hxxps://u[.]to/aBUXIQ

Analysis

max time kernel
134s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 20:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://u.to/aBUXIQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1788	msedge.exe
1788	msedge.exe
1088	msedge.exe
1088	msedge.exe
3476	identity_helper.exe
3476	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 1496	1088	msedge.exe	86
PID 1088 wrote to memory of 1496	1088	msedge.exe	86
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1188	1088	msedge.exe	87
PID 1088 wrote to memory of 1788	1088	msedge.exe	88
PID 1088 wrote to memory of 1788	1088	msedge.exe	88
PID 1088 wrote to memory of 3156	1088	msedge.exe	89
PID 1088 wrote to memory of 3156	1088	msedge.exe	89
PID 1088 wrote to memory of 3156	1088	msedge.exe	89
PID 1088 wrote to memory of 3156	1088	msedge.exe	89
PID 1088 wrote to memory of 3156	1088	msedge.exe	89
PID 1088 wrote to memory of 3156	1088	msedge.exe	89
PID 1088 wrote to memory of 3156	1088	msedge.exe	89
PID 1088 wrote to memory of 3156	1088	msedge.exe	89
PID 1088 wrote to memory of 3156	1088	msedge.exe	89
PID 1088 wrote to memory of 3156	1088	msedge.exe	89
PID 1088 wrote to memory of 3156	1088	msedge.exe	89
PID 1088 wrote to memory of 3156	1088	msedge.exe	89
PID 1088 wrote to memory of 3156	1088	msedge.exe	89
PID 1088 wrote to memory of 3156	1088	msedge.exe	89
PID 1088 wrote to memory of 3156	1088	msedge.exe	89
PID 1088 wrote to memory of 3156	1088	msedge.exe	89
PID 1088 wrote to memory of 3156	1088	msedge.exe	89
PID 1088 wrote to memory of 3156	1088	msedge.exe	89
PID 1088 wrote to memory of 3156	1088	msedge.exe	89
PID 1088 wrote to memory of 3156	1088	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://u.to/aBUXIQ
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcff346f8,0x7ffdcff34708,0x7ffdcff34718
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,13586385297686399269,16332698181355886369,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,13586385297686399269,16332698181355886369,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,13586385297686399269,16332698181355886369,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1872 /prefetch:8
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13586385297686399269,16332698181355886369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13586385297686399269,16332698181355886369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13586385297686399269,16332698181355886369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,13586385297686399269,16332698181355886369,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,13586385297686399269,16332698181355886369,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13586385297686399269,16332698181355886369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13586385297686399269,16332698181355886369,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13586385297686399269,16332698181355886369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13586385297686399269,16332698181355886369,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:3460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
0fcc786e82bfd86ee1bc8dfd1530a13b

SHA1
1d4885b27c4e173751035cdaa9953586917d4f0d

SHA256
44975b0f5f0275cc07cf8c3aafe912c0149a7a5dedc3bbe5359c1ba043dc3c7f

SHA512
8243f0eaad6eec285321b51b80aca89fa6f8984a5a4755418102bffe88c057eae3eb7e69795e31a20f1530c1eedbfb8afa379f2c5beb27c5915a62cd70b6d47b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
784B

MD5
0b8d28ba7cdf51a77145319dec013b52

SHA1
8e8b94d53b481407945be7b710c4af96fe040142

SHA256
455d108ebfd087d1bea7f48e30286fd2cddf190fb8c581579d81c4fd377190a5

SHA512
3ab3f6e8b66041f079db6c5ee6be447d2f5a78e2df9542c8f0c03af11f3f66dd490503397f1812092cbc0400fb7c46826469822dfcbe9f98e08a52d4a6c20aa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
727618552a2f8e36a9a00e39bb977b83

SHA1
223fefece7217f0fa6c0e2dccc0acc438a463215

SHA256
61080ce0bca2ffc7d60110df5337680c6eb68730015261560e579ccb95df8d4d

SHA512
1e4a4c35f1bf1d19d5acacf870c6c8cc0d5d62162b6e47afe14263818dbf509ac8ca93167ae6b16907c5e5379fb255455c77d7a28e86918e15924a4988d0725d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c5df3776b76987a11b839798d71ec49c

SHA1
87bb3cca0c2895badddd5078a8e854a7bf056f33

SHA256
1da89db24207cbc9e21fdccc4167a35dc46bbe7ecad24675137049659527395d

SHA512
1a07c60214af71f0b3e81aa732e091c3c4a8c406814f93f3622fc94c6d5e349c79c7ed0a22a24ac2920b38922f8c5eed36ab5db75707f69258ef34aba92c650c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f77f36349a45a3761e831c713737018c

SHA1
edc4322e4cd921af7320dff651280da0630a0aa7

SHA256
968289ff7a95ada895f968c0aeee42e59a2d25157362f0efad14c7f926f64240

SHA512
963ca270661372b1a65960d14a3930752225e43dbc1daa380e5f8f11530554d2c37a9e2a3862ca36b43c990914e54741fc5e3e87cf9450216c62e7c0bbe4f95d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d4f43dd2ce4f31a5d2843fe85896974c

SHA1
77baec78e96015f79e579db50871c541046a4b2a

SHA256
6d6178dd9bdd98812c588d78ba4d6bc8c29e2de2883a487a0243b739c95a735e

SHA512
f2557e966473d75e2ae557f26e2b94d53d96590603361dac9ad6a4ff0f64f2b396f6d4716f67419513f289d2c172fbc7a683a8be1954e98edc5f4d5637c61d94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f2b1086afc8330568d470193e6299b94

SHA1
cc6a0584e5ec103b601873e525cf2d447b881a44

SHA256
05e1a3e01e672603832061ca93d8213d47302269a2758b8b5163a465b8cd71b4

SHA512
61b2e6fe2dc852cd108d0a15d45b8533d21ad30c14ca84fa39ee433a31758a3d1d1e6d4f3a57f838cc15fe308cc0d9b27d2bac4355f75601ceb03770d7422350

Download Submit