hxxps://rb[.]gy/9u9m78

Analysis

max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
09/03/2025, 09:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://rb.gy/9u9m78

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4084	msedge.exe
4084	msedge.exe
3056	msedge.exe
3056	msedge.exe
5020	msedge.exe
5020	msedge.exe
3428	identity_helper.exe
3428	identity_helper.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe
2848	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2108	3056	msedge.exe	80
PID 3056 wrote to memory of 2108	3056	msedge.exe	80
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 1108	3056	msedge.exe	81
PID 3056 wrote to memory of 4084	3056	msedge.exe	82
PID 3056 wrote to memory of 4084	3056	msedge.exe	82
PID 3056 wrote to memory of 1324	3056	msedge.exe	83
PID 3056 wrote to memory of 1324	3056	msedge.exe	83
PID 3056 wrote to memory of 1324	3056	msedge.exe	83
PID 3056 wrote to memory of 1324	3056	msedge.exe	83
PID 3056 wrote to memory of 1324	3056	msedge.exe	83
PID 3056 wrote to memory of 1324	3056	msedge.exe	83
PID 3056 wrote to memory of 1324	3056	msedge.exe	83
PID 3056 wrote to memory of 1324	3056	msedge.exe	83
PID 3056 wrote to memory of 1324	3056	msedge.exe	83
PID 3056 wrote to memory of 1324	3056	msedge.exe	83
PID 3056 wrote to memory of 1324	3056	msedge.exe	83
PID 3056 wrote to memory of 1324	3056	msedge.exe	83
PID 3056 wrote to memory of 1324	3056	msedge.exe	83
PID 3056 wrote to memory of 1324	3056	msedge.exe	83
PID 3056 wrote to memory of 1324	3056	msedge.exe	83
PID 3056 wrote to memory of 1324	3056	msedge.exe	83
PID 3056 wrote to memory of 1324	3056	msedge.exe	83
PID 3056 wrote to memory of 1324	3056	msedge.exe	83
PID 3056 wrote to memory of 1324	3056	msedge.exe	83
PID 3056 wrote to memory of 1324	3056	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://rb.gy/9u9m78
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb38b43cb8,0x7ffb38b43cc8,0x7ffb38b43cd8
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,5050069909031587694,8943752763072790654,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1956,5050069909031587694,8943752763072790654,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2504 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1956,5050069909031587694,8943752763072790654,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,5050069909031587694,8943752763072790654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,5050069909031587694,8943752763072790654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,5050069909031587694,8943752763072790654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,5050069909031587694,8943752763072790654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1956,5050069909031587694,8943752763072790654,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,5050069909031587694,8943752763072790654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,5050069909031587694,8943752763072790654,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1956,5050069909031587694,8943752763072790654,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1956,5050069909031587694,8943752763072790654,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,5050069909031587694,8943752763072790654,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,5050069909031587694,8943752763072790654,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2748 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aceef780c08301cd5b23ae05d0987aca

SHA1
d7dacb2528c70e3340a836da7666fcffd6f2a17b

SHA256
257d92d753dd7de9a01fb0c77c63f8c3ed01ea6d7c14d8c5e1fb2db50e0077aa

SHA512
95943d8b8db3450627559344429cb82c09fa2a61b35721f400a26378bafdb1d3243d52c7eecd3c2c355373de7f48d0bf290987e7064d80b9fa689f17475ae729

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e826770e88318fe8f2db3f380cc22916

SHA1
d4ebc1b80456022971bcbe046fbc95b821592eca

SHA256
39b58b21a085a32ab8c05a900f7865051b785bc0cf2b499a1cc8e26adc34165a

SHA512
c8f2f24e216db852c957bea9d5d3961b15d7274b02e72534ae496bbae0149c682155a6a24a0b74bdbda62374050e71e897d8010aeefd4c13d1290327b30708b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
467B

MD5
91674aa0518b6f75f3bf8056ad9f21a6

SHA1
9b360e2813d3ec0dccaba77f2b158b6b6126e2b2

SHA256
500929ddb53d5ba9da568d124403cece7d88dfb237bd617535c3b2f69af18c56

SHA512
5154e1f1d6ff911bff5dfb52332a741bed1eef6f235e9e319d8016a78d798f92d611180c36e55e967816eadfaa9cca8d05c5d61fc9ebf2568f5a062500d1dc78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
75e179615bca1eb33e75300e4d05eb89

SHA1
da357331f7f861c23aaf87aff535a7815e580274

SHA256
99632611c0170156cae08b325894ec73733c2369308fb56a082efa3a80864aef

SHA512
6cbe8240d9f07ff6a289008a903ccc8beb723c0e50cf9982e2596f50940444ab96125d523066bb370c40df1fb37f16d15e5a1ea1262ecded396001539c1690a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5bbcadd21b158ecbadee549beb45113f

SHA1
90bfbff81d043d1b4b30b720405f35948a550c63

SHA256
0b7263887a6cdc9d7f497290b06946bbb57b1b49a515a5d2dfca843b62526676

SHA512
239179c741a07aaf208ea7c0a48c8047c7c7ca4d2a8b9de14a9360aaf924d6cb436dc6d6dc9caa601fdead96501d297e96f562e11eba3852a3c75878f3be9db8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7358cf26418a979380619f92983457cf

SHA1
d77bb35c3a218a1114dc3aabb908038ec62e7058

SHA256
7ca4680335c13fc1f1e0e1bfc5feb5308b91a01685c0290c25e06678c6a27c86

SHA512
cd355b3c4dbe788a4bf77fb9587b3c8a54b420538965df51812f25f7e5f2c03ef9ee42b05ff7d204522066900a7d342b8c023ce35da2a80c60f33a42aaeb72d1

Download Submit