Analysis
-
max time kernel
1798s -
max time network
1685s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
10-11-2024 00:17
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://wetransfer.com/downloads/113ab84daa43d1cc2d520a298ac5034e20241109233046/9bae79?t_exp=1731454246&t_lsid=fdbced13-ee3a-4104-89d3-6487ab17e361&t_network=link&t_rid=ZW1haWx8NjcyZmYwYTZiNjM1NTFjNmY2ODJlOTgy&t_s=download_link&t_ts=1731195062
Resource
win11-20241007-en
General
Malware Config
Signatures
-
A potential corporate email address has been identified in the URL: [email protected]
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exepid Process 1272 msedge.exe 1272 msedge.exe 4900 msedge.exe 4900 msedge.exe 1016 msedge.exe 1016 msedge.exe 1112 identity_helper.exe 1112 identity_helper.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid Process 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid Process 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
Processes:
msedge.exepid Process 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe 4900 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid Process procid_target PID 4900 wrote to memory of 2212 4900 msedge.exe 77 PID 4900 wrote to memory of 2212 4900 msedge.exe 77 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1080 4900 msedge.exe 78 PID 4900 wrote to memory of 1272 4900 msedge.exe 79 PID 4900 wrote to memory of 1272 4900 msedge.exe 79 PID 4900 wrote to memory of 3568 4900 msedge.exe 80 PID 4900 wrote to memory of 3568 4900 msedge.exe 80 PID 4900 wrote to memory of 3568 4900 msedge.exe 80 PID 4900 wrote to memory of 3568 4900 msedge.exe 80 PID 4900 wrote to memory of 3568 4900 msedge.exe 80 PID 4900 wrote to memory of 3568 4900 msedge.exe 80 PID 4900 wrote to memory of 3568 4900 msedge.exe 80 PID 4900 wrote to memory of 3568 4900 msedge.exe 80 PID 4900 wrote to memory of 3568 4900 msedge.exe 80 PID 4900 wrote to memory of 3568 4900 msedge.exe 80 PID 4900 wrote to memory of 3568 4900 msedge.exe 80 PID 4900 wrote to memory of 3568 4900 msedge.exe 80 PID 4900 wrote to memory of 3568 4900 msedge.exe 80 PID 4900 wrote to memory of 3568 4900 msedge.exe 80 PID 4900 wrote to memory of 3568 4900 msedge.exe 80 PID 4900 wrote to memory of 3568 4900 msedge.exe 80 PID 4900 wrote to memory of 3568 4900 msedge.exe 80 PID 4900 wrote to memory of 3568 4900 msedge.exe 80 PID 4900 wrote to memory of 3568 4900 msedge.exe 80 PID 4900 wrote to memory of 3568 4900 msedge.exe 80
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://wetransfer.com/downloads/113ab84daa43d1cc2d520a298ac5034e20241109233046/9bae79?t_exp=1731454246&t_lsid=fdbced13-ee3a-4104-89d3-6487ab17e361&t_network=link&t_rid=ZW1haWx8NjcyZmYwYTZiNjM1NTFjNmY2ODJlOTgy&t_s=download_link&t_ts=17311950621⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdb03c3cb8,0x7ffdb03c3cc8,0x7ffdb03c3cd82⤵PID:2212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,2811625401083154979,12588097828094774551,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:22⤵PID:1080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,2811625401083154979,12588097828094774551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,2811625401083154979,12588097828094774551,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:82⤵PID:3568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,2811625401083154979,12588097828094774551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:3728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,2811625401083154979,12588097828094774551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,2811625401083154979,12588097828094774551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4596 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,2811625401083154979,12588097828094774551,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,2811625401083154979,12588097828094774551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:12⤵PID:4368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,2811625401083154979,12588097828094774551,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:12⤵PID:4628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,2811625401083154979,12588097828094774551,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:4688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,2811625401083154979,12588097828094774551,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:12⤵PID:4984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,2811625401083154979,12588097828094774551,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3680 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1996
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3860
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4528
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5aad1d98ca9748cc4c31aa3b5abfe0fed
SHA132e8d4d9447b13bc00ec3eb15a88c55c29489495
SHA2562a07cac05ffcf140a9ad32e58ef51b32ecccf1e3ab5ef4e656770df813a8944e
SHA512150ebf7e37d20f88b21ab7ea0793afe1d40b00611ed36f0cf1ac1371b656d26f11b08a84dbb958891c79776fae04c9c616e45e2e211d292988a5709857a3bf72
-
Filesize
152B
MD5cb557349d7af9d6754aed39b4ace5bee
SHA104de2ac30defbb36508a41872ddb475effe2d793
SHA256cfc24ed7d1c2e2c6585f53db7b39aa2447bf9212487b0a3c8c2a7d8e7e5572ee
SHA512f0cf51f42d975d720d613d09f201435bf98c6283ae5bc033207f4ada93b15e49743a235a1cfb1b761bde268e2f7f8561aa57619b99bff67a36820bc1a4d0ec4a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize840B
MD595d0a2e75e43de9f36ed663bd0621772
SHA1241ad935c5f86d3ecb39a788ce74079db64b11fe
SHA256a0bd859e51b4abe56af40c7751d444c8f9b4f447303b36645bb4372e3645cf8f
SHA5126b507fe8cec6f701a3385e809d301edcd793f9cdc5b70c32562998d094e1f64ec1b8a2b15bcb03fcffa5bfe5af161712e1a1452f084b8f378a09f7c087b534ae
-
Filesize
1KB
MD58bcf22a91570d9b7c6bc24b516d665ea
SHA1410749362952f774e83df4c9090df9177ec2457a
SHA25647a2d7fc922f12e07095c53748325cd3058ac27878941940e07e10010fa4505d
SHA512ee1cce726e2169b3685b8db6e28b64c1d7093baff61bf6ff335520f04ee7d6c0f13bfa04a58ae2dd41d2cb37a805c296d38d495eab32700dac7fa8e856e05273
-
Filesize
5KB
MD517a5d6e196cc5941bd3f7f0395ad2ce9
SHA107aaa62b37199c419342ff47f45fc5a8db09b9df
SHA256c91d59d219d1fc4346542d9accb62849f2fbb18722d9aeddd0471671d1e02d09
SHA51251036c6bbf60677068d62eaa8d22bdf9d5391cd8789a2afd8a2560303fde897a3bbc7916f581f09fb8a1221f40df5d67427a454f611deebb378c199f77222dae
-
Filesize
6KB
MD5e4c6934dca101ecc49eac1e08a8f1c25
SHA1d1eb869658048b2bbdc3d98f380a2fa3e048b4be
SHA256af8112f1256871e4250dfb0f2d80607cd0153a8b92826edb78139a3ed7e51872
SHA512968d952d27ecf20fd64dddfe48127d9acab6f89d368418336b74a57e7fedffe1fe4865ec9b647587bb9e683e0be033bc608dcc0493011e5b1a640937fbaed991
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD5b2f4cdda3cc6422d927765ab65b6fd75
SHA147f6a050a96b2e25f3fc73f637232deda72a225a
SHA256b5dcbfe3dbd4c0012d02908f0d0554c0b53a77ac5c540023bc034e1d6d1517e0
SHA5123b21dbf920a6f2a4c3201f5f740adcda279b56a0c78094c747d5ac6db784858a3922d785604b8433a8d1b64794c172e5cb58df749e1172821450872b4e761624
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e