hxxps://1drv[.]ms/f/s!Aqv63XQZh7J7ev2dHee0DHE6GIg?e=HCj0fw

Analysis

max time kernel
900s
max time network
845s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
24-01-2025 21:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://1drv.ms/f/s!Aqv63XQZh7J7ev2dHee0DHE6GIg?e=HCj0fw

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4240	msedge.exe
4240	msedge.exe
2488	msedge.exe
2488	msedge.exe
4444	identity_helper.exe
4444	identity_helper.exe
4020	msedge.exe
4020	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 1112	2488	msedge.exe	77
PID 2488 wrote to memory of 1112	2488	msedge.exe	77
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 3508	2488	msedge.exe	78
PID 2488 wrote to memory of 4240	2488	msedge.exe	79
PID 2488 wrote to memory of 4240	2488	msedge.exe	79
PID 2488 wrote to memory of 1252	2488	msedge.exe	80
PID 2488 wrote to memory of 1252	2488	msedge.exe	80
PID 2488 wrote to memory of 1252	2488	msedge.exe	80
PID 2488 wrote to memory of 1252	2488	msedge.exe	80
PID 2488 wrote to memory of 1252	2488	msedge.exe	80
PID 2488 wrote to memory of 1252	2488	msedge.exe	80
PID 2488 wrote to memory of 1252	2488	msedge.exe	80
PID 2488 wrote to memory of 1252	2488	msedge.exe	80
PID 2488 wrote to memory of 1252	2488	msedge.exe	80
PID 2488 wrote to memory of 1252	2488	msedge.exe	80
PID 2488 wrote to memory of 1252	2488	msedge.exe	80
PID 2488 wrote to memory of 1252	2488	msedge.exe	80
PID 2488 wrote to memory of 1252	2488	msedge.exe	80
PID 2488 wrote to memory of 1252	2488	msedge.exe	80
PID 2488 wrote to memory of 1252	2488	msedge.exe	80
PID 2488 wrote to memory of 1252	2488	msedge.exe	80
PID 2488 wrote to memory of 1252	2488	msedge.exe	80
PID 2488 wrote to memory of 1252	2488	msedge.exe	80
PID 2488 wrote to memory of 1252	2488	msedge.exe	80
PID 2488 wrote to memory of 1252	2488	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://1drv.ms/f/s!Aqv63XQZh7J7ev2dHee0DHE6GIg?e=HCj0fw
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffeafa03cb8,0x7ffeafa03cc8,0x7ffeafa03cd8
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,12903612569247419073,4177611748689977148,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,12903612569247419073,4177611748689977148,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,12903612569247419073,4177611748689977148,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,12903612569247419073,4177611748689977148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,12903612569247419073,4177611748689977148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,12903612569247419073,4177611748689977148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,12903612569247419073,4177611748689977148,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,12903612569247419073,4177611748689977148,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,12903612569247419073,4177611748689977148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,12903612569247419073,4177611748689977148,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1988 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,12903612569247419073,4177611748689977148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,12903612569247419073,4177611748689977148,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,12903612569247419073,4177611748689977148,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3888 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fdee96b970080ef7f5bfa5964075575e

SHA1
2c821998dc2674d291bfa83a4df46814f0c29ab4

SHA256
a241023f360b300e56b2b0e1205b651e1244b222e1f55245ca2d06d3162a62f0

SHA512
20875c3002323f5a9b1b71917d6bd4e4c718c9ca325c90335bd475ddcb25eac94cb3f29795fa6476d6d6e757622b8b0577f008eec2c739c2eec71d2e8b372cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
46e6ad711a84b5dc7b30b75297d64875

SHA1
8ca343bfab1e2c04e67b9b16b8e06ba463b4f485

SHA256
77b51492a40a511e57e7a7ecf76715a2fd46533c0f0d0d5a758f0224e201c77f

SHA512
8472710b638b0aeee4678f41ed2dff72b39b929b2802716c0c9f96db24c63096b94c9969575e4698f16e412f82668b5c9b5cb747e8a2219429dbb476a31d297e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d21102fce8288cdc2a31e781974e6625

SHA1
2e0451a4110875eb09ff957c6135a24022e6cc2d

SHA256
2d14f3275b74017211f55c682c811f18fffe721da5cdf96682187a241e3baf6d

SHA512
669a46c3290ac074ac2e512a544d175f3ac06ace6d8e9bffbdd338e8bf415694b5aa0dd017248f79ba5956c853956995257355b0d5efdffb12e4028290dc5499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
875B

MD5
be6d4cbe53be0a1c6684caad692957c4

SHA1
027798cc4bf20bc31bd1e208431d4ae72cdca7ed

SHA256
ddc84ccf435a1470a95e2d30ceb5ab095b0fa3240513534920595dc5902d9425

SHA512
435562d5db3c6c08662f478c6b637f05731a64beff7c4980176d33243a988a3ea678ac0a4805b8bb12598ac8e92ba995639d4094c10df1120c88ecaacce2f899

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
561868cf328510a92e813cbff1be3a8c

SHA1
fa80a09de12b2ceed9a7525292af3bb3473f90ba

SHA256
06853fbf73b8d9a0b4cbaae851b1f79640e648ca275af8f66a1554a8782a8162

SHA512
fd0765fc6efde1f359bd62d4644a2d56a9189c136e660bd48c83c1ed187a6f97f5b148d3d9d5c9f1885a6515ba664332b982f63c1495d104636b0d87e13d7f3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7494da09c3fd6d34e1fa8da19d74d588

SHA1
1f379696d14a68fadda1f90bd0034dabdcc7244f

SHA256
8aaf2991891c06563d47ab206d4a2af28483478a2fc58a74dcabf76f2df1cce0

SHA512
461c6382472400d8dce74405c3522b1d003ce4b8094e4db9d8a1476f2d09cce41e72764cda6844b40ae0c399dcc807285d74058ddb300c6c50741a110b0ce07d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9c275d11feed8475107e59b90a5ee021

SHA1
3c6d6a0dffaf2d09f1486f35ced0ef4c1b907674

SHA256
689ed1adf29905d3d01ee721438436d8ab2165a33abc10103949fb86dd7978fd

SHA512
543dec1d7af267c7ae2579256c9b2eee92033a05f4e17e7c6a6c9149112cd10dd7a365a1f0992fa2b041d27e9e7a1b542708a70e737311dea98e28b407fb784e

Download Submit