hxxps://bit[.]ly/debrid-link

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2024 22:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bit.ly/debrid-link

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3784	msedge.exe
3784	msedge.exe
968	msedge.exe
968	msedge.exe
3640	identity_helper.exe
3640	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
968	msedge.exe
968	msedge.exe
968	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe
968	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 4844	968	msedge.exe	84
PID 968 wrote to memory of 4844	968	msedge.exe	84
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3436	968	msedge.exe	85
PID 968 wrote to memory of 3784	968	msedge.exe	86
PID 968 wrote to memory of 3784	968	msedge.exe	86
PID 968 wrote to memory of 4596	968	msedge.exe	87
PID 968 wrote to memory of 4596	968	msedge.exe	87
PID 968 wrote to memory of 4596	968	msedge.exe	87
PID 968 wrote to memory of 4596	968	msedge.exe	87
PID 968 wrote to memory of 4596	968	msedge.exe	87
PID 968 wrote to memory of 4596	968	msedge.exe	87
PID 968 wrote to memory of 4596	968	msedge.exe	87
PID 968 wrote to memory of 4596	968	msedge.exe	87
PID 968 wrote to memory of 4596	968	msedge.exe	87
PID 968 wrote to memory of 4596	968	msedge.exe	87
PID 968 wrote to memory of 4596	968	msedge.exe	87
PID 968 wrote to memory of 4596	968	msedge.exe	87
PID 968 wrote to memory of 4596	968	msedge.exe	87
PID 968 wrote to memory of 4596	968	msedge.exe	87
PID 968 wrote to memory of 4596	968	msedge.exe	87
PID 968 wrote to memory of 4596	968	msedge.exe	87
PID 968 wrote to memory of 4596	968	msedge.exe	87
PID 968 wrote to memory of 4596	968	msedge.exe	87
PID 968 wrote to memory of 4596	968	msedge.exe	87
PID 968 wrote to memory of 4596	968	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bit.ly/debrid-link
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc1cde46f8,0x7ffc1cde4708,0x7ffc1cde4718
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,602821152046882106,10698133041011956834,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,602821152046882106,10698133041011956834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,602821152046882106,10698133041011956834,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,602821152046882106,10698133041011956834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,602821152046882106,10698133041011956834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,602821152046882106,10698133041011956834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,602821152046882106,10698133041011956834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,602821152046882106,10698133041011956834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
3dfa9db623f32f8b83820b5e50d5a518

SHA1
201c7fb99865eeae8b65abd1363e94ee41be75f0

SHA256
7edea1bf040f263c33054ac0ebde52c9c9ce92f211e49fb8546f34b1ed1c2b6b

SHA512
d33892df05fca92eca0896bf1b7ef69016939c220b71a61698a1c47e668355f035b8e9770bdded3d3796ab1bfe2350971c3560f7444cec2b9b32056ae466ca3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
445B

MD5
24e0533ce7b5c9020d659f596a6c2fba

SHA1
bc9260a7db83efe252265c466daa6120873f91a5

SHA256
18e9b60dccd42fd7515ee5fc5f1315aee3d09c33ee548be914b3d098d1a440ff

SHA512
143c2bf2903f80049b6f450776200469c56d791a2b1669f52d5e2dc953f9e5a65f2ed106c9e4d0569086a99167e3af8619295bc2cca2e8d329cf67588bbdfb93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f45364ad28a424ddc13acc077081429f

SHA1
f5dfd35b6177b94cd9c4220f12ef8215a2355798

SHA256
afb3cfbde466756a62c04e337a0ae22ef2908e0a0ef4ba65b855e108d3b6932c

SHA512
0500c2f5c3c79416fb53504182aa848d15f1f3d3b68e34a7a570ee8ecc01d527bb4a81a0b97717afd15a861bb89d50472211c1e448da188d96eca86ef7846da2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
16e7052a1d8b7d765bcca0b373c7130c

SHA1
355d62ef112aa024bd8222723a6b97e2b9881f2d

SHA256
83a9cbb7367ca26591868f503b2a0ae9f62737acaee955d6db3c9942cf0c4c0f

SHA512
326e16c4772f5f484fda82df0bd6a5fd840d35227b3d92eff2fb8e481024a41a9b64d5549f5c7b54e60e1550e5d41f07c6257bee341f17e1f9a4662347c5e5cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1976ba2e40272796d304995c52bdbf91

SHA1
a54e9d9041bf2c57d6d1d7e3ece233ff37d52b6c

SHA256
12242238ba3a022d99f1a77120c6a741ce8af28f07fbc66d9278c715440ececc

SHA512
2957e1f88993aa6fe1bf4b744d279ba977c0e0a42c13d6b80a03490bba4febb4b595245326a7d2bc5bce2f6344bd47a4a5e94c7c7027c7f9d8d7e7dd24547245

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d6a32764689d50770d6399af24778863

SHA1
9e2bccd1acc01f6547e77c66770897fb77de88b2

SHA256
69fc962ca886ffc664f4324d67d63cc3e6528545943885054aaa588a0adf4717

SHA512
b3bddeefb342d66c5027089b41769a564286c5ca4021b04e5e19106817521269f38ecba9b0309052c68c400945df4b6025df24ebd8b8171f7288f7360567a7da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ef4051014f205a0db034e3542bcaf0c3

SHA1
e189ee9f65d3828a2eeba0710d27f098a3bb6fdc

SHA256
9481b4b203bdfc12770758651949792c34f2cc4a5eba65e56f6ee73d30018e76

SHA512
a71f2a8b388921dbf16ec18573ffe57d5567c3ddbdec292b09a70c5899db7d8692e45bc8da4264ec6687beee1e4f6e772a1a39dd9beba644f6b42a3329a3593d

Download Submit