Analysis
- max time kernel
18s - max time network
24s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
01/09/2024, 14:56
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://filebin.net/a36oiaw6dro9e2w5
Resource
win7-20240729-en
windows7-x64
5 signatures
300 seconds
Behavioral task
behavioral2
Sample
https://filebin.net/a36oiaw6dro9e2w5
Resource
win10-20240404-en
windows10-1703-x64
7 signatures
300 seconds
Behavioral task
behavioral3
Sample
https://filebin.net/a36oiaw6dro9e2w5
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
300 seconds
Behavioral task
behavioral4
Sample
https://filebin.net/a36oiaw6dro9e2w5
Resource
win11-20240802-en
windows11-21h2-x64
7 signatures
300 seconds
General
- Target https://filebin.net/a36oiaw6dro9e2w5
- Sample240901-sbaljsvbke
Score
3/10
Malware Config
Signatures
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2404 msedge.exe 2404 msedge.exe 1196 msedge.exe 1196 msedge.exe 4904 identity_helper.exe 4904 identity_helper.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1196 wrote to memory of 3520 1196 msedge.exe 84 PID 1196 wrote to memory of 3520 1196 msedge.exe 84 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 4364 1196 msedge.exe 85 PID 1196 wrote to memory of 2404 1196 msedge.exe 86 PID 1196 wrote to memory of 2404 1196 msedge.exe 86 PID 1196 wrote to memory of 2188 1196 msedge.exe 87 PID 1196 wrote to memory of 2188 1196 msedge.exe 87 PID 1196 wrote to memory of 2188 1196 msedge.exe 87 PID 1196 wrote to memory of 2188 1196 msedge.exe 87 PID 1196 wrote to memory of 2188 1196 msedge.exe 87 PID 1196 wrote to memory of 2188 1196 msedge.exe 87 PID 1196 wrote to memory of 2188 1196 msedge.exe 87 PID 1196 wrote to memory of 2188 1196 msedge.exe 87 PID 1196 wrote to memory of 2188 1196 msedge.exe 87 PID 1196 wrote to memory of 2188 1196 msedge.exe 87 PID 1196 wrote to memory of 2188 1196 msedge.exe 87 PID 1196 wrote to memory of 2188 1196 msedge.exe 87 PID 1196 wrote to memory of 2188 1196 msedge.exe 87 PID 1196 wrote to memory of 2188 1196 msedge.exe 87 PID 1196 wrote to memory of 2188 1196 msedge.exe 87 PID 1196 wrote to memory of 2188 1196 msedge.exe 87 PID 1196 wrote to memory of 2188 1196 msedge.exe 87 PID 1196 wrote to memory of 2188 1196 msedge.exe 87 PID 1196 wrote to memory of 2188 1196 msedge.exe 87 PID 1196 wrote to memory of 2188 1196 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://filebin.net/a36oiaw6dro9e2w51⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff449b46f8,0x7fff449b4708,0x7fff449b47182⤵PID:3520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,4665015633922988638,10824600640315485044,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:22⤵PID:4364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,4665015633922988638,10824600640315485044,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,4665015633922988638,10824600640315485044,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:82⤵PID:2188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4665015633922988638,10824600640315485044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:12⤵PID:4380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4665015633922988638,10824600640315485044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:12⤵PID:4972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,4665015633922988638,10824600640315485044,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:82⤵PID:4232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,4665015633922988638,10824600640315485044,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4665015633922988638,10824600640315485044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:12⤵PID:228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4665015633922988638,10824600640315485044,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:12⤵PID:3984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4665015633922988638,10824600640315485044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:12⤵PID:1428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,4665015633922988638,10824600640315485044,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:12⤵PID:1912
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4536
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1804
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\14d8f578-853f-4e20-803f-6644cafe6d14.tmp
- Size 11KB
- SHA256 a116f7a62136f6ff389dd5740c62a8b65aa761e7cc2fe1102381392d3d8bda4b
- MD5 50609983ae7a41ef72039af64994cd01
- SHA1 93f246f1b5dc8c007f8e5cb1b5f6dd27bc117229
- SHA512 c6f00d3b5008d735cf65e348943e3d13075d19c1b915a74e6c901a09ff11cb5aed932eecfd3c72dd33abd840289f8d7201120c81c6259c51b543a8cb0d305c35
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSSLANe2RUQ23I9Rw5Ytj9i:A9iIxuERzA83h09RZxYhEgY+kLsJWMr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da
- MD5 9b008261dda31857d68792b46af6dd6d
- SHA1 e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3
- SHA512 78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
- MD5 0446fcdd21b016db1f468971fb82a488
- SHA1 726b91562bb75f80981f381e3c69d7d832c87c9d
- SHA512 1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 5KB
- SHA256 5b385677433191fee8d2bc882db69c072848aa6e07481cb3360bcd28a656415c
- MD5 f7f703f98806969b645051a8e2d87315
- SHA1 5dac978752c0586a617f05001ef0a0c02bd05bfb
- SHA512 21cc39c0160f5d7e40032aca8c5763cc56582453057ed1caa5cac478dc84361b84de40d34738f4ba5732ae69ffc9fab90918cca821911cdac822506d9efcc0e6
- SSDEEP 96:nGkzaa1BNkdwpvWMoiVmdeH/ddevUWQyV+VDCziEwb:nGkztVCGWMX1gvro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 26c7f9bb3408b347c49380d8ac044a2f3a5d61e25341d2c34477ee4c7b5eb141
- MD5 90d1e30fbdb8cf7019898a27872c522d
- SHA1 360ed80652fc4a334424aa121b1c960afa760eaa
- SHA512 b2a5147b95a04967d558177fdf60196991ca1a7c9c48a2806a3add700fa1f3d723cb43a41158caa348f7fd7f47acd3e3a0592d252bb60ac30401ad042fd5585f
- SSDEEP 96:nGkzga1BNUdwpvWMoiVmdezue1j/dTevUWQyV+VD7AiEwb:nGkz/VSGWMDueh16vrg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512