1533ae01b9e2f82b7dcc42a7e7e25d4e9eb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
238d6233d3596cba5c33755cfea9de03

SHA1
5318e3e167f01b6cf7ae405c88b1759b0de13fed

SHA256
83b6e9b56ee15fd717c673286c5f27f4cc7fc1cabf440d18aa4921a80476a9aa

SHA512
5f0a9de154c5ffe47fbef4edc65d5123b49c88c3dec7b1eec6a8a5cb64d35ed1e6eafb4ac80392c491e52078cce9ef17eb88f11e26175e1e6b61a537b096f66e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
869B

MD5
ff1457a0c6c3f6734fda450d1c5d72dd

SHA1
28285fcebde8d8afb37ea5026cbe1b01750a4264

SHA256
fdc9a954701439b17c0a0e00fcd53c3e4e401449f681336090094b05c264e169

SHA512
fb96924e0a217a657037d9328db1507f21c4895ea0fb2da503433d25a283184c090ceade658daa8e79d7fe238d0b4e82f33a2b000fc58c84189bf609b4fdd52c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d0b17ffbab6e7226d3d48733e6d46195

SHA1
46f318eb42f96201b3fa292de426323c1b68c63f

SHA256
d49d40e720ff688a54f69f3e6310d46067a9e36e9a8031a119a386e0c1a95578

SHA512
82d2da1f754109cd586fdfc213e09c2a5599b744b196130cc2c54eb1f5822165dfa5d9011eee93d0db112834c2ec4beab80183504ea8d944703b4a467b4386f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
954af025e04e5b11dfd568ecdac83b64

SHA1
844a5a07a9543ba02959ef99778a87c289722b17

SHA256
0c42b5577acf3501563b0b6fa35282b939a6f34c73b5941b76e01b50acf5e689

SHA512
269f3f489c64c975e175ab33d5d9d6f485a3e84ccd6564214ce504176e0cd1e379a287d75b3ac1c72b97d65cd5f02b4429c67444424c8f8f22b15fb2c1171703

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581f3b.TMP

Filesize
538B

MD5
79dd0b0f8102336b8554e40d6d08d0d7

SHA1
af86ab860c1eda71eba399b85714bedb8d746cb1

SHA256
98cd2ec2d4355c45fb8a23f3b9ec4513bdd88591479ae6b1297ec6c75a8091d6

SHA512
9e680e1a7572bb65cf18334c4c2435a52d085270488e64282f1d7d6fc4742e58a2b160d5d1daf7440ef7d4df94ed2858c52c934dad30b15867921d60e7c915b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ae21a7e39d562ab16bf0bf1b3b13867d

SHA1
e6b74f638be8380102383d8ffb1c7c77b9e4d9d5

SHA256
3f9e04603361a9705f0898866f886ee09ed38718b508682e4645a9e5eca8017b

SHA512
e15249af957effaecccd1a0555895a11547e94f986fa41ec70118f73c1d1063d4a9db7c816e2bc35878910aa9d6b48619f2d0c2b9b96ae3f5b383a63ec399d76

Download Submit