hxxps://u[.]to/nCKHIQ

Analysis

max time kernel
81s
max time network
88s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
26-01-2025 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://u.to/nCKHIQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe
3448	msedge.exe
3448	msedge.exe
1720	identity_helper.exe
1720	identity_helper.exe
2168	msedge.exe
2168	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 236	3448	msedge.exe	77
PID 3448 wrote to memory of 236	3448	msedge.exe	77
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 4256	3448	msedge.exe	78
PID 3448 wrote to memory of 2492	3448	msedge.exe	79
PID 3448 wrote to memory of 2492	3448	msedge.exe	79
PID 3448 wrote to memory of 1108	3448	msedge.exe	80
PID 3448 wrote to memory of 1108	3448	msedge.exe	80
PID 3448 wrote to memory of 1108	3448	msedge.exe	80
PID 3448 wrote to memory of 1108	3448	msedge.exe	80
PID 3448 wrote to memory of 1108	3448	msedge.exe	80
PID 3448 wrote to memory of 1108	3448	msedge.exe	80
PID 3448 wrote to memory of 1108	3448	msedge.exe	80
PID 3448 wrote to memory of 1108	3448	msedge.exe	80
PID 3448 wrote to memory of 1108	3448	msedge.exe	80
PID 3448 wrote to memory of 1108	3448	msedge.exe	80
PID 3448 wrote to memory of 1108	3448	msedge.exe	80
PID 3448 wrote to memory of 1108	3448	msedge.exe	80
PID 3448 wrote to memory of 1108	3448	msedge.exe	80
PID 3448 wrote to memory of 1108	3448	msedge.exe	80
PID 3448 wrote to memory of 1108	3448	msedge.exe	80
PID 3448 wrote to memory of 1108	3448	msedge.exe	80
PID 3448 wrote to memory of 1108	3448	msedge.exe	80
PID 3448 wrote to memory of 1108	3448	msedge.exe	80
PID 3448 wrote to memory of 1108	3448	msedge.exe	80
PID 3448 wrote to memory of 1108	3448	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://u.to/nCKHIQ
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffeda43cb8,0x7fffeda43cc8,0x7fffeda43cd8
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,2716375602473987518,1522946561551919959,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1820 /prefetch:2
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,2716375602473987518,1522946561551919959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,2716375602473987518,1522946561551919959,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2716375602473987518,1522946561551919959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2716375602473987518,1522946561551919959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2716375602473987518,1522946561551919959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2716375602473987518,1522946561551919959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,2716375602473987518,1522946561551919959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,2716375602473987518,1522946561551919959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2716375602473987518,1522946561551919959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2716375602473987518,1522946561551919959,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2716375602473987518,1522946561551919959,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2716375602473987518,1522946561551919959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2716375602473987518,1522946561551919959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2552 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,2716375602473987518,1522946561551919959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:3580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c0a1774f8079fe496e694f35dfdcf8bc

SHA1
da3b4b9fca9a3f81b6be5b0cd6dd700603d448d3

SHA256
c041da0b90a5343ede7364ccf0428852103832c4efa8065a0cd1e8ce1ff181cb

SHA512
60d9e87f8383fe3afa2c8935f0e5a842624bb24b03b2d8057e0da342b08df18cf70bf55e41fa3ae54f73bc40a274cf6393d79ae01f6a1784273a25fa2761728b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e11c77d0fa99af6b1b282a22dcb1cf4a

SHA1
2593a41a6a63143d837700d01aa27b1817d17a4d

SHA256
d96f9bfcc81ba66db49a3385266a631899a919ed802835e6fb6b9f7759476ea0

SHA512
c8f69f503ab070a758e8e3ae57945c0172ead1894fdbfa2d853e5bb976ed3817ecc8f188eefd5092481effd4ef650788c8ff9a8d9a5ee4526f090952d7c859f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
368cee01167583c114bf27a280a4f1a9

SHA1
e943cadb709b69cf425ef26119750df4016c67e5

SHA256
2b402040f8ebffe02673a253750143d51c1806d477f8ba317fd945d9bb463eb1

SHA512
e3a76ff617b26beea301557d4c02eaee95c567a28b12f8728829f20624c4a9b18ed195fcf758ff2ba1ceb9951418866197a0dee441be4e9aefba1a20f81b01b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
827dcde26f234322f7f6819b7b4305f6

SHA1
61029e7c51f63a5aa58502d8b96549ca9946bdf4

SHA256
e661fccc3203168544269de633e457820b87de4d597a2fc5b31113fdcd77bc35

SHA512
395a50b794fac5387fe79c99635b0ca6bd235bda3a541ad2be5ed029e30ef9c60a4e2e0c30e419e0a8630e1ce888e259d87f358af38d36b5d8c0f1c3ce122584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0834e9e3012830db95edf7e97db541e8

SHA1
2dca54a1b1fbbb0b3d15a2c088a5bf25937a421b

SHA256
cd4ba8c0e694cb285e141e48437d58558dc420a9c2f0879878175ecd60284bba

SHA512
7a4eceaf6e5ebc48abcba6533083343b0c545df7cb00e892f8ee310e45199afac801e194c57f5b6c62f3ad79ed5f50310b3e703cd4262a75696aec1da5f5fb8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e3dfd9708bd999c0b97626ae53490d11

SHA1
d9d7eca9142074164d1646a3d811ee473893c32e

SHA256
5b8bfcdb58c8d10dffc7ca12a1ca8bf09cb1d38fb00829592c88675a6502a1b1

SHA512
ed6bd564d2774d034b7c87732039c271f82aff47d54b88d8522aaf7f06506d50a598aab03228738e7e566020545a1adc928862ce66cc02e6ca57c7c117a07b7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a2613f34165f819ea2b10fd42cdec0e6

SHA1
9d88c10c330d8927715a68789612ef3ec18f9860

SHA256
f14dcbb9318fdb4f2dc9f7704421e5c74df891d3be4a72f003df50eda2c226af

SHA512
ea15fdacab084305529c62d573df42f92c214e2a806fda54e8d86af06521a222aba3824944c5cc431bf3bdcf4d12aaab759174e9d31e5f434b4c3ab24a77868b

Download Submit