hxxps://go[.]microsoft[.]com/fwlink/?linkid=866263

Analysis

max time kernel
44s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 23:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://go.microsoft.com/fwlink/?linkid=866263

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3380	msedge.exe
3380	msedge.exe
1256	msedge.exe
1256	msedge.exe
1340	identity_helper.exe
1340	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 4508	1256	msedge.exe	84
PID 1256 wrote to memory of 4508	1256	msedge.exe	84
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 1848	1256	msedge.exe	85
PID 1256 wrote to memory of 3380	1256	msedge.exe	86
PID 1256 wrote to memory of 3380	1256	msedge.exe	86
PID 1256 wrote to memory of 4016	1256	msedge.exe	87
PID 1256 wrote to memory of 4016	1256	msedge.exe	87
PID 1256 wrote to memory of 4016	1256	msedge.exe	87
PID 1256 wrote to memory of 4016	1256	msedge.exe	87
PID 1256 wrote to memory of 4016	1256	msedge.exe	87
PID 1256 wrote to memory of 4016	1256	msedge.exe	87
PID 1256 wrote to memory of 4016	1256	msedge.exe	87
PID 1256 wrote to memory of 4016	1256	msedge.exe	87
PID 1256 wrote to memory of 4016	1256	msedge.exe	87
PID 1256 wrote to memory of 4016	1256	msedge.exe	87
PID 1256 wrote to memory of 4016	1256	msedge.exe	87
PID 1256 wrote to memory of 4016	1256	msedge.exe	87
PID 1256 wrote to memory of 4016	1256	msedge.exe	87
PID 1256 wrote to memory of 4016	1256	msedge.exe	87
PID 1256 wrote to memory of 4016	1256	msedge.exe	87
PID 1256 wrote to memory of 4016	1256	msedge.exe	87
PID 1256 wrote to memory of 4016	1256	msedge.exe	87
PID 1256 wrote to memory of 4016	1256	msedge.exe	87
PID 1256 wrote to memory of 4016	1256	msedge.exe	87
PID 1256 wrote to memory of 4016	1256	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=866263
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd83a46f8,0x7ffcd83a4708,0x7ffcd83a4718
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,6197719912313150184,13107018724749007808,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,6197719912313150184,13107018724749007808,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,6197719912313150184,13107018724749007808,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6197719912313150184,13107018724749007808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6197719912313150184,13107018724749007808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6197719912313150184,13107018724749007808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6197719912313150184,13107018724749007808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,6197719912313150184,13107018724749007808,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3312 /prefetch:8
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,6197719912313150184,13107018724749007808,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6197719912313150184,13107018724749007808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6197719912313150184,13107018724749007808,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1848 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6197719912313150184,13107018724749007808,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,6197719912313150184,13107018724749007808,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:2448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
1a016cc956fb05a9c6a8c03560142c00

SHA1
eaa89b366baf130a18a34798fd862b2f5b3bfadb

SHA256
cb8ac95603da51ea6191f71bc7d6ea1f39e00f1c718a80f14317be559c608cae

SHA512
948b3eb63d844a04cf0467737d81654d4a76e446729c4d4ff8dbaafe6e6a9994a61c1908ca178ed45c1aad72d6dc3d18c222b4e2e285dcd8f2e1e28b035ccd8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
735059a9325afba04fb7cce506f9c132

SHA1
eaa5e17a682c65421ed455010a3606d42e31bbad

SHA256
1303e4c590376dbf558799a87be2df417fb6856e3226add37fd48a8c584ae6e2

SHA512
81cd6311de585417740ba631553676cb995118c6f12cfb1ca8bf52a3f9567363a7063f5241f2bb755c1254e24f377b68fd57b972d539e10d7b796c888ea2ec07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
812544f0451d5e7d234039adbcab84cf

SHA1
56ab12c633c6bea48088005aebb7f5b7821123f3

SHA256
f3d646dff1f3a603520e5d81b9cc2ea74565bc56657eac8b74a1fd51e70261dd

SHA512
bfbad55b17a80d08b3fa3126a43d5f303cdd43680d06258b1f9fda93d5cb8b141537da169f0a586b021c4148e1f0175e5487f20c180bd76eacc0cc40accc04d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
3a27b067e6ecb450bfdc0e00b8fdcd56

SHA1
06305a2885b94582d76bad4b888dff06edb9621b

SHA256
a000a2adae23ff49f987d661b66a3ab0fd55c17eb9ad550ee3be978d2428e43c

SHA512
ede96e9a8183318f921ad6dcabe2a7f6302b5387ff404101a00d08b810913055a7e6d11ba0ff768f4e1b6fc515caa320d92600318ec9a6978b0acc335a36e8a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
ae2f63847ae003172981d3f3247464e2

SHA1
c69d0f033f2235509a746680db383fede93da30b

SHA256
c8e68d218786c63942209d7252676325de55364d265a1afc3cc3e4f87c13581b

SHA512
f2a168e65f2ad99f83e70e2bb5263b9855eeca235f6771e167f07c8b21c126d24bcd0a641ad5e59414939308b1b1de3212caad4d28a8ec10109b268fc21cfa66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
202c6133e5c1273c58b0660dd9a5475c

SHA1
8d46a19c0c58c3cd7d34a73d25e078e486b40c1c

SHA256
689b96ccd14b768916a8ec26eef1ce1e99e0d0e8b99fb4c6d8d3413a4932402e

SHA512
a9ff2fd0189c85a0b2f6684fed0e84369dc15142ab03a15f2c9dde63ca23be34f39f1b01cd1e5af5166f8a82ecb24c53eb7d11c00b12b8cc1bf786793bc2f4aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e88b.TMP

Filesize
874B

MD5
75bd2e75572c9a3ddaa00dc3e543b941

SHA1
f83c8f86dd5500950a3ac0000c7d44843cb681d1

SHA256
9fe501b1a96ab341304ac229bb8c5bf2da610c1df64692f9ad6e8e3bac8ec200

SHA512
aec1fe5afe6b2f1e8444000cb8a21e5dc09e305a8a48c41d491dcb40f4a5cd602abddfcf13ad22ca6eb348d88b98e6df0b486647254f74b717360d9469522a9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ff94f0ce1c97320a692f38da8a16ee46

SHA1
5f723c7f5de37d9588f1a9c2dc1922783c87d071

SHA256
381284333dbb13a11fafcf67cc04139334189c4ac3f69d1f5504227c3b212849

SHA512
028aebfe5b3d463c83ae73686b5cb4de742cff5d9c1828a7d1314eab86e29c364b202d406996dbf25f216fbe341de28cba63dc3920138099777052f9b4d3bd36

Download Submit