hxxps://www[.]mediafire[.]com/folder/5k5fk96z7alyr/NÐµw

Analysis

max time kernel
0s
max time network
4s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
08-09-2024 07:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.mediafire.com/folder/5k5fk96z7alyr/NÐµw

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 424 wrote to memory of 5520	424	msedge.exe	80
PID 424 wrote to memory of 5520	424	msedge.exe	80
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 5304	424	msedge.exe	81
PID 424 wrote to memory of 4160	424	msedge.exe	82
PID 424 wrote to memory of 4160	424	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/folder/5k5fk96z7alyr/NÐµw
1⤵
- Suspicious use of WriteProcessMemory
PID:424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa15333cb8,0x7ffa15333cc8,0x7ffa15333cd8
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1844,6950151664424198507,14585801670786019172,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1856 /prefetch:2
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1844,6950151664424198507,14585801670786019172,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1844,6950151664424198507,14585801670786019172,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,6950151664424198507,14585801670786019172,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1844,6950151664424198507,14585801670786019172,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9828ffacf3deee7f4c1300366ec22fab

SHA1
9aff54b57502b0fc2be1b0b4b3380256fb785602

SHA256
a3d21f0fb6563a5c9d0f7a6e9c125ec3faaa86ff43f37cb85a8778abc87950f7

SHA512
2e73ea4d2fcd7c8d52487816110f5f4a808ed636ae87dd119702d1cd1ae315cbb25c8094a9dddf18f07472b4deaed3e7e26c9b499334b26bdb70d4fa7f84168d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6fdbe80e9fe20761b59e8f32398f4b14

SHA1
049b1f0c6fc4e93a4ba6b3c992f1d6cecf3ada1f

SHA256
b7f0d9ece2307bdc4f05a2d814c947451b007067ff8af977f77f06c3d5706942

SHA512
cf25c7fd0d6eccc46e7b58949c16d17ebeefb7edd6c76aa62f7ab5da52d1c6fc88bde620be40396d336789bd0d62b2162209a947d7ab69389e8c03682e880234

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3f1b9453d02606935067aea27ec65398

SHA1
2d37b1e9c57be29f860a6384cda02c50e71946ff

SHA256
b2a2d48cc8b4a1ef126631c139c2d1e51ecb4562adda121ea2a957d7edeae087

SHA512
af698437b19259b813028339d8875160b61958e3f487e3921cf2b5e45a2f048277166aecaef9f28135e33d8a34e832792b562d99a5d036f7151649d494936af5

Download Submit