Analysis

  • max time kernel
    75s
  • max time network
    77s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    27/01/2025, 15:11

General

  • Target

    https://linkinformatica.urlsand.com/?u=https%3A%2F%2Fproadech.com%2FIDRxuj&e=7a5efa93&h=34775100&f=y&p=y

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://linkinformatica.urlsand.com/?u=https%3A%2F%2Fproadech.com%2FIDRxuj&e=7a5efa93&h=34775100&f=y&p=y
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2152
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffca7a33cb8,0x7ffca7a33cc8,0x7ffca7a33cd8
      2⤵
        PID:244
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1720,17221051371412271963,13667664052786670585,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1876 /prefetch:2
        2⤵
          PID:3640
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1720,17221051371412271963,13667664052786670585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3268
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1720,17221051371412271963,13667664052786670585,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2584 /prefetch:8
          2⤵
            PID:2744
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,17221051371412271963,13667664052786670585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
            2⤵
              PID:3116
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,17221051371412271963,13667664052786670585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
              2⤵
                PID:4744
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,17221051371412271963,13667664052786670585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4560 /prefetch:1
                2⤵
                  PID:4532
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,17221051371412271963,13667664052786670585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
                  2⤵
                    PID:1236
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1720,17221051371412271963,13667664052786670585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3328 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1320
                  • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1720,17221051371412271963,13667664052786670585,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1988
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,17221051371412271963,13667664052786670585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
                    2⤵
                      PID:5100
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,17221051371412271963,13667664052786670585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
                      2⤵
                        PID:1428
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,17221051371412271963,13667664052786670585,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
                        2⤵
                          PID:2212
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,17221051371412271963,13667664052786670585,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
                          2⤵
                            PID:3560
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1720,17221051371412271963,13667664052786670585,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
                            2⤵
                              PID:2692
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:4316
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:2416

                              Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      554d6d27186fa7d6762d95dde7a17584

                                      SHA1

                                      93ea7b20b8fae384cf0be0d65e4295097112fdca

                                      SHA256

                                      2fa6145571e1f1ece9850a1ac94661213d3e0d82f1cef7ac1286ff6b2c2017cb

                                      SHA512

                                      57d9008ccabc315bd0e829b19fe91e24bab6ef20bcfab651b937b0f38eec840b58d0aed092a3bbedd2d6a95d5c150372a1e51087572de55672172adc1fc468a7

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      a28bb0d36049e72d00393056dce10a26

                                      SHA1

                                      c753387b64cc15c0efc80084da393acdb4fc01d0

                                      SHA256

                                      684d797e28b7fd86af84bfb217d190e4f5e03d92092d988a6091b2c7bbbd67c1

                                      SHA512

                                      20940fee33aa2194c36a3db92d4fd314ce7eacc2aa745abec62aa031c2a53ba4ff89f2568626e7bd2536090175f8d045c3bb52c5faa5ecc8da8410ab5fc519f7

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      768B

                                      MD5

                                      9874a54ba8480598a130ac225f2614be

                                      SHA1

                                      863fa445c19fce606cfbae0484b20067f3311306

                                      SHA256

                                      062bc1416ecbd13ed2aed2f8a531f2145cdbad4118282165fa190524982dc7e8

                                      SHA512

                                      869163ddf34880371e4e5b2dcee5b3297d3b0d449359570e3e65e9fba590ee4b9e04d9be1e416589dc203213300eeacfae39cf05bbeb0c75b0e8ea46d68f87fd

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      1KB

                                      MD5

                                      dca432c925b37fc6b372fbe477559920

                                      SHA1

                                      71235494e94387d5e79c0def16db1af290151dc6

                                      SHA256

                                      25616ac0a5ef576e6ddcec323f4a5a6bff7e093704378c7f3d78c2507fea7f46

                                      SHA512

                                      e607168e0fc848cd21622a2018e17419aa3211b7c90eed66c83c3d7d5ad62436c56fbce47e657c0b4741519fb2cb188c197a7a29a0b45372b5c8eab9b44aac1e

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      5KB

                                      MD5

                                      332dfd90c9c9b437952826f6af64bb69

                                      SHA1

                                      71ad8346fb98c0f1d1d7c319a0694751283de569

                                      SHA256

                                      f9ef178db0c735f9d2ca4dc03184427b7cbfa292de9c58d1e51ca3c2930d22a8

                                      SHA512

                                      2282cd3afaccc2dc08d8a6d5bff97e9351db0f23e6ef9eac1da0add2f55a1690bb0a62d96d5af0784161972c4bbb9a20cd7b99e4eda26b3963b72be1d9e8e52c

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      c51d1af7739bd35f21aaf9cc7f2533bf

                                      SHA1

                                      1db404a3fcf646b1fa25abe88ced3fb6eeb2200e

                                      SHA256

                                      810a7edb539ab52a925cde74713c67e7cf12b61fc982f33fdde33bd8722fbd49

                                      SHA512

                                      1a340066e9f155ecb49df42bf39df2ecdab464c2ad6c02becf5c8d3e4e78c75093c989027ee5d5a0f9a074812781c9ee912a6e6f5965a58829ea6fdb21828636

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      9e86e227f794e3d1f6bcccdc9727b17c

                                      SHA1

                                      5110be9a589215be7286c2cbf66b388743de31a1

                                      SHA256

                                      68e1ca661d313a29af9f0c1dea52f7ded8b1d5ae3f499a6619b3b4477f84adce

                                      SHA512

                                      8efcad43c5f4173129bf60e2bfdf57201474d8b8ef14fafe8764f2825ccb6123234914414add16bbfcd1e41f41c945cc2b22bac580dfab69f9adaebe83c9ab32

