Analysis
-
max time kernel
145s -
max time network
141s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
16-11-2024 17:54
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://mega.nz/file/EF5CxB7Q#Ivrmu9gJBFm8mqpFHiacc3n75gtayXptVrTm4k8PbtY
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
https://mega.nz/file/EF5CxB7Q#Ivrmu9gJBFm8mqpFHiacc3n75gtayXptVrTm4k8PbtY
Resource
win11-20241007-en
General
-
Target
https://mega.nz/file/EF5CxB7Q#Ivrmu9gJBFm8mqpFHiacc3n75gtayXptVrTm4k8PbtY
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1432 msedge.exe 1432 msedge.exe 1112 msedge.exe 1112 msedge.exe 4564 msedge.exe 4564 msedge.exe 3248 identity_helper.exe 3248 identity_helper.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe 1112 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1112 wrote to memory of 3648 1112 msedge.exe 79 PID 1112 wrote to memory of 3648 1112 msedge.exe 79 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 568 1112 msedge.exe 80 PID 1112 wrote to memory of 1432 1112 msedge.exe 81 PID 1112 wrote to memory of 1432 1112 msedge.exe 81 PID 1112 wrote to memory of 1072 1112 msedge.exe 82 PID 1112 wrote to memory of 1072 1112 msedge.exe 82 PID 1112 wrote to memory of 1072 1112 msedge.exe 82 PID 1112 wrote to memory of 1072 1112 msedge.exe 82 PID 1112 wrote to memory of 1072 1112 msedge.exe 82 PID 1112 wrote to memory of 1072 1112 msedge.exe 82 PID 1112 wrote to memory of 1072 1112 msedge.exe 82 PID 1112 wrote to memory of 1072 1112 msedge.exe 82 PID 1112 wrote to memory of 1072 1112 msedge.exe 82 PID 1112 wrote to memory of 1072 1112 msedge.exe 82 PID 1112 wrote to memory of 1072 1112 msedge.exe 82 PID 1112 wrote to memory of 1072 1112 msedge.exe 82 PID 1112 wrote to memory of 1072 1112 msedge.exe 82 PID 1112 wrote to memory of 1072 1112 msedge.exe 82 PID 1112 wrote to memory of 1072 1112 msedge.exe 82 PID 1112 wrote to memory of 1072 1112 msedge.exe 82 PID 1112 wrote to memory of 1072 1112 msedge.exe 82 PID 1112 wrote to memory of 1072 1112 msedge.exe 82 PID 1112 wrote to memory of 1072 1112 msedge.exe 82 PID 1112 wrote to memory of 1072 1112 msedge.exe 82
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://mega.nz/file/EF5CxB7Q#Ivrmu9gJBFm8mqpFHiacc3n75gtayXptVrTm4k8PbtY1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffda74f3cb8,0x7ffda74f3cc8,0x7ffda74f3cd82⤵PID:3648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,11457705018241553996,13850757187141756302,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:22⤵PID:568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,11457705018241553996,13850757187141756302,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,11457705018241553996,13850757187141756302,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2560 /prefetch:82⤵PID:1072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,11457705018241553996,13850757187141756302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:3320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,11457705018241553996,13850757187141756302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:1324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,11457705018241553996,13850757187141756302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:12⤵PID:2996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,11457705018241553996,13850757187141756302,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:12⤵PID:2228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,11457705018241553996,13850757187141756302,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3384 