hxxp://google[.]com

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
11/12/2023, 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4520	msedge.exe
4520	msedge.exe
2336	msedge.exe
2336	msedge.exe
1476	identity_helper.exe
1476	identity_helper.exe
6096	msedge.exe
6096	msedge.exe
6096	msedge.exe
6096	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 3400	2336	msedge.exe	87
PID 2336 wrote to memory of 3400	2336	msedge.exe	87
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4916	2336	msedge.exe	90
PID 2336 wrote to memory of 4520	2336	msedge.exe	89
PID 2336 wrote to memory of 4520	2336	msedge.exe	89
PID 2336 wrote to memory of 4756	2336	msedge.exe	91
PID 2336 wrote to memory of 4756	2336	msedge.exe	91
PID 2336 wrote to memory of 4756	2336	msedge.exe	91
PID 2336 wrote to memory of 4756	2336	msedge.exe	91
PID 2336 wrote to memory of 4756	2336	msedge.exe	91
PID 2336 wrote to memory of 4756	2336	msedge.exe	91
PID 2336 wrote to memory of 4756	2336	msedge.exe	91
PID 2336 wrote to memory of 4756	2336	msedge.exe	91
PID 2336 wrote to memory of 4756	2336	msedge.exe	91
PID 2336 wrote to memory of 4756	2336	msedge.exe	91
PID 2336 wrote to memory of 4756	2336	msedge.exe	91
PID 2336 wrote to memory of 4756	2336	msedge.exe	91
PID 2336 wrote to memory of 4756	2336	msedge.exe	91
PID 2336 wrote to memory of 4756	2336	msedge.exe	91
PID 2336 wrote to memory of 4756	2336	msedge.exe	91
PID 2336 wrote to memory of 4756	2336	msedge.exe	91
PID 2336 wrote to memory of 4756	2336	msedge.exe	91
PID 2336 wrote to memory of 4756	2336	msedge.exe	91
PID 2336 wrote to memory of 4756	2336	msedge.exe	91
PID 2336 wrote to memory of 4756	2336	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffe182446f8,0x7ffe18244708,0x7ffe18244718
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,5964724678809783686,8571948297095102077,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,5964724678809783686,8571948297095102077,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,5964724678809783686,8571948297095102077,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5964724678809783686,8571948297095102077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5964724678809783686,8571948297095102077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5964724678809783686,8571948297095102077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,5964724678809783686,8571948297095102077,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,5964724678809783686,8571948297095102077,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5964724678809783686,8571948297095102077,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=196 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5964724678809783686,8571948297095102077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4476 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5964724678809783686,8571948297095102077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4444 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5964724678809783686,8571948297095102077,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,5964724678809783686,8571948297095102077,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1848 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1100

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:4788
- C:\Windows\system32\curl.exe
  curl ascii.live/forrest
  2⤵
  PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
208a234643c411e1b919e904ee20115e

SHA1
400b6e6860953f981bfe4716c345b797ed5b2b5b

SHA256
af80020ae43388bbd3db31c75aade369d489a30a933574dea19163e094d5f458

SHA512
2779b96325234c836cbb91820ee332ed56c15b534ec0c7770b322a5c03849ec3ee67b0ec7978e1fab563eeed1cea96f5155d7b942702555d9352ff6711a548d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
770a98cc6e313ee42c20f2eac1af1487

SHA1
dcfc78eb8a31e33aa8600d4e775d23afb2975e8f

SHA256
8715b6b8949d9accca25fc09afa7b795831c62d7e55f542565ecbc8996efc9ed

SHA512
c569f9ca9164a31d3654c936de8fd53fb991999903aeb7b8897bf11759a5d3d61f13dbdefb377e3e5e9778049bd860f6acedd3afeedf29b400df88dc2091ed94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1009B

MD5
85b84f9c472f6845519d3fbc174f9410

SHA1
7fa8ff763d6f46f314bbca637bbbe50de6e17151

SHA256
e9481ab3eb42f0b68077b57e43b8290397b28dddc041ae3a10e27e1f09d4fe04

SHA512
29fbbff62cd1e29b979ad9b31281428f595a2d48e134a491731d587ed8eb7729f1b389a24c6e367e7c57e841e7cb26999e33c6d2f572090d756d66c6a9f39333

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7fafdf022f5c9d3a9318dcc20a1bf383

SHA1
d53877fb451737a5d97ca98b7f6193dd420af077

SHA256
b1f8519b526e160b378463b74d0a964afa20bfda0e84f8fe9300fd10dff11849

SHA512
13912abac7e01195af73577c1121f5a81553663877e78f9090354e8c1cd2e32846efa3587a4361a2499b068d8a47b344b012ff2dba98110a59e047db27218a16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
22e36b60f776429975ddcaee113226c5

SHA1
db4f4b9d3bade72a3a8f44dfe8c8dca63bcdf81e

SHA256
5f0f32c30034da2b615aa3b2d00957c0b5eb980d311eba776726c549a9102d69

SHA512
14756cc1946a01e0826c85ecac11b912b706e732ea3ba39a586b02ae7d3d334464e78a789b8c30d66584ecf9ebeb527e2ea3ea372d7e1505964fa5c0c63c90b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5a6206a3489650bf4a9c3ce44a428126

SHA1
3137a909ef8b098687ec536c57caa1bacc77224b

SHA256
0a9e623c6df237c02a585539bffb8249de48949c6d074fe0aaf43063731a3e28

SHA512
980da83c3142bf08433ec1770a2ec5f5560daf3ee680466f89beae8290e921c0db677489daad055fbc1f196388f8bc4f60e050600381f860b06d330062440a78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1d9befb020bef7b4f183fcbaf7f4fd1e

SHA1
82b7781a5f2c5b7552d28fc8fbdcfcd3355c4f44

SHA256
4f56fa7651b876bd021af7ba2249d9371c67d4744d2ed8e36ff7e2805ae4b16c

SHA512
2df87818f99c3e565960aba10225a44f976600d2234900eab7aecebe13a8c2525799f5228587bfa4863785c1eeab2cd69eab2ba73875ec6bac83954650b17b8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c9e66fa6a687657642eb2e63cbe8ccdb

SHA1
f79dc6d0f2418b6cf3d1107904f9109f4246543e

SHA256
0f2be2d24e4c310823d6500d0d7506adc14ab5015b7a616af825f57edb3f4ebd

SHA512
dd57ed77789864b1e83f88deccf8b6d82dcb2da112f1d5ad4a20392003d4c9d9fe4abf1ab6d7adcad2cee9b55c3f8167cdb1881b981f6a735f15b511c344e943

Download Submit