hxxps://gofile[.]io/d/w9MR8K

Analysis

max time kernel
71s
max time network
78s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-09-2024 03:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/w9MR8K

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
2816	msedge.exe
2816	msedge.exe
2684	identity_helper.exe
2684	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe

Suspicious use of FindShellTrayWindow 29 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 4852	2816	msedge.exe	83
PID 2816 wrote to memory of 4852	2816	msedge.exe	83
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 3200	2816	msedge.exe	84
PID 2816 wrote to memory of 4656	2816	msedge.exe	85
PID 2816 wrote to memory of 4656	2816	msedge.exe	85
PID 2816 wrote to memory of 2204	2816	msedge.exe	86
PID 2816 wrote to memory of 2204	2816	msedge.exe	86
PID 2816 wrote to memory of 2204	2816	msedge.exe	86
PID 2816 wrote to memory of 2204	2816	msedge.exe	86
PID 2816 wrote to memory of 2204	2816	msedge.exe	86
PID 2816 wrote to memory of 2204	2816	msedge.exe	86
PID 2816 wrote to memory of 2204	2816	msedge.exe	86
PID 2816 wrote to memory of 2204	2816	msedge.exe	86
PID 2816 wrote to memory of 2204	2816	msedge.exe	86
PID 2816 wrote to memory of 2204	2816	msedge.exe	86
PID 2816 wrote to memory of 2204	2816	msedge.exe	86
PID 2816 wrote to memory of 2204	2816	msedge.exe	86
PID 2816 wrote to memory of 2204	2816	msedge.exe	86
PID 2816 wrote to memory of 2204	2816	msedge.exe	86
PID 2816 wrote to memory of 2204	2816	msedge.exe	86
PID 2816 wrote to memory of 2204	2816	msedge.exe	86
PID 2816 wrote to memory of 2204	2816	msedge.exe	86
PID 2816 wrote to memory of 2204	2816	msedge.exe	86
PID 2816 wrote to memory of 2204	2816	msedge.exe	86
PID 2816 wrote to memory of 2204	2816	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/w9MR8K
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdce3446f8,0x7ffdce344708,0x7ffdce344718
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,1872599831913793397,3707444659571193495,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,1872599831913793397,3707444659571193495,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,1872599831913793397,3707444659571193495,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1872599831913793397,3707444659571193495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1872599831913793397,3707444659571193495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1872599831913793397,3707444659571193495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1872599831913793397,3707444659571193495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,1872599831913793397,3707444659571193495,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,1872599831913793397,3707444659571193495,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1872599831913793397,3707444659571193495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1872599831913793397,3707444659571193495,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1872599831913793397,3707444659571193495,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1872599831913793397,3707444659571193495,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:1996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
39b0e2a09fef0d9a53509a289c13b76a

SHA1
093bdd889df95a6db3aa64519627fb38066470a4

SHA256
c7c9666006ef66b2ce29b5ebfd4116bd21bb4b3d559849b931f819b4ebe7e95e

SHA512
27fac5d4ecbc4409e36d88676693fec6762a2683e64bcc1405e4be45e19141946c9add2b932d89c2c85f53021c699b5083fb01d6745e5a55856b74f9ae1ec77b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
856B

MD5
e0f548373f719213cd8313e3675be3cb

SHA1
dd4049db492739dc9f9190d1dfe0bd207e453fcb

SHA256
45c9cb932e3c6344832f1125bc29f5675e3ebd9d6a589a2d105f1d1cfc168e71

SHA512
f8e139b151ee4ef51330cf4598a68378e08ba10f880ca4ab3d06e170696f84c9c788cb61e972c8a6bfa354dda19ff7ae850fe5e60a5e28d9481cb5099488c0b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3edc639445e463bfa7be3aca5fb9685c

SHA1
926cbc8670e45f316f31c0728c0fd39c2db8c10b

SHA256
b171238b01e21d22eb9e22fd9ecb765f4d7f7dd6a2a023d91b1f11c123c4e255

SHA512
35586995f9ecaabc88affdd6554d39c452f08626b1979e2e2cbe56b3cb839d23ac9cf6c1cf245e47e5ff44627a1bde4bd97addd828c18e0faae714d3838139ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3f6ac03e9cc8b2fe7cf7c0818426cdbf

SHA1
2c0602ad3e9e2e0554401bd3ab61a8135edb0ade

SHA256
dbdf6ced8202b15ab0966871fa6436cc7bf0a06c4717620d3e54c6f8ac4ffea6

SHA512
c36d294bd4c676e3ef29bf6475b21d4ab3d197bca3ad6b0e7fb47186ea7dd7ffd08bea3a9b5e3898038b33b86f05d8611eb0e4314e718ee00b96493a55396d27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a529eb48-f38e-4815-9d21-39511df52036.tmp

Filesize
6KB

MD5
146ad12da4db484bd6e9a1b55edaacc3

SHA1
55158cc7e4fce7630bbf21ef88258de7a3fda800

SHA256
8823cb31224cc2c372b4280fac3c7161641fb1fcc5c0bf550089c77acda87ec3

SHA512
30252ab94d38ee3d34fed86967eaa3d1cd284cdd0e81ff595694829aada53fbbc1092efb7558430f6930e91cc7306f39d6d04e9f660d1c79412adaba29ff9552

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4f2b663f9dfd6388da6f6fac8ba760e6

SHA1
942ec212de816729b3d80d15b08cf16039a2f306

SHA256
ab62e3ffaaf1fdd6f2536e0a88b803b149df501c0fcc33fe9a20707514a7d3bb

SHA512
a9e1b0494403950e1d39118fed22e4e5d8207d10305111df7928032b26e9ebc4c44c18bc30535ed90bdef3a6e4f8b74ba2128c57627dd06b9794b65ab15c9085

Download Submit