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,11457705018241553996,13850757187141756302,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:12⤵PID:3712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,11457705018241553996,13850757187141756302,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:12⤵PID:776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,11457705018241553996,13850757187141756302,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,11457705018241553996,13850757187141756302,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5144 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2388
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2040
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3372
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5554d6d27186fa7d6762d95dde7a17584
SHA193ea7b20b8fae384cf0be0d65e4295097112fdca
SHA2562fa6145571e1f1ece9850a1ac94661213d3e0d82f1cef7ac1286ff6b2c2017cb
SHA51257d9008ccabc315bd0e829b19fe91e24bab6ef20bcfab651b937b0f38eec840b58d0aed092a3bbedd2d6a95d5c150372a1e51087572de55672172adc1fc468a7
-
Filesize
152B
MD5a28bb0d36049e72d00393056dce10a26
SHA1c753387b64cc15c0efc80084da393acdb4fc01d0
SHA256684d797e28b7fd86af84bfb217d190e4f5e03d92092d988a6091b2c7bbbd67c1
SHA51220940fee33aa2194c36a3db92d4fd314ce7eacc2aa745abec62aa031c2a53ba4ff89f2568626e7bd2536090175f8d045c3bb52c5faa5ecc8da8410ab5fc519f7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize72B
MD5b1c009fc25769e1fa85ca695d1de4571
SHA17e4c86ba8c9cc25bcc13a7d48b80990ce11a21d0
SHA256be8d50f643a574f2a33d52deec05b3360daf8382ab1e285e549e10b716b002c4
SHA51247ca06d21d21e6ae31019ed9662b0e1dd0c541f8e774a1184e1d4b03c717d0d1dc95a10689ab76a36e6ab6b476a0f489f9351b02a3071c51d3f1ad2496d02a2a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
188B
MD5008114e1a1a614b35e8a7515da0f3783
SHA13c390d38126c7328a8d7e4a72d5848ac9f96549b
SHA2567301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18
SHA512a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b
-
Filesize
5KB
MD52b693f4aa796df2495764c0a203f9b95
SHA104d246dfe6cd2376c4c56996dac0d77d58fb6ff4
SHA256c470d8443a62cd746f18a3dd0b2424b395cf7a31fe384d38e4b102e373c8dc0c
SHA512f844cd17d7935350c0439d07d350df5d2a143787cb2a810b13e1e2f14bff6f70a2a678090ef342925678d757af14701837e036405c606d7092f615676a9dd09d
-
Filesize
6KB
MD520cc3c465fef7d067bf0d7488305ce3b
SHA1f7bee74ccf71d6ddf733cb7122d13b6efcd10668
SHA256274a7b4a202c68494fee11d2aa78eee1d825ac0b761d70a69b8ef4916e48ad61
SHA5120558f5a4fc839d3a38525bae9f95b2b243c52d3d4645be0ead0c11191f7d3c04b7ca67ccc1fd829bcd0e06f15240dbff61b9c7fdc6d72d9d3f70cece7961e0f4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD5f6b37f52e13a74f1a43cf5cb10f1f152
SHA1a71c9c1bbe1f20fec4d88fd5e4e840dc09eac3a7
SHA2568cc75c3d522c6c090e5a6d972e1a4bbdd723c481a7daaba0084560ffa610fd3e
SHA512cbfc0d94a7fcb959ec38251bbebb46ac167cdcc988be75902b969edcec66c6ba9826b11b00830d40d2180df6d2727c04d8db3b28a8ef09d74a462f30642b7e11
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58054a.TMP
Filesize48B
MD5fe3ba392ee6f269ec61e168cac21eb97
SHA1b8d65a93e3bbdcdef393469b2100fa4b96ed04f5
SHA256b351d45e0a7e846cf5c726db75d98547f12f01e30ac17bbabdaffd9735a23d95
SHA5129f7e5a7b126807615a15ee88901dfe9f980c45f85de62b86ee51c201fb1ab5bf9b75742f037c1429f447f980b6b4df3518ea37aa08ecb264d7feff5623c54f5b
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD5c8994e434ac56aaea0e78a106a52c490
SHA1c8d0733e4ce819f71962adaa99b39e01fc8b7e7c
SHA256de3f082e5b1549c4c727319a5a8a91baaec4222f06065cc4f34e6ecb601b3242
SHA5122a962962f83013490b80139467a898a8e397b4536f64868d7eeb5e8ca80427b7b97055a5d7e59ea48ebed532038fbcabe2bb415e47222153e94bc0c828217a5e