hxxp://google[.]com

Resubmissions

07/11/2023, 14:22

231107-rpw62ahb4w 1

27/10/2023, 15:55

23/10/2023, 16:49

17/10/2023, 12:22

16/10/2023, 18:28

16/10/2023, 17:48

12/10/2023, 18:50

Analysis

max time kernel
1342s
max time network
1136s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
27/10/2023, 15:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2980	msedge.exe
2980	msedge.exe
4508	msedge.exe
4508	msedge.exe
4000	identity_helper.exe
4000	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 1836	4508	msedge.exe	53
PID 4508 wrote to memory of 1836	4508	msedge.exe	53
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 3048	4508	msedge.exe	85
PID 4508 wrote to memory of 2980	4508	msedge.exe	84
PID 4508 wrote to memory of 2980	4508	msedge.exe	84
PID 4508 wrote to memory of 3092	4508	msedge.exe	86
PID 4508 wrote to memory of 3092	4508	msedge.exe	86
PID 4508 wrote to memory of 3092	4508	msedge.exe	86
PID 4508 wrote to memory of 3092	4508	msedge.exe	86
PID 4508 wrote to memory of 3092	4508	msedge.exe	86
PID 4508 wrote to memory of 3092	4508	msedge.exe	86
PID 4508 wrote to memory of 3092	4508	msedge.exe	86
PID 4508 wrote to memory of 3092	4508	msedge.exe	86
PID 4508 wrote to memory of 3092	4508	msedge.exe	86
PID 4508 wrote to memory of 3092	4508	msedge.exe	86
PID 4508 wrote to memory of 3092	4508	msedge.exe	86
PID 4508 wrote to memory of 3092	4508	msedge.exe	86
PID 4508 wrote to memory of 3092	4508	msedge.exe	86
PID 4508 wrote to memory of 3092	4508	msedge.exe	86
PID 4508 wrote to memory of 3092	4508	msedge.exe	86
PID 4508 wrote to memory of 3092	4508	msedge.exe	86
PID 4508 wrote to memory of 3092	4508	msedge.exe	86
PID 4508 wrote to memory of 3092	4508	msedge.exe	86
PID 4508 wrote to memory of 3092	4508	msedge.exe	86
PID 4508 wrote to memory of 3092	4508	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffae9246f8,0x7fffae924708,0x7fffae924718
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,17613808119349637001,2392469613198119946,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,17613808119349637001,2392469613198119946,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,17613808119349637001,2392469613198119946,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2288 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17613808119349637001,2392469613198119946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17613808119349637001,2392469613198119946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17613808119349637001,2392469613198119946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,17613808119349637001,2392469613198119946,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,17613808119349637001,2392469613198119946,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17613808119349637001,2392469613198119946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,17613808119349637001,2392469613198119946,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:3176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:908

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6276613a51dae3b747451bc05e24edfa

SHA1
96ff591013fc8d378a9b37ea580d8ec6e98bbde5

SHA256
d17c0519716f5fa61ccf7289220c5e8917a36fbb29e48a86bb1122c9e3fcafb0

SHA512
dc84cd5df4867849039ecea2c98b1aeb435399b9503b1384159b2d08fe180b9f3daadc98f55c6ab28faa1e66dea8abfa4e702232a7027d933b0eca91fcf6b5f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\63e241c8-25d5-4da4-a4b2-e52eb075dd15.tmp

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
fcef77af2e16c6c03bec30971ce22275

SHA1
3339777a32ec4542b02842a148b708735c491c2c

SHA256
942de38cabafcc587767538dc385317c0d69eae882866d5dc28fc284992180d7

SHA512
4207e01f074c328c53c0061cc599b4cac5890b208b7a432d2fc132a36230c70f5b698d831e37cdb2bee2fef0332b899b3ca879ed9147fdb4a3c56368a8a728aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
65e4a220e427be2fd7c418436628d984

SHA1
ef2d360da2cd3575eb273854c66f790a5999f1ef

SHA256
08e0d79ecb3b86bfe19e3c0e677dae33547d57ce9244996a94503095510a4680

SHA512
aaa69e1058159a05bf92fa1f5f371a43f8f7a14c5b259e2874322b7557ef3b9956c45db22f31f3ee1c55658f4e0aae261c6c770a4e363476ec519404ef076a65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
34608b660377eef2226127d067e7501d

SHA1
a5f9fdf87966fc8416431b8b8f48149e11610bbe

SHA256
e3fb9c839105b22e01314696b989de5a01ee32b2909b4385738b855dac81e917

SHA512
09c13598144d2861d1f607e64e7a4b28d91a191c432bb4c4e5761afd3fc2344b3cd883c66c76079daaa6ae58df6a8d80860118f87709e4cfccc47f6514bbc17b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
38cc133cb04a2b4f130be886ff385238

SHA1
8e82cb61317aceb967452d010aa5eef1ddbaff46

SHA256
2be92b8f5ceceb31c835a47bee8d8c630e467c9aab22de1e9897a7a02f0fa3df

SHA512
421a386d2693ce32f9596e16aa23e644be3d65e191726508df6064bfdba8f238546eaaaf207c4ab4c29c6a0ac185aa9ab47dc428a0bc569212a0efdd6f246513

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
330760bbee13d878e57a84ba9e353a08

SHA1
d9dcb0e2a1e716475cc9025f9f9d7b39bdbad123

SHA256
aa4b6c5eeef60055fa13b294eac7cb9002f1d954ecfaab0de425d32f94574aab

SHA512
aac2b433f42da0e2abf5565d1ecf6031e2987fc0d5c4f6d3d2bd85f775ec73c5680b33db8622504196ca56e2746dae6dc3980f4fd7895cec86668bd0514b2722

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
f1881400134252667af6731236741098

SHA1
6fbc4f34542d449afdb74c9cfd4a6d20e6cdc458

SHA256
d6fcec1880d69aaa0229f515403c1a5ac82787f442c37f1c0c96c82ec6c15b75

SHA512
18b9ac92c396a01b6662a4a8a21b995d456716b70144a136fced761fd0a84c99e8bd0afb9585625809b87332da75727b82a07b151560ea253a3b8c241b799450

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1936a2a2d595c59fb194669d6476a3d0

SHA1
7f0db585ebea19d70119b8ae1faa14e0b8656b4f

SHA256
0ffc0db9f96bac1db83445111d986764921c3d71262e2a1e95c89f9fec561307

SHA512
da48c55d7a7e58393ff37d3d217d91fb0ad2639e2ff6a2f9bf50d42dd89915f080af4096841c1bfe4fdfa2a9ef8c4b92e02c0a620712a8c8b61a7d069ac87d4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f1d53a7f53b75a2f655780b4cc91f690

SHA1
20997f96f51b92351c36f4ffdf929f18dfe0ad16

SHA256
c7d630e312f30cd6e164b50d70b449aa8b0f2d1e24ac801f97cfff6695be98d2

SHA512
564df9f841bbb0d9679b5b3954e406e699272fdc6384520ff37cccf41bba62749f8661fd0929e890d73220399bba0ea7f859e8d1c9ff691511f4221ddf5912d3

Download Submit