hxxp://beegrenugoz[.]com

Analysis

max time kernel
146s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
07/08/2023, 16:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://beegrenugoz.com

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3808	msedge.exe
3808	msedge.exe
1744	msedge.exe
1744	msedge.exe
3704	identity_helper.exe
3704	identity_helper.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 3092	1744	msedge.exe	27
PID 1744 wrote to memory of 3092	1744	msedge.exe	27
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 2752	1744	msedge.exe	82
PID 1744 wrote to memory of 3808	1744	msedge.exe	83
PID 1744 wrote to memory of 3808	1744	msedge.exe	83
PID 1744 wrote to memory of 3640	1744	msedge.exe	84
PID 1744 wrote to memory of 3640	1744	msedge.exe	84
PID 1744 wrote to memory of 3640	1744	msedge.exe	84
PID 1744 wrote to memory of 3640	1744	msedge.exe	84
PID 1744 wrote to memory of 3640	1744	msedge.exe	84
PID 1744 wrote to memory of 3640	1744	msedge.exe	84
PID 1744 wrote to memory of 3640	1744	msedge.exe	84
PID 1744 wrote to memory of 3640	1744	msedge.exe	84
PID 1744 wrote to memory of 3640	1744	msedge.exe	84
PID 1744 wrote to memory of 3640	1744	msedge.exe	84
PID 1744 wrote to memory of 3640	1744	msedge.exe	84
PID 1744 wrote to memory of 3640	1744	msedge.exe	84
PID 1744 wrote to memory of 3640	1744	msedge.exe	84
PID 1744 wrote to memory of 3640	1744	msedge.exe	84
PID 1744 wrote to memory of 3640	1744	msedge.exe	84
PID 1744 wrote to memory of 3640	1744	msedge.exe	84
PID 1744 wrote to memory of 3640	1744	msedge.exe	84
PID 1744 wrote to memory of 3640	1744	msedge.exe	84
PID 1744 wrote to memory of 3640	1744	msedge.exe	84
PID 1744 wrote to memory of 3640	1744	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://beegrenugoz.com
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff375e46f8,0x7fff375e4708,0x7fff375e4718
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,10414062199831562196,443633834538299881,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,10414062199831562196,443633834538299881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,10414062199831562196,443633834538299881,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10414062199831562196,443633834538299881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10414062199831562196,443633834538299881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,10414062199831562196,443633834538299881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  PID:484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,10414062199831562196,443633834538299881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10414062199831562196,443633834538299881,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10414062199831562196,443633834538299881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10414062199831562196,443633834538299881,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10414062199831562196,443633834538299881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2196,10414062199831562196,443633834538299881,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,10414062199831562196,443633834538299881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2908 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,10414062199831562196,443633834538299881,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a7ad9bb1054aa03e39b3554833d0c3ec

SHA1
cbd5b99ca100bc2f1292df23bf8e2a5a6f9640d9

SHA256
0c3eae39386b4117ad26187afc4933e254468cd12d813271f4b7420cee73c189

SHA512
d1d0b77e0bc412b4ee687e849531a7c9b70200d45d0bdbf38357b6fc59af835522e749b2fd8c2d4cde73518970568c38d73416c97381a11cc6029c14b1678276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
253B

MD5
8935253dee9c97e39032ca8615ba0f0b

SHA1
aacad5a72935104f1bc64ea18b90ff0825acc081

SHA256
52a255216adceea88d39e0adc53da14becc6129b3d60157e1597ad570dc1a330

SHA512
7de8d3b6af370699a46768d5c94e553d65cc6718aab607930c12475a6717e90428640614a3a2587ac338508ac811b3d3fb7031dea21f683d64206e01016fdd9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9af557010b4633223ddb6af366e4a47c

SHA1
8a3e25719449941a65456351e134c7ebaaf55920

SHA256
25d2763e1d27d561d62d8683169511d4dc3188d3eba9186b76aefd5a3fdc4996

SHA512
24826d89068bf8cb7f7c3eedfaa4fd352b2aaec13b1af34da471243e9598ca32d407c66a0294bb3ff6a41e731b109bcbf0e95b25b5a6af9cf43d286a2dfc54c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f6f1c312f1dc9cd06cd0c94d02c257e9

SHA1
cd1bb13299bc4ea3dac02754dce67cf5ecb867c5

SHA256
8d925791bf5f56bab55199cc79a917dba9cf3f255764425a1d4dfceb543030ee

SHA512
ec367308b49c608015f7d12e2cd7252704b050723415b8d6d49ff888ef038ffa5822b0fe49d0bd0cd4e5e57e78574e994509244e157d329a04faa95960f17450

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
888c7c2d6666d075d7c7d6eff9107e78

SHA1
ea3f35db4ef3bf8a201fd81d628c54b6cb69646e

SHA256
4f8959a08093b5cb78c6e80a9d4a564b809b8bfdb07177eb5cbd7725ca692b56

SHA512
01c4e1f9e2a0e2a1f778e7c74b3a5f4cd3cce2180ae93e9257bb6fa99bcce3839d064f6da51b2c02daefcc1594e19b10b88684ffb7acd6d5ac327f6ea88003da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
728825c1e691460b96520ed7400a98db

SHA1
1d0028ade0d71a69b89274dde5ab437c1738d166

SHA256
5279600d66732843559f0265b6eda3d4d160911000bd24cdbcb1ada858240b81

SHA512
4d0455e748f591c66b6b43d79fd4bdfca461c9172a81de9933c2af0bab67a6ea12fed4a73799d8e58aec78d8a64328f98d8be7ea11c89ce6593652877068a33b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e62cc4051e1f8eaa0abda5d730a2496b

SHA1
d15346e40b196bc313cbfe5ac96b3c90b83345be

SHA256
ffb5b740b8777d010f0d32a120092084c3cd32eaceb937188d698ddc22df2fcb

SHA512
3e8f6d89c7c153177b2149d86cd8602ceafedf66f5335a86b19dfa46fc38c47f6ff9a272c3b71b4464a5921ebdf2461fba25692ca916b9715bac520bf1e81a22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
9baf1a4091354765eb6edf9a63f577db

SHA1
64deb9cc9cb36d0dd08efd4d0102fb81ba9aac15

SHA256
b6dd17f71e33f5dbf60cbd79b5866359d63243f7c3702e66e7eadff068b7674a

SHA512
05dc71ddafc05053d3f9c672df39d4b3f73582e7930b9455bf328cac01f48a9a74c2e5b594285d18b6066dd29903b97a9528248f32ee0f8f1bc563e5c451a7c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
378e601a0ff22134f81675192e8bd7dd

SHA1
013aa8f1574de511df335bd7496e891b57a27160

SHA256
710ff4cfda902d47c077f0add0eec0b5148c0d2f484e7934eef171df54c85d32

SHA512
e6d47ac5788c8d99ca5e142d1db0b7f53b9e23a70cb5487b5d67eb4b938db81392b9069a751b5c188d2168f32fc905a205df9e95dea02eb67adf605c22c24fe6

Download Submit