hxxp://linasti[.]blogspot[.]com

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 03:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://linasti.blogspot.com

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3528	msedge.exe
3528	msedge.exe
3044	msedge.exe
3044	msedge.exe
4324	identity_helper.exe
4324	identity_helper.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe
3044	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 3616	3044	msedge.exe	83
PID 3044 wrote to memory of 3616	3044	msedge.exe	83
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 1000	3044	msedge.exe	84
PID 3044 wrote to memory of 3528	3044	msedge.exe	85
PID 3044 wrote to memory of 3528	3044	msedge.exe	85
PID 3044 wrote to memory of 4732	3044	msedge.exe	86
PID 3044 wrote to memory of 4732	3044	msedge.exe	86
PID 3044 wrote to memory of 4732	3044	msedge.exe	86
PID 3044 wrote to memory of 4732	3044	msedge.exe	86
PID 3044 wrote to memory of 4732	3044	msedge.exe	86
PID 3044 wrote to memory of 4732	3044	msedge.exe	86
PID 3044 wrote to memory of 4732	3044	msedge.exe	86
PID 3044 wrote to memory of 4732	3044	msedge.exe	86
PID 3044 wrote to memory of 4732	3044	msedge.exe	86
PID 3044 wrote to memory of 4732	3044	msedge.exe	86
PID 3044 wrote to memory of 4732	3044	msedge.exe	86
PID 3044 wrote to memory of 4732	3044	msedge.exe	86
PID 3044 wrote to memory of 4732	3044	msedge.exe	86
PID 3044 wrote to memory of 4732	3044	msedge.exe	86
PID 3044 wrote to memory of 4732	3044	msedge.exe	86
PID 3044 wrote to memory of 4732	3044	msedge.exe	86
PID 3044 wrote to memory of 4732	3044	msedge.exe	86
PID 3044 wrote to memory of 4732	3044	msedge.exe	86
PID 3044 wrote to memory of 4732	3044	msedge.exe	86
PID 3044 wrote to memory of 4732	3044	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://linasti.blogspot.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f57d46f8,0x7ff9f57d4708,0x7ff9f57d4718
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,960629123041723511,11515420327503885349,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,960629123041723511,11515420327503885349,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,960629123041723511,11515420327503885349,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,960629123041723511,11515420327503885349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,960629123041723511,11515420327503885349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,960629123041723511,11515420327503885349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,960629123041723511,11515420327503885349,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,960629123041723511,11515420327503885349,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,960629123041723511,11515420327503885349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,960629123041723511,11515420327503885349,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,960629123041723511,11515420327503885349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,960629123041723511,11515420327503885349,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,960629123041723511,11515420327503885349,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4680 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
778b61d49dfe8e3f880e1b09b968d2e1

SHA1
423841b190a6e99043c20cb4b906c28653c7c70c

SHA256
9fce554881b0d252cdfd1deccd2c9dea4efb1e8af7f0d81932cd2de9ac7085e3

SHA512
668c9f8dfcf073e48f135ca432cc09a11d1bb028759da75a554960879168293068cf640bd5ff048f9f0a2f7b582e463dc5aff83aa5f214199298cc7f55e2ca6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1a71e00aa265af28a13e6b5ef9b6aab5

SHA1
76b00c2ab6fea0bc83c65613619cad856306cce0

SHA256
19db08b956e23e05dc3380f5cccb142ca495c33f2e8719dab0c9be9594cc288e

SHA512
6806694d1881ce2a28581aedfd91c4e2243e58716cfdfae027840149babd98bb97c6bb00265032cd607bd686e8e2133ce268899b1b2900431f216b016dcccc80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0253b1358bb976ad978dd10fb485ed60

SHA1
006766ea4549ff068ceb691470254e414ae981b3

SHA256
236cc215e34575f46f19edbb9a2e4bc1a54055e651ca1b1ffe2385dce49a4880

SHA512
3050899db5af5c8c97cc932c94cc5e31dc7f097e4ceaac38573f4e4be1425881fa2e7906eb9fce14203909381eda9a2fb98a990e4059fe012237170093f82a61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6673f4a1fcd2771656b178fe8e8e953d

SHA1
0f2c520962fce6886ffa06cf7c46c581646ea10b

SHA256
ef345d7f82a62ef5ba52fb4a0c2f5b11dff04c99d5a520a58436260c046dcf7f

SHA512
3a4e42d95df7f987aca2c1e6f2f27a1f7324b1ebfaf4ad6284ebefc7e1490278ef9664ec985e7b8e58cc82c7cbf54a75bf552a5a44b229625d65c022771ad8a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1d619ce4893e245ae8de236d55ed4315

SHA1
4aab5be7ef35f38170acf96e69ebfa4616d523b4

SHA256
2783cb696dcbbb3533e8b867e0dce03f7e3d11a288ba70e73c52291c89862c15

SHA512
a5599b3dae65c1867fd66d57db2a554b549375da435215856b94178e8c7d688752d7272aadc42273c9bc0597c46355fea85ccb6f60a48c2040830195ac484e85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a856c20c67064629cae1aeaf719aa542

SHA1
9235572cce306249a2b92e77e49e2298aac58831

SHA256
1a10e34c4d557441d49b1b7bee689ac3f812ba89af6bcb5c323ffdb48d4b9cec

SHA512
9709f35da141476ae43d550bf3512ee7f9a67ce813e003ba67357cd229772d37144c774f9e80b25552a17468effeb3fa5610dc673635fb7190ef44481e9a22a1

Download Submit