hxxps://doc-0c-9o-docs[.]googleusercontent[.]com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/jh7qupdg7vpgivq3o56s38so27nm0o97/16965

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://doc-0c-9o-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/jh7qupdg7vpgivq3o56s38so27nm0o97/16965

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
628	msedge.exe
628	msedge.exe
3528	msedge.exe
3528	msedge.exe
4820	identity_helper.exe
4820	identity_helper.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 4460	3528	msedge.exe	84
PID 3528 wrote to memory of 4460	3528	msedge.exe	84
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 452	3528	msedge.exe	86
PID 3528 wrote to memory of 628	3528	msedge.exe	87
PID 3528 wrote to memory of 628	3528	msedge.exe	87
PID 3528 wrote to memory of 2972	3528	msedge.exe	88
PID 3528 wrote to memory of 2972	3528	msedge.exe	88
PID 3528 wrote to memory of 2972	3528	msedge.exe	88
PID 3528 wrote to memory of 2972	3528	msedge.exe	88
PID 3528 wrote to memory of 2972	3528	msedge.exe	88
PID 3528 wrote to memory of 2972	3528	msedge.exe	88
PID 3528 wrote to memory of 2972	3528	msedge.exe	88
PID 3528 wrote to memory of 2972	3528	msedge.exe	88
PID 3528 wrote to memory of 2972	3528	msedge.exe	88
PID 3528 wrote to memory of 2972	3528	msedge.exe	88
PID 3528 wrote to memory of 2972	3528	msedge.exe	88
PID 3528 wrote to memory of 2972	3528	msedge.exe	88
PID 3528 wrote to memory of 2972	3528	msedge.exe	88
PID 3528 wrote to memory of 2972	3528	msedge.exe	88
PID 3528 wrote to memory of 2972	3528	msedge.exe	88
PID 3528 wrote to memory of 2972	3528	msedge.exe	88
PID 3528 wrote to memory of 2972	3528	msedge.exe	88
PID 3528 wrote to memory of 2972	3528	msedge.exe	88
PID 3528 wrote to memory of 2972	3528	msedge.exe	88
PID 3528 wrote to memory of 2972	3528	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://doc-0c-9o-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/jh7qupdg7vpgivq3o56s38so27nm0o97/16965
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b6df46f8,0x7ff9b6df4708,0x7ff9b6df4718
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,2882391686106679758,2109325490430258954,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,2882391686106679758,2109325490430258954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,2882391686106679758,2109325490430258954,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2882391686106679758,2109325490430258954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2882391686106679758,2109325490430258954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2882391686106679758,2109325490430258954,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2882391686106679758,2109325490430258954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2882391686106679758,2109325490430258954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,2882391686106679758,2109325490430258954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4184 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,2882391686106679758,2109325490430258954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2882391686106679758,2109325490430258954,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,2882391686106679758,2109325490430258954,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5008 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d5af55f794f9a10c5943d2f80dde5c5

SHA1
5252adf87d6bd769f2c39b9e8eba77b087a0160d

SHA256
43e50edafcaaeae9fcd4dce5b99bf14fe79dae1401019443f31aa9ff81347764

SHA512
2e2e09a00db732ff934da1e6ab8617fb3c8de482f9667a2c987435d0a5d67550b4bfd66e8b4475012b60908c24e39dff58e2f2ffa55f13ffc55caae1be630c71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
325B

MD5
3967c8f9d8ba60aaf4b1b27f58b9f0ea

SHA1
f979313cdea137122743a7dca3d9e841dafba89a

SHA256
72697dc9f33e5173917905539315bec21238409d48cfb1b385e62961c90f384f

SHA512
ad28e66f2bb04ebd102a064da9ee2f9c4c69f7ea927c4416fafe2a15e6cb30f224945f8ad787b50dea562c5d7070f6bb454350cf41326497deda8af5c8d8a9e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1a4134029c97994059ae5f78d0779942

SHA1
75a1f8f741b80aae532568c35ddab6b1f7580e77

SHA256
a97996a9c9a5a60eab5bf1670be9a06dbb04b27af808f2ae3ba6299d0990cadc

SHA512
6f4c2ef420c39890039032f4a4561c4bad144fd041044f6d042fea090e7ba1e39c7c916114970b3786717affd3149efffa60b51eafb6fee8512fb809f07d9fb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b27da78bc3ab77dde7da462003f69a27

SHA1
eb403489f3ea7c61f28c4e6fe09db2e7f8c8b37c

SHA256
74dd41e89982464065b601852e8a046b337290adb5388fb40dd311ae4734e842

SHA512
5955c39f8e1af813e0a4f62a223587c79c5f2f26bc25e537f155ce210b75d0a7917b250582da2c8dcce0abc798bc9d9cd186d7e32786cf14551edcadcacc176d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
10f5b64000466c1e6da25fb5a0115924

SHA1
cb253bacf2b087c4040eb3c6a192924234f68639

SHA256
d818b1cebb2d1e2b269f2e41654702a0df261e63ba2a479f34b75563265ee46b

SHA512
8a8d230594d6fade63ecd63ba60985a7ccd1353de8d0a119543985bf182fdbb45f38ccc96441c24f0792ea1c449de69563c38348c2bedb2845522a2f83a149db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
39823c3bb0f0f8b8d059d6260cd1269f

SHA1
f5c905bb6bd107b54c03c6298f0b0079c5b70213

SHA256
a980fb18a6741367bd3a927e318b18b00dc53ada3f8bc3f36549d634778119a4

SHA512
1cb5d4a45427dc3075bf71ae88f19e50dff2f05b5020ab2107344049ab1fb2bcb4241056c5b7b5bee5704cc0178b14cadfe78b76cdac9045fa59d9067e789c93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c5a733260bd6a712c8c255e02a93f309

SHA1
ab2d43d5403d0b5829c6e3d1c49381394d0d2432

SHA256
bea5db68dd39a81e879b54a91e04e05a047fb9b517665b6cd7f437ebec0c3c59

SHA512
36d349b5e43416be3e4ffd8a399dbd8253ba50993538fdb33eeca716fb4f339c55ea1b2fb89b460e788eed91b40be736f98beb8555abbde95520ff317f6fc5f5

Download Submit