Analysis
-
max time kernel
23s -
max time network
22s -
platform
windows11-21h2_x64 -
resource
win11-20241007-fr -
resource tags
arch:x64arch:x86image:win11-20241007-frlocale:fr-fros:windows11-21h2-x64systemwindows -
submitted
23-12-2024 19:17
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://u.to/aBUXIQ
Resource
win11-20241007-fr
General
-
Target
http://u.to/aBUXIQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1104 msedge.exe 1104 msedge.exe 5112 msedge.exe 5112 msedge.exe 2472 identity_helper.exe 2472 identity_helper.exe 4240 msedge.exe 4240 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe 5112 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5112 wrote to memory of 4904 5112 msedge.exe 77 PID 5112 wrote to memory of 4904 5112 msedge.exe 77 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 2764 5112 msedge.exe 78 PID 5112 wrote to memory of 1104 5112 msedge.exe 79 PID 5112 wrote to memory of 1104 5112 msedge.exe 79 PID 5112 wrote to memory of 2408 5112 msedge.exe 80 PID 5112 wrote to memory of 2408 5112 msedge.exe 80 PID 5112 wrote to memory of 2408 5112 msedge.exe 80 PID 5112 wrote to memory of 2408 5112 msedge.exe 80 PID 5112 wrote to memory of 2408 5112 msedge.exe 80 PID 5112 wrote to memory of 2408 5112 msedge.exe 80 PID 5112 wrote to memory of 2408 5112 msedge.exe 80 PID 5112 wrote to memory of 2408 5112 msedge.exe 80 PID 5112 wrote to memory of 2408 5112 msedge.exe 80 PID 5112 wrote to memory of 2408 5112 msedge.exe 80 PID 5112 wrote to memory of 2408 5112 msedge.exe 80 PID 5112 wrote to memory of 2408 5112 msedge.exe 80 PID 5112 wrote to memory of 2408 5112 msedge.exe 80 PID 5112 wrote to memory of 2408 5112 msedge.exe 80 PID 5112 wrote to memory of 2408 5112 msedge.exe 80 PID 5112 wrote to memory of 2408 5112 msedge.exe 80 PID 5112 wrote to memory of 2408 5112 msedge.exe 80 PID 5112 wrote to memory of 2408 5112 msedge.exe 80 PID 5112 wrote to memory of 2408 5112 msedge.exe 80 PID 5112 wrote to memory of 2408 5112 msedge.exe 80
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://u.to/aBUXIQ1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc13c03cb8,0x7ffc13c03cc8,0x7ffc13c03cd82⤵PID:4904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1792,14748743443144998757,5340013918953502100,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1784 /prefetch:22⤵PID:2764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1792,14748743443144998757,5340013918953502100,131072 --lang=fr --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1792,14748743443144998757,5340013918953502100,131072 --lang=fr --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:82⤵PID:2408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,14748743443144998757,5340013918953502100,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:3344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,14748743443144998757,5340013918953502100,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:12⤵PID:3568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,14748743443144998757,5340013918953502100,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:12⤵PID:1424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1792,14748743443144998757,5340013918953502100,131072 --lang=fr --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1792,14748743443144998757,5340013918953502100,131072 --lang=fr --service-sandbox-type=none --mojo-platform-channel-handle=5760 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,14748743443144998757,5340013918953502100,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:12⤵PID:2952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,14748743443144998757,5340013918953502100,131072 --lang=fr --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:12⤵PID:3892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,14748743443144998757,5340013918953502100,131072 --lang=fr --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:2992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1792,14748743443144998757,5340013918953502100,131072 --lang=fr --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:12⤵PID:5036
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1596
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1004
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5eb33ff8cdeb93a300f1e581ada64808d
SHA16e62770d605862afad2c23a327c0d94ecb45a9ba
SHA256ab889bbec97293cc5d6253785ce8cde83d3a1fb98ce3811c44f6d3b70d81db61
SHA5120fe90799ece398068cff78e8408a1fba6ee302756e0fc4f2c8da057e6832827125d3f16136a9ae789d607c23da4e3457d6c85065de5f0271852b8274b7d213f0
-
Filesize
152B
MD54c1a24fa898d2a98b540b20272c8e47b
SHA13218bff9ce95b52842fa1b8bd00be073177141ef
SHA256bbcc378fcbf64580e7a48b4e7ca9be57fa0a1f2e747f488325685bdb18d73a95
SHA512e61f196e7f1c9a5fe249abe9b11eea770fb2f4babc61f60b12c71f43e6fe9354cf14869daf46abc2c2655bce180252acd43c10562a2dcd31fa7d90d33253820e
-
Filesize
152B
MD5f1d2c7fd2ca29bb77a5da2d1847fbb92
SHA1840de2cf36c22ba10ac96f90890b6a12a56526c6
SHA25658d0f80310f4a84f687c5ce0adaa982eb42fe4480510399fa2ae975d40bb8bc5
SHA512ede1fafea2404f16948fe0b5ea5161ccee3ee6e40c55ff98c337eac981a6776b9c73dc030a5c59e4347aec91259f497539206e71949c33adcecbf2c846709e14
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize432B
MD5581ef8ad2036a6ec1a726ea0dc82cad2
SHA19f52501fa1a95c81c824e0c1e7d7de85fa8d60b3
SHA256c2f8a28e1b72f53911e75961829e32c866d9ee8c9596dcb4942a765b9806b800
SHA512450eec336993765368f63ccf5697b0f82a5e2606fabbf0afaccfab8209886228d280b933888bf6745137fcd4d6978279f20d3219ad5fb58810567509fac891df
-
Filesize
5KB
MD580a3ee32f8e4f3d4f463982a0d57bb54
SHA15127ca229d6e841fe0687c1ff72df7d4b94f79f9
SHA256971b616cad9e41cd0fa24fb79a03abe296faba42f61aafb7cf066965f875af1c
SHA51223495595c2285d95534272bb913e1595a977bdf5be75d00ce10ac3611ba65148b41acc7631c681bb78ef62e9e2c23ff97c389c0c8f5c1b86dacbbd382c36c920
-
Filesize
6KB
MD5b0ffce34a30e635abb985922dc97740c
SHA1d33e8bed44fc181c5ee3cc4f07f57e404369e1bc
SHA2568bf60d3b1b0acb78439cecfc1a2f8a70763ff2ba2db27f3ae2817b32015d88b1
SHA5122b62bdd82843298cfbb8a091c6b0e4ddf472b3a2174667e83f26985db7075b811d6e0ffa2a1d303b78760140a3e3d2cf78269fb8b69778d7de2d41e169844b97
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\000002.dbtmp
Filesize16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23