Analysis
-
max time kernel
145s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 18:50
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://trimmer.to/EfUba
Resource
win10v2004-20241007-en
General
-
Target
https://trimmer.to/EfUba
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2988 msedge.exe 2988 msedge.exe 4368 msedge.exe 4368 msedge.exe 4820 identity_helper.exe 4820 identity_helper.exe 360 msedge.exe 360 msedge.exe 360 msedge.exe 360 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4368 wrote to memory of 5028 4368 msedge.exe 83 PID 4368 wrote to memory of 5028 4368 msedge.exe 83 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 4696 4368 msedge.exe 84 PID 4368 wrote to memory of 2988 4368 msedge.exe 85 PID 4368 wrote to memory of 2988 4368 msedge.exe 85 PID 4368 wrote to memory of 2380 4368 msedge.exe 86 PID 4368 wrote to memory of 2380 4368 msedge.exe 86 PID 4368 wrote to memory of 2380 4368 msedge.exe 86 PID 4368 wrote to memory of 2380 4368 msedge.exe 86 PID 4368 wrote to memory of 2380 4368 msedge.exe 86 PID 4368 wrote to memory of 2380 4368 msedge.exe 86 PID 4368 wrote to memory of 2380 4368 msedge.exe 86 PID 4368 wrote to memory of 2380 4368 msedge.exe 86 PID 4368 wrote to memory of 2380 4368 msedge.exe 86 PID 4368 wrote to memory of 2380 4368 msedge.exe 86 PID 4368 wrote to memory of 2380 4368 msedge.exe 86 PID 4368 wrote to memory of 2380 4368 msedge.exe 86 PID 4368 wrote to memory of 2380 4368 msedge.exe 86 PID 4368 wrote to memory of 2380 4368 msedge.exe 86 PID 4368 wrote to memory of 2380 4368 msedge.exe 86 PID 4368 wrote to memory of 2380 4368 msedge.exe 86 PID 4368 wrote to memory of 2380 4368 msedge.exe 86 PID 4368 wrote to memory of 2380 4368 msedge.exe 86 PID 4368 wrote to memory of 2380 4368 msedge.exe 86 PID 4368 wrote to memory of 2380 4368 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://trimmer.to/EfUba1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9eb5a46f8,0x7ff9eb5a4708,0x7ff9eb5a47182⤵PID:5028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,11030236813035333519,2177440861221221124,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:22⤵PID:4696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,11030236813035333519,2177440861221221124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,11030236813035333519,2177440861221221124,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:82⤵PID:2380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,11030236813035333519,2177440861221221124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:1300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,11030236813035333519,2177440861221221124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵PID:5072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,11030236813035333519,2177440861221221124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:12⤵PID:3532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,11030236813035333519,2177440861221221124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:82⤵PID:1784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,11030236813035333519,2177440861221221124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,11030236813035333519,2177440861221221124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:12⤵PID:3908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,11030236813035333519,2177440861221221124,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:12⤵PID:3208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,11030236813035333519,2177440861221221124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:12⤵PID:4532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,11030236813035333519,2177440861221221124,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:12⤵PID:5008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,11030236813035333519,2177440861221221124,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4660 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:360
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2044
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:540
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD56960857d16aadfa79d36df8ebbf0e423
SHA1e1db43bd478274366621a8c6497e270d46c6ed4f
SHA256f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32
SHA5126deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe
-
Filesize
152B
MD5f426165d1e5f7df1b7a3758c306cd4ae
SHA159ef728fbbb5c4197600f61daec48556fec651c1
SHA256b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841
SHA5128d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize192B
MD5debd0719f89f42471eceaf2447eea765
SHA1b59e945c129b8acbf3d420b96d99b370f4a42e62
SHA256230ce0623ebe221717dbad7408af442e4a33f98f17580ea4facc703342d6b0c8
SHA512bbfb9d6d19129b17dc89287266da2330e2207ca9be54537fab6e6ca5c563970836461078151de0f5bb547fbeb4f334ad760bef0fd96afca7000b9849951f550c
-
Filesize
758B
MD596e922948a140808c40b6fbd96bb0094
SHA18affb79864e0b3cbd119486d1260d374b632d272
SHA256a8f70877095581e9789f63377e712d68c34d3a66c6768106beee211edf685ccf
SHA512228bf0d3bf6727e80fca1bcb1b628a6a5aa19489af3c8cf288a6b135397140d8e10b9294ea5912672633706103f581ce20b2a6662f6b8f601d43b9b2e9dc3ba2
-
Filesize
5KB
MD5246a7eacff1d0d088e66e2306882d326
SHA1f2c2eae4ccf5423a3b15a1ebc1f3f9000d7e9718
SHA25615a25623344d4d9c2775673c4ed541b940e82035fa226ba5e456fae96d53d729
SHA51236bddb9ac56f49e1984f6c80cef9d3c6e3dcd7d5d2ccfb8cfaddc594684fb4e27e067b96c697023e2992208d189b4a3794b96f9334d2e5c6bff731078a644989
-
Filesize
6KB
MD5d3f1f50ca6e06f32cc838c9774573db2
SHA1637439c530408e0611e115b34be6de41e8c1f3e0
SHA2564027538b048e3f8809b66ea50d4b702f2bd5cf3295e39293531979d24eb03529
SHA5123bcfbc20e7ad460b193c3a6b3dfb95d25272542155f248acc57ce0bc6b435d8ed51d754c1b76fac1973b3f8976e1b6c79a4b88b4fc733e48c0149de1576aa415
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD511d95ee243eaa38c105b68cb75f2bc2b
SHA1a6e4dfa3752dfaa71ef6de18f5a529eaa80da127
SHA2569da3a1148cecffc83fd5f95f46a5a8e8f4bab0a0e375c916c5df7fda452ae501
SHA512908d63d543a0223fbe36306581806d24ca3701dd52e4f310fc2acbba2babb681a77a84efe85a3f6f0a249dcd88c3ec271bee1de04e8fd2c8c828b6ae01fa58d3
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84