Analysis
-
max time kernel
1149s -
max time network
1182s -
platform
windows11-21h2_x64 -
resource
win11-20241023-en -
resource tags
arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system -
submitted
13-12-2024 17:12
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://vo.la/PIreNL
Resource
win11-20241023-en
General
-
Target
https://vo.la/PIreNL
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4500 msedge.exe 4500 msedge.exe 4792 msedge.exe 4792 msedge.exe 3076 msedge.exe 3076 msedge.exe 3252 identity_helper.exe 3252 identity_helper.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe 4792 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4792 wrote to memory of 1372 4792 msedge.exe 78 PID 4792 wrote to memory of 1372 4792 msedge.exe 78 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4016 4792 msedge.exe 79 PID 4792 wrote to memory of 4500 4792 msedge.exe 80 PID 4792 wrote to memory of 4500 4792 msedge.exe 80 PID 4792 wrote to memory of 2292 4792 msedge.exe 81 PID 4792 wrote to memory of 2292 4792 msedge.exe 81 PID 4792 wrote to memory of 2292 4792 msedge.exe 81 PID 4792 wrote to memory of 2292 4792 msedge.exe 81 PID 4792 wrote to memory of 2292 4792 msedge.exe 81 PID 4792 wrote to memory of 2292 4792 msedge.exe 81 PID 4792 wrote to memory of 2292 4792 msedge.exe 81 PID 4792 wrote to memory of 2292 4792 msedge.exe 81 PID 4792 wrote to memory of 2292 4792 msedge.exe 81 PID 4792 wrote to memory of 2292 4792 msedge.exe 81 PID 4792 wrote to memory of 2292 4792 msedge.exe 81 PID 4792 wrote to memory of 2292 4792 msedge.exe 81 PID 4792 wrote to memory of 2292 4792 msedge.exe 81 PID 4792 wrote to memory of 2292 4792 msedge.exe 81 PID 4792 wrote to memory of 2292 4792 msedge.exe 81 PID 4792 wrote to memory of 2292 4792 msedge.exe 81 PID 4792 wrote to memory of 2292 4792 msedge.exe 81 PID 4792 wrote to memory of 2292 4792 msedge.exe 81 PID 4792 wrote to memory of 2292 4792 msedge.exe 81 PID 4792 wrote to memory of 2292 4792 msedge.exe 81
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://vo.la/PIreNL1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffed83e3cb8,0x7ffed83e3cc8,0x7ffed83e3cd82⤵PID:1372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,18240246114450261732,4550653940010841927,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1948 /prefetch:22⤵PID:4016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,18240246114450261732,4550653940010841927,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,18240246114450261732,4550653940010841927,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2580 /prefetch:82⤵PID:2292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,18240246114450261732,4550653940010841927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:2804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,18240246114450261732,4550653940010841927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵PID:1948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,18240246114450261732,4550653940010841927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3016 /prefetch:12⤵PID:3724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,18240246114450261732,4550653940010841927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:12⤵PID:4564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,18240246114450261732,4550653940010841927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:12⤵PID:2780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,18240246114450261732,4550653940010841927,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:12⤵PID:732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,18240246114450261732,4550653940010841927,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3292 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,18240246114450261732,4550653940010841927,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:12⤵PID:1844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,18240246114450261732,4550653940010841927,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,18240246114450261732,4550653940010841927,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3096 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3140
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1872
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2424
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD55431d6602455a6db6e087223dd47f600
SHA127255756dfecd4e0afe4f1185e7708a3d07dea6e
SHA2567502d9453168c86631fb40ec90567bf80404615d387afc7ec2beb7a075bcc763
SHA512868f6dcf32ef80459f3ea122b0d2c79191193b5885c86934a97bfec7e64250e10c23e4d00f34c6c2387a04a15f3f266af96e571bbe37077fb374d6d30f35b829
-
Filesize
152B
MD57bed1eca5620a49f52232fd55246d09a
SHA1e429d9d401099a1917a6fb31ab2cf65fcee22030
SHA25649c484f08c5e22ee6bec6d23681b26b0426ee37b54020f823a2908ab7d0d805e
SHA512afc8f0b5b95d593f863ad32186d1af4ca333710bcfba86416800e79528616e7b15f8813a20c2cfa9d13688c151bf8c85db454a9eb5c956d6e49db84b4b222ee8
-
Filesize
462B
MD526fb480a9fe9f187f0c683fecb47dfef
SHA143040363852a2935757bd6a956c9aae59df1368b
SHA2561fb19fdf2a463cb74a68ad6f5832efc41688169ae7c5f156a3c56d90cb8f75a5
SHA51207638cc8286cbef28a8b09d620938c330498ccb3caef5a058d318e4bd4f9f9e3d41bf5acdb79e50fe863d271cd673f7c58c0e8a71ee4a8e2c441dcaa6ef0d6f9
-
Filesize
5KB
MD5a6c8aa9639a9153d6c3dc3a7fbd765e2
SHA172c63d3d2308e9106ae016eda809aa7edcc00681
SHA256dff0ddfcc36c84fe4e14957f3d3ab61ccd8fd243a98cf6b06e299fb743087688
SHA51209199ff8a3ffb4ba571eef05a53e0dbb7e5fd0dab1c6370b38a9bd2d10da4f87d14944587671e8da9a8735e8761bf939634c90973d7b6e870df7caddabcca41e
-
Filesize
6KB
MD5e3252f4bf9b5be36a878b2ea10e26826
SHA1cba92707f0d621bcdd35049424f009d58227d787
SHA256f17861ee92f9e7f5f4d6790c3a72bb18ec77a67308d1568b953668070da4e987
SHA512b17f42225bcb6c56e169e2abe9e4646e4f183634c9cd27f8652a5f250760ab0261bede595a923ffe60c7475bc560f9bd2416b66564f2e5c3d998c9e60bb3390e
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD5e04f10dc6663df27f87854a0c110f71f
SHA1fe9fc28a14bee1726b4611fe1945b5009ffe4ecf
SHA256cf12bd5ec4b7c762179f00fcdd60e6abd05cfd19f410e49f71897bfa9b6b350a
SHA51216e8cc269d56a22ef1791d49343fcb917e987cf4222a687d945a722bb40db7fa185a8f3c929fb61996d2cbab18cf9b96b45ad2289ea480778860ac3823e97ee2