hxxp://google[.]com

Resubmissions

07/11/2023, 14:22

231107-rpw62ahb4w 1

27/10/2023, 15:55

23/10/2023, 16:49

17/10/2023, 12:22

16/10/2023, 18:28

16/10/2023, 17:48

12/10/2023, 18:50

Analysis

max time kernel
1769s
max time network
1689s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
16/10/2023, 18:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4408	msedge.exe
4408	msedge.exe
2516	msedge.exe
2516	msedge.exe
1680	identity_helper.exe
1680	identity_helper.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe
2516	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 1960	2516	msedge.exe	81
PID 2516 wrote to memory of 1960	2516	msedge.exe	81
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 244	2516	msedge.exe	82
PID 2516 wrote to memory of 4408	2516	msedge.exe	83
PID 2516 wrote to memory of 4408	2516	msedge.exe	83
PID 2516 wrote to memory of 4616	2516	msedge.exe	84
PID 2516 wrote to memory of 4616	2516	msedge.exe	84
PID 2516 wrote to memory of 4616	2516	msedge.exe	84
PID 2516 wrote to memory of 4616	2516	msedge.exe	84
PID 2516 wrote to memory of 4616	2516	msedge.exe	84
PID 2516 wrote to memory of 4616	2516	msedge.exe	84
PID 2516 wrote to memory of 4616	2516	msedge.exe	84
PID 2516 wrote to memory of 4616	2516	msedge.exe	84
PID 2516 wrote to memory of 4616	2516	msedge.exe	84
PID 2516 wrote to memory of 4616	2516	msedge.exe	84
PID 2516 wrote to memory of 4616	2516	msedge.exe	84
PID 2516 wrote to memory of 4616	2516	msedge.exe	84
PID 2516 wrote to memory of 4616	2516	msedge.exe	84
PID 2516 wrote to memory of 4616	2516	msedge.exe	84
PID 2516 wrote to memory of 4616	2516	msedge.exe	84
PID 2516 wrote to memory of 4616	2516	msedge.exe	84
PID 2516 wrote to memory of 4616	2516	msedge.exe	84
PID 2516 wrote to memory of 4616	2516	msedge.exe	84
PID 2516 wrote to memory of 4616	2516	msedge.exe	84
PID 2516 wrote to memory of 4616	2516	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec4a146f8,0x7ffec4a14708,0x7ffec4a14718
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,9226153345504296997,17929699674219536990,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,9226153345504296997,17929699674219536990,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,9226153345504296997,17929699674219536990,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9226153345504296997,17929699674219536990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9226153345504296997,17929699674219536990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9226153345504296997,17929699674219536990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,9226153345504296997,17929699674219536990,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,9226153345504296997,17929699674219536990,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9226153345504296997,17929699674219536990,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9226153345504296997,17929699674219536990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9226153345504296997,17929699674219536990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9226153345504296997,17929699674219536990,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,9226153345504296997,17929699674219536990,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d5af55f794f9a10c5943d2f80dde5c5

SHA1
5252adf87d6bd769f2c39b9e8eba77b087a0160d

SHA256
43e50edafcaaeae9fcd4dce5b99bf14fe79dae1401019443f31aa9ff81347764

SHA512
2e2e09a00db732ff934da1e6ab8617fb3c8de482f9667a2c987435d0a5d67550b4bfd66e8b4475012b60908c24e39dff58e2f2ffa55f13ffc55caae1be630c71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
de2f26f5102c35b43610ae4968494f16

SHA1
abf857b8593786dcedcf319a46239289ae9aeeaa

SHA256
cd4722f086c2cbf5a52d332a7364c38c03c02b39223966b2d31f8e9a0279f201

SHA512
08b17cad8de0c17a1f5739938d9b85fade9a3124b76cd546ec7508c8abe59b8595f166768098acd6782bbaca01ecb4af16694d495ca2894398c624ad4b8c3c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d57cc6192b3aeb2140323f2d0bb077c9

SHA1
ec86f6366175810ac483acaac601252156c63a4c

SHA256
48f9a8118894ce2bded01c715cebcaa7afd6ab272a9617a482df22d6aed73324

SHA512
2d38b9da8bc01c795d3e93c9017fdecd38ddf9edef424dfed3ad65ffd07b37f8d22623cff33b00e64f81ef19312135a6a1d1ad3d5bb74124ec19ef3e67676d5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d5eacf26a71f3862578b3f85168f5c02

SHA1
3aff61d70a8ad9282d94366a503d3d5432f0e1c4

SHA256
9c6eb219e5d9444586de3570dd5fd536d021dc5378982fcbf6e057b413e9cceb

SHA512
0a7535e51615c30e96cdc53a3bf2f0d81d2f83774841b239e1515c89308419e8ccad6d27fd9d0f7c1fab68e1991e1a909ac9fab41872f23bcd724f68a314af91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
233ad98198cf9aaf24604fe659013cea

SHA1
0d5861f50db8d9e7d7d3cf4e975fd45c9e19f761

SHA256
b2351de7427d0dae798ab79dee11dc7a311318dd368bc1b1f78e89a5ab8c89e8

SHA512
06c3ab31186b08920e54f7c616fcad079e1834fc59b98ad2292e25f801afe4e94411615f13ad4fbcde63bd69ed60841543a4c14a5b20a8b79125209e763046e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
64fcfcf59fda8b00cd629c9a7286e54b

SHA1
2f4af995296a7742819f9e463116f09e8b9311fe

SHA256
b24b9cbfda79d43874c0fcad6054e3c7671b1951516fb316ebc89a23b21fe221

SHA512
df9d2a0438476e73861d0ddf49a06e47058dfb7e0dbd5eb5c401f17fed7bfa1254023af693939be9740f975e1f2fa8c78743e643ac8ad5ccd622a2bcfe5a4a41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
10f5b64000466c1e6da25fb5a0115924

SHA1
cb253bacf2b087c4040eb3c6a192924234f68639

SHA256
d818b1cebb2d1e2b269f2e41654702a0df261e63ba2a479f34b75563265ee46b

SHA512
8a8d230594d6fade63ecd63ba60985a7ccd1353de8d0a119543985bf182fdbb45f38ccc96441c24f0792ea1c449de69563c38348c2bedb2845522a2f83a149db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d9eb0a13bc394beb705be65f82885be7

SHA1
f2c6550487581f300413413a8ecaa8a4518fdee2

SHA256
74c6ab257d64d3207fafd9447bff763ae21c023b06e41d67c91a4e7d375b5b74

SHA512
4c66cd6c23003caa37af2528b22cdd81ee0af604117618363a8d9df31cf3e1145ccf73802a0e8529e798ae0e9201a1d31e7e94148ebf1a2d029d7adba0cb5c5d

Download Submit