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0b4725b0d32d30e48080091627234866cdac6cb8\index.txt

                                      Filesize

                                      238B

                                      MD5

                                      4c6ec624b15a1003452b5dddd852b8e4

                                      SHA1

                                      244af2a47d31ff86a25ee98aa0848d5ec292ae91

                                      SHA256

                                      fdfac456a04d9897c8b95c59fb2444d17cc57d4056995c293dd604717f1c48b8

                                      SHA512

                                      d7d4ae72134c37c0377a9c60dba1ec871d7057e3a81cb721eba0fdb08fe4fd0a29c782e82635a37de024e461b17a165cfea2e210e03252fe21f39a779a3c3620

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0b4725b0d32d30e48080091627234866cdac6cb8\index.txt

                                      Filesize

                                      122B

                                      MD5

                                      74d82d18b642206b4ada6b65815ed1a0

                                      SHA1

                                      8322bc9ca300fe5fc6a55dbd2f57de3f0924556d

                                      SHA256

                                      dd054c6f05a1c93b7054d5a3ba665fcdb99643b5f7f2fbb94c8333e45f282b5a

                                      SHA512

                                      97032afd269a32c3bc7910d6117aa607c0924aa3fc76e9d50500ead4fc2f39356837e37244a6788c3b7d146b6ffce84c88bf82493678a6748b13b7ce069db7d1

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\0b4725b0d32d30e48080091627234866cdac6cb8\index.txt~RFe57abe0.TMP

                                      Filesize

                                      143B

                                      MD5

                                      b320f2e4c78a9b03ebc8d8a8fd8dce9b

                                      SHA1

                                      b4770372c6c0ee66c6b087ad887bce9ffbcf43df

                                      SHA256

                                      adcc5d7b50f4af327d7c1b7ffc0f8524fdf8251ee34f52f6f60d4f178d57509b

                                      SHA512

                                      cff389e878269eedae4994ce76b124c9da58e4eaf99abee42b4f1d0c3a7acbef2ffd31eb0ffdf56f76507998edb5fe947919d3ff89afff8a55f4d3465e74e720

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                      Filesize

                                      72B

                                      MD5

                                      055a313f0a1af275bb71977b5dcb7036

                                      SHA1

                                      7e495fbbad41eddd0411ed95b3092830919e5643

                                      SHA256

                                      eee7d4704ca41e0578e77cdfa18ab14550bd6a8819028b9bc313dc3db93fe577

                                      SHA512

                                      2b9344a4453a21b77bca60ebceb7b5f8616ed47f9d6db40762415e9064492c5981f1316504a4bcd7181bcffce8ff30e9200d7b5c8ae0e8e12540c03005b10dbe

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57fa00.TMP

                                      Filesize

                                      48B

                                      MD5

                                      7539fedcc1a0111835044d09e4e29ca4

                                      SHA1

                                      4ed3f1860e27a238ca5a6398c8404af4e617b10e

                                      SHA256

                                      ae9cdf47860e956ea889b1ba3b11508e771fa028d4def0382b6818b52e9e6133

                                      SHA512

                                      d0eb125e962f812476f04a2c548f931f939768973f847438b6d85aceb58c3ca5ab67b05e68c5ede4fdfb3879ab6d073b6b7e48f29ebb0a08a6b245b4a48a7a74

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      537B

                                      MD5

                                      e7e33738429cafac536812743218c6a2

                                      SHA1

                                      5e133ec6ba62442addaeac1ef19cc704fc516707

                                      SHA256

                                      d4ea1fc698770d7620968816993ea5031291dfc3bef00e889e6e645643f80ca2

                                      SHA512

                                      708c59d6825848ba62739c08908c71e3c7927810f0a7884029252907ed6c868689b1b1293291fc0b6e01de54eb131c19e5f2295cb6c978cb1a5ff7d1da3c23e4

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cbcc.TMP

                                      Filesize

                                      204B

                                      MD5

                                      ce297f3e0c87c8c46d20d589ab184809

                                      SHA1

                                      9051498b5b541a2cde03964ccbff7bfea7766684

                                      SHA256

                                      ee0a41d403bf123de3d3147b4e4f56d3986a12596ac0b91dd4f6c224e5ab18c8

                                      SHA512

                                      5c521b278446b067cd3756297acebae15d2681a882c6a35969880d9ca8ffcd35d45756421a14713741902ce6f8dbaf3aeb6423b1f1b117e78781dab8e079a0da

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      46295cac801e5d4857d09837238a6394

                                      SHA1

                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                      SHA256

                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                      SHA512

                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      206702161f94c5cd39fadd03f4014d98

                                      SHA1

                                      bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                      SHA256

                                      1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                      SHA512

                                      0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      10KB

                                      MD5

                                      09750a507efe7edf7f9120664f462121

                                      SHA1

                                      ae83c05887aaff7e415095dfe9467cf16eab0f76

                                      SHA256

                                      335318a47f22cfeaa0b2938c2cfe61aa6796192194e1b7b7eaf3db5d6254e2de

                                      SHA512

                                      870417cdd25ae70d5181d01b3480b96a277fe68c3e52e2eb205b8776fb065c21f450df54f5dbb2220850c4d645d8ecba0e61c12ddfd1edc2b954afce5e2ef7c0