hxxps://www[.]google[.]com[.]ar

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2023 10:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.google.com.ar

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1800	msedge.exe
1800	msedge.exe
720	msedge.exe
720	msedge.exe
2748	identity_helper.exe
2748	identity_helper.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 720 wrote to memory of 4756	720	msedge.exe	86
PID 720 wrote to memory of 4756	720	msedge.exe	86
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1452	720	msedge.exe	88
PID 720 wrote to memory of 1800	720	msedge.exe	89
PID 720 wrote to memory of 1800	720	msedge.exe	89
PID 720 wrote to memory of 4652	720	msedge.exe	90
PID 720 wrote to memory of 4652	720	msedge.exe	90
PID 720 wrote to memory of 4652	720	msedge.exe	90
PID 720 wrote to memory of 4652	720	msedge.exe	90
PID 720 wrote to memory of 4652	720	msedge.exe	90
PID 720 wrote to memory of 4652	720	msedge.exe	90
PID 720 wrote to memory of 4652	720	msedge.exe	90
PID 720 wrote to memory of 4652	720	msedge.exe	90
PID 720 wrote to memory of 4652	720	msedge.exe	90
PID 720 wrote to memory of 4652	720	msedge.exe	90
PID 720 wrote to memory of 4652	720	msedge.exe	90
PID 720 wrote to memory of 4652	720	msedge.exe	90
PID 720 wrote to memory of 4652	720	msedge.exe	90
PID 720 wrote to memory of 4652	720	msedge.exe	90
PID 720 wrote to memory of 4652	720	msedge.exe	90
PID 720 wrote to memory of 4652	720	msedge.exe	90
PID 720 wrote to memory of 4652	720	msedge.exe	90
PID 720 wrote to memory of 4652	720	msedge.exe	90
PID 720 wrote to memory of 4652	720	msedge.exe	90
PID 720 wrote to memory of 4652	720	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com.ar
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff94f5446f8,0x7ff94f544708,0x7ff94f544718
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1824,6684618906426719112,13368021795872991723,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1824,6684618906426719112,13368021795872991723,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2472 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1824,6684618906426719112,13368021795872991723,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,6684618906426719112,13368021795872991723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,6684618906426719112,13368021795872991723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,6684618906426719112,13368021795872991723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1824,6684618906426719112,13368021795872991723,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3316 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1824,6684618906426719112,13368021795872991723,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3316 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,6684618906426719112,13368021795872991723,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,6684618906426719112,13368021795872991723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,6684618906426719112,13368021795872991723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1824,6684618906426719112,13368021795872991723,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1824,6684618906426719112,13368021795872991723,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4924 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d5af55f794f9a10c5943d2f80dde5c5

SHA1
5252adf87d6bd769f2c39b9e8eba77b087a0160d

SHA256
43e50edafcaaeae9fcd4dce5b99bf14fe79dae1401019443f31aa9ff81347764

SHA512
2e2e09a00db732ff934da1e6ab8617fb3c8de482f9667a2c987435d0a5d67550b4bfd66e8b4475012b60908c24e39dff58e2f2ffa55f13ffc55caae1be630c71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
1c0db99e0bf0629ddcecd2198b4c5184

SHA1
e9f5a66dd02a41eeddac621683f92baed482162b

SHA256
9162696de1cd58a4c6a9ce389c81f8fc1d54dc6b3f1cb17e5084da4f34098341

SHA512
6d1dec213a5f443d2a2e0362577e082d156fdc291f20636bb2820f3a7c94533120d7e10230ed78f07984424076848ef65dabc397c18a5076a0aeb7c58037a2b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3fd7ba1fb35e52475f1c4474f4c4d50b

SHA1
1fc6791a49ad6e074e5326f32b45f843fb62383d

SHA256
19c37ba4086b9124b3001720fffd337037f65bb8b7da271ad2766e0ce08c2c5b

SHA512
36dab65785945fb78680ce45989033ccdd4bff451db413d2456a58ab9bced7ba69f080f80e66c8ad30f830c1f1917092bf5cf12ee38b7c36fcb9027c09a2aae5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
219a65a002c37918bd3ec32ecdbb0b66

SHA1
0d6bb3c506f65dcdd4cf2d820922a04f24dccc23

SHA256
d9a4a009c8667693c2f9aa50f0c9f0270355c259bd4f11b20cb73fa27244628d

SHA512
543f3e2dbd7589426965ce09ac98b0779b1bc7acfeb94718f7d3eb9ae565c6a8d1faac36a45c7bcaf89a7f251fa26c52bcdf4107446c3e35ea64a82a5fc4a587

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
99b4ccf3df324ff73a8a128eec895143

SHA1
8d6be12c416c81b16db621151d60e2e88cb00fa2

SHA256
7d9a8d81a35bd8ee149330eb1ec9f69a33deaa50de9dad7ece4f05c727a91a94

SHA512
9d333868e758265df14d0c603d638688256eb6beab1c29bdd5188308fd1d3abb54cd10b68741e86c91bb914bf78554c5b192d73b15a981a79432128bc903a5d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
810259b065325e0edc620a5b9b9c55c3

SHA1
b8b67c040700acd38699333d4ed6864bca069c7e

SHA256
2652a5944358f7a2057ddf63e75921fe2628e7f254b929c6efa2712e846f56e6

SHA512
643af1d7f84ada59dfae0d187fd758ca81e55f77bfe1a2b65bec75e3f133a2b06f745a9906895960c18bcfc57357566bf09574f5b7c05dfc720141c6343b41d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
10f5b64000466c1e6da25fb5a0115924

SHA1
cb253bacf2b087c4040eb3c6a192924234f68639

SHA256
d818b1cebb2d1e2b269f2e41654702a0df261e63ba2a479f34b75563265ee46b

SHA512
8a8d230594d6fade63ecd63ba60985a7ccd1353de8d0a119543985bf182fdbb45f38ccc96441c24f0792ea1c449de69563c38348c2bedb2845522a2f83a149db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5090d72430805e53ee748e6da93efb53

SHA1
7b420f565fbbdb7857afc39cd32eb7f28a9d9ff6

SHA256
deed0e4136ac3b16b226f79a98271024e510e8118eded4cb9e61667f3639b1e7

SHA512
01642010c0b43b426887364105d9f60265a506386294c3df3a0451d077cdcecf39d5402d71cb1d724bb01da36f48f9ec74e9416ebdb756fbd1a609c870a56f72

Download Submit