hxxp://google[.]com

Analysis

max time kernel
38s
max time network
39s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
03-02-2024 18:03

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

http://google.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "121"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4960	msedge.exe
4960	msedge.exe
1504	identity_helper.exe
1504	identity_helper.exe
2448	msedge.exe
2448	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1064	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 4384	4960	msedge.exe	73
PID 4960 wrote to memory of 4384	4960	msedge.exe	73
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4548	4960	msedge.exe	78
PID 4960 wrote to memory of 4252	4960	msedge.exe	77
PID 4960 wrote to memory of 4252	4960	msedge.exe	77
PID 4960 wrote to memory of 4900	4960	msedge.exe	79
PID 4960 wrote to memory of 4900	4960	msedge.exe	79
PID 4960 wrote to memory of 4900	4960	msedge.exe	79
PID 4960 wrote to memory of 4900	4960	msedge.exe	79
PID 4960 wrote to memory of 4900	4960	msedge.exe	79
PID 4960 wrote to memory of 4900	4960	msedge.exe	79
PID 4960 wrote to memory of 4900	4960	msedge.exe	79
PID 4960 wrote to memory of 4900	4960	msedge.exe	79
PID 4960 wrote to memory of 4900	4960	msedge.exe	79
PID 4960 wrote to memory of 4900	4960	msedge.exe	79
PID 4960 wrote to memory of 4900	4960	msedge.exe	79
PID 4960 wrote to memory of 4900	4960	msedge.exe	79
PID 4960 wrote to memory of 4900	4960	msedge.exe	79
PID 4960 wrote to memory of 4900	4960	msedge.exe	79
PID 4960 wrote to memory of 4900	4960	msedge.exe	79
PID 4960 wrote to memory of 4900	4960	msedge.exe	79
PID 4960 wrote to memory of 4900	4960	msedge.exe	79
PID 4960 wrote to memory of 4900	4960	msedge.exe	79
PID 4960 wrote to memory of 4900	4960	msedge.exe	79
PID 4960 wrote to memory of 4900	4960	msedge.exe	79

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbaba73cb8,0x7ffbaba73cc8,0x7ffbaba73cd8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,16210360053165978027,12839746858113238228,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,16210360053165978027,12839746858113238228,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1884 /prefetch:2
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,16210360053165978027,12839746858113238228,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,16210360053165978027,12839746858113238228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,16210360053165978027,12839746858113238228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,16210360053165978027,12839746858113238228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,16210360053165978027,12839746858113238228,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,16210360053165978027,12839746858113238228,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4816

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a15055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5cabc17286e25c0ade7a7f050b6e92a6

SHA1
c25ab09177ad0da9ee6caf78310236bdc2cba319

SHA256
0e75f9140c154297d8f741aea07b90fc1be1b8deb79c3f204148471800e322b6

SHA512
0cc35eda0168f51e5e719ba0bfb226c9f5293a6056d47190a23377deb98244f42c62b8416696cdd13b2db6228c1c8a2513cdf6dbb1d4b59f0c1c889d1acee6e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
1e1229f3bf1b425b9d56ed94332d5633

SHA1
cfcc6c11dc02361f55856847411a2a9c56998b81

SHA256
39454bd622bb626267d372edfbec118e9a352552b0ecec1290feee5c1d5b060c

SHA512
d76c1e9ff8f5225cb799be001c20344ca5779bda6c85173f4d93d94657fd55cabfdd7308a2f445e225c54f0e52b25a95980bf4eb2dcd11caf36bd34a66484037

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
e9ae1ef39cba897f19984f5c18f591da

SHA1
96011bd777f0b4a8ec28ae686e79b08c5ee0021c

SHA256
1f90ff9d9fa55079d0532013ab0c904d770b5722e54091fbaa6811b56c937ce5

SHA512
1e02cadd2df38ff00b021aa15af4d20f4cbab5dada2b4b9fed5cd8703a460c7ee9c970fc31cce98616ab1d805021b41efa51279798772e81fb9