hxxps://is[.]gd/zCtajb

Analysis

max time kernel
148s
max time network
141s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
12-12-2024 17:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://is.gd/zCtajb

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3528	msedge.exe
3528	msedge.exe
3424	msedge.exe
3424	msedge.exe
4284	identity_helper.exe
4284	identity_helper.exe
1504	msedge.exe
1504	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 1708	3424	msedge.exe	77
PID 3424 wrote to memory of 1708	3424	msedge.exe	77
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 560	3424	msedge.exe	78
PID 3424 wrote to memory of 3528	3424	msedge.exe	79
PID 3424 wrote to memory of 3528	3424	msedge.exe	79
PID 3424 wrote to memory of 1340	3424	msedge.exe	80
PID 3424 wrote to memory of 1340	3424	msedge.exe	80
PID 3424 wrote to memory of 1340	3424	msedge.exe	80
PID 3424 wrote to memory of 1340	3424	msedge.exe	80
PID 3424 wrote to memory of 1340	3424	msedge.exe	80
PID 3424 wrote to memory of 1340	3424	msedge.exe	80
PID 3424 wrote to memory of 1340	3424	msedge.exe	80
PID 3424 wrote to memory of 1340	3424	msedge.exe	80
PID 3424 wrote to memory of 1340	3424	msedge.exe	80
PID 3424 wrote to memory of 1340	3424	msedge.exe	80
PID 3424 wrote to memory of 1340	3424	msedge.exe	80
PID 3424 wrote to memory of 1340	3424	msedge.exe	80
PID 3424 wrote to memory of 1340	3424	msedge.exe	80
PID 3424 wrote to memory of 1340	3424	msedge.exe	80
PID 3424 wrote to memory of 1340	3424	msedge.exe	80
PID 3424 wrote to memory of 1340	3424	msedge.exe	80
PID 3424 wrote to memory of 1340	3424	msedge.exe	80
PID 3424 wrote to memory of 1340	3424	msedge.exe	80
PID 3424 wrote to memory of 1340	3424	msedge.exe	80
PID 3424 wrote to memory of 1340	3424	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://is.gd/zCtajb
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa04453cb8,0x7ffa04453cc8,0x7ffa04453cd8
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,10317889533899737353,13999442961142665110,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,10317889533899737353,13999442961142665110,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,10317889533899737353,13999442961142665110,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,10317889533899737353,13999442961142665110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,10317889533899737353,13999442961142665110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,10317889533899737353,13999442961142665110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,10317889533899737353,13999442961142665110,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,10317889533899737353,13999442961142665110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,10317889533899737353,13999442961142665110,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,10317889533899737353,13999442961142665110,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4704 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,10317889533899737353,13999442961142665110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,10317889533899737353,13999442961142665110,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,10317889533899737353,13999442961142665110,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3420 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e1544690d41d950f9c1358068301cfb5

SHA1
ae3ff81363fcbe33c419e49cabef61fb6837bffa

SHA256
53d69c9cc3c8aaf2c8b58ea6a2aa47c49c9ec11167dd9414cd9f4192f9978724

SHA512
1e4f1fe2877f4f947d33490e65898752488e48de34d61e197e4448127d6b1926888de80b62349d5a88b96140eed0a5b952ef4dd7ca318689f76e12630c9029da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9314124f4f0ad9f845a0d7906fd8dfd8

SHA1
0d4f67fb1a11453551514f230941bdd7ef95693c

SHA256
cbd58fa358e4b1851c3da2d279023c29eba66fb4d438c6e87e7ce5169ffb910e

SHA512
87b9060ca4942974bd8f95b8998df7b2702a3f4aba88c53b2e3423a532a75407070368f813a5bbc0251864b4eae47e015274a839999514386d23c8a526d05d85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
f475ab059591fb28d363f471a787cd27

SHA1
3f1bed31c113e8e259c18ccd795cd0aaf1f855a3

SHA256
fc4940f8729e913f6a4656faec11696eea4441539ce7e5fadbcc1ff531a547c1

SHA512
36c94c2927b4aba4b6c79e7419c4f354835701f8d8688b6f6170c25cbd87e0a0485d1b1185bf47337bfeb4b1c6c0ee0f191650f7fefbb3083df7d798bda1e11f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
689B

MD5
16ce4b4858f484f6192b7623e2a4ca5d

SHA1
a00af78e72aac86c40dd2e397506a534255e19cb

SHA256
d00b86d9f41d8ec0b7cbc2e83b1b98c457d4261619729db32ccd65940fb1a8c1

SHA512
17de4bb8da37902d3e8499c00209487ce360b332577b906b7ad53569d823cd70aaea86fdd10286ae82f82bdd0316526e75c89e85789f6a253d13129933c28d6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
30b38d644e56a2b26631af4776ac9e4d

SHA1
470fa3f43db30c133b80aae1a2d0cd9e8d757427

SHA256
af0d6f0dc4cb037d45e0dc61b6647e66a080530676a7baeee10e599a819628f5

SHA512
37ffad1b32d430c4a24e56fce65170c105dd04b852b76981f4c717958b4946866c53f0290cc12288855b98004453960b84eee5178b1f553030ba69dc93f1d4eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
405e2897819f008018deba5381d441ca

SHA1
0d5ecf755b419c9ce66a7f38d42ff3228b3c6ff3

SHA256
eec2ae938647cc52ca781839c7a8bdfc589cd5756acc03b0097d01816b3f78cb

SHA512
d47bc301e492a11435439176bffba6c07baeecbb0ec7b98260480156f44f4174e8bf227599c73f2c17b6025cf23df61429c8bce0942e8da0594b08618d3fe895

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
2fbfeefe311d04bdfa512c06f8d259ea

SHA1
432b55f256c2838cd47105755193c5da57f2d9e1

SHA256
192b0ce18ada3f09d96093cfcd0aceb1b4f851a7b8ef8aca7ba9d5f43fc68bc8

SHA512
03116b37261cbdca6598f159509e489b950d3c716f2b46fd8363e737c5eacc60a98578aa9ac38d95eff88fe226dcbe27cb4e2dc22e60f9bc4d9803d1d103797c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583b3f.TMP

Filesize
371B

MD5
2c1907330417ba8cb27d1c5a7cccba96

SHA1
c855b35f6eb221edbba0b894653a62e5c9ee7a14

SHA256
ab156ca88e61174ae78b6415f2cf183c862416866d632c4d2cedd103edd57048

SHA512
13f74b05ab17492630c49e63744272da54a4ff5194e43d5dc41103489607a5e86de960ffa9699c3661158877b0bcb54275ed987759c2a9b5f98a523253efe3c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
981271f8bf349d1b9a294acdf208139d

SHA1
538fe2974271aaf80e782bb15b6afc80d4c30742

SHA256
7a7e6795d482792d4512ba2e7ffbf655275c546b635329400fdb6b0ee03a1a92

SHA512
ef0ff7cea4a71eaafe13ccc24e9151fb758ae95e58061bb9f6cb88fdcefde4d0087261b860871b9c9ff313c2b987b2cf9c9bcaec673f3dcd4cfb549dac3d5837

Download Submit