hxxps://filebin[.]net/a36oiaw6dro9e2w5

Analysis

max time kernel
27s
max time network
30s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
01/09/2024, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://filebin.net/a36oiaw6dro9e2w5
Sample240901-sbaljsvbke

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe
3040	msedge.exe
3040	msedge.exe
3916	msedge.exe
3916	msedge.exe
4244	identity_helper.exe
4244	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 4436	3040	msedge.exe	81
PID 3040 wrote to memory of 4436	3040	msedge.exe	81
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2708	3040	msedge.exe	82
PID 3040 wrote to memory of 2176	3040	msedge.exe	83
PID 3040 wrote to memory of 2176	3040	msedge.exe	83
PID 3040 wrote to memory of 3256	3040	msedge.exe	84
PID 3040 wrote to memory of 3256	3040	msedge.exe	84
PID 3040 wrote to memory of 3256	3040	msedge.exe	84
PID 3040 wrote to memory of 3256	3040	msedge.exe	84
PID 3040 wrote to memory of 3256	3040	msedge.exe	84
PID 3040 wrote to memory of 3256	3040	msedge.exe	84
PID 3040 wrote to memory of 3256	3040	msedge.exe	84
PID 3040 wrote to memory of 3256	3040	msedge.exe	84
PID 3040 wrote to memory of 3256	3040	msedge.exe	84
PID 3040 wrote to memory of 3256	3040	msedge.exe	84
PID 3040 wrote to memory of 3256	3040	msedge.exe	84
PID 3040 wrote to memory of 3256	3040	msedge.exe	84
PID 3040 wrote to memory of 3256	3040	msedge.exe	84
PID 3040 wrote to memory of 3256	3040	msedge.exe	84
PID 3040 wrote to memory of 3256	3040	msedge.exe	84
PID 3040 wrote to memory of 3256	3040	msedge.exe	84
PID 3040 wrote to memory of 3256	3040	msedge.exe	84
PID 3040 wrote to memory of 3256	3040	msedge.exe	84
PID 3040 wrote to memory of 3256	3040	msedge.exe	84
PID 3040 wrote to memory of 3256	3040	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://filebin.net/a36oiaw6dro9e2w5
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb03e23cb8,0x7ffb03e23cc8,0x7ffb03e23cd8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1844,10776382752752411721,17028470584608402791,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1852 /prefetch:2
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1844,10776382752752411721,17028470584608402791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1844,10776382752752411721,17028470584608402791,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,10776382752752411721,17028470584608402791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2984 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,10776382752752411721,17028470584608402791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1844,10776382752752411721,17028470584608402791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4060 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1844,10776382752752411721,17028470584608402791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,10776382752752411721,17028470584608402791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,10776382752752411721,17028470584608402791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,10776382752752411721,17028470584608402791,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,10776382752752411721,17028470584608402791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,10776382752752411721,17028470584608402791,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:2380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 82e6cd647225c2781d32207ca56e1bf5e85dddabdfdf67a469c6e8910062975c
MD5 70e969d4a2b40aef8eb0736379c0bcfb
SHA1 608c4fdf0e6b820eed23b793884e11210b32be58
SHA512 e38f13e75d7a74400b1c21be8c5d8045c366078c4bfd7a25de86a872a22db8b383484c4f044d433f557ba3f181670398eeb7322fb6946a3bfff03875576b596d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f393d5cc1a1b59d1bf0f19ade21515652b60bdea4b2d11780b904eb90fdd7b4b
MD5 fc36221d3cc9a4657faeb51e3ea7023a
SHA1 22e3f8e68b2dd3992d544f8ca57c48c6878f77f9
SHA512 1d831b911b8e6970f3c829d7aed3c7d0faeb3f986fa029c8db8e2b2ced40898ad96b26311e620300ecd6d5a71f444582052b9ae11c4231224010096105bdb117
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 6f51f4fb7c8153716f59d6815f1d7e2e362c6774ce5de371384b3dcd6c4009b4
MD5 8d1dbe6519d666c61e0f3c11a4881b07
SHA1 ea329699cb773eafabb6b192f64a0908fbbb9502
SHA512 6f7546cda1bb0581f13aa03b3ad3aa58564a9141c4c58b347a6f9a6ecef822c904b34ccf976565a223276bb2c7f1ef1ef886ce0c695d3dbefde51d42b5af323f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 343e1cb381176b14c2e401efcaccbaaf300c93baf4dbab0614fc0d642c60ba0c
MD5 a28fa9db9cd95d20033946447e886b40
SHA1 dba9c20e316723fee1bd39ea1d0480950cec170d
SHA512 7ed430cadc886f842bc41a59907d4e0a5391c39109072fcaf8efb83cf6213a69f0f1567a5003f29664577e469f5d9637bd034f257dae01417c7f704e7d8cdfaa
SSDEEP 96:nwk3wMhkMouwSv0MoiVmdHIvJxce0WQyV+VpziX3wI3:nwk3Xhk2v0MAIhxceLx93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 7348e2603912d7571574c487cfac41e8e1274d9f17ace2148b5682b8f630b005
MD5 ec499eddcf45da5217b2498a9e7b54a5
SHA1 b17974a759e361ba4bab1b1a3fdda33c1a24cea3
SHA512 a502378874f5c53aed724fbdfb6d74f2c6dfcc9fee61be48b1eeb9cb59a134ad68efd17ee3e9dc22d6ca2bd70bcccaa98d66f6c720e93afb502eddc504888fda
SSDEEP 96:nwk3YMhkJouwSv0MoiVmdEuZ1jIiJxce0WQyV+VpAiX3wI3:nwk3fhknv0MDuZhIoxceLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 25KB
SHA256 ecc17c289b6a0f4fe10cae7e9eed2413279d3d4354d82fcc9bc672b7bd7493aa
MD5 8c0d6616af07f61a695d23555f03afb5
SHA1 4d920d7f35be99217c86ea4dc2396a55e960a537
SHA512 f903fe7977d14cc2d021bbf54f103421d0500cbf7b7f3cfd4ba93ae56af294307ec1b7d82c93d1fb530bb132ef4d009aa244ce2a60c23d7748b5ca08e4c7a2d0
SSDEEP 768:n/c8q28WRSQf8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3SLl/+0tWrUpV:n/c8q28WRSQfu1jaKSLpHtVpV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 37bc4ed61301e4d7dc23dd08c2653328f9fc1a492ddcb1262a281379049d1b74
MD5 2ea7ee16e1e9518423195c7cf10e53aa
SHA1 c62e7168f93bb00481f9f645635488c6b7ce400a
SHA512 c871842649bafeedd70ca957803b728e36b007ae39125bd255fe0d9ba38a2b87ea62c949c2106cd8c19c65933616cb789a1c68ca42352cf2c7996ecef18500f4
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG3wLe2RUM7RhnK4N8CLSf7mKn:M9iIxuERzA83h09RZxASGgbZ24N3Sf7N
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 a177a2cc551f21581a6643c680a1a61c2e9ebdd1d7346ffe82354646430d0dd2
MD5 683db786d7f64e2922392d458de7dd39
SHA1 49f94b98e0b2c734870b175b394104d18cefcc5f
SHA512 186e36f9965a63351f13cfbe75ecce8086196d089c0a56fe420d8f603e29ad77ada497565acd4e23a62812191639dae89ce031a7689de8f95227ccc3bb54bf21
SSDEEP 192:WoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASG3wLe2RUM7RhnKGN8CLSf7mKn:S9iIxuERzA83h09RZxASGgbZ2GN3Sf7N
MD5 SHA1 SHA512 SSDEEP

Submit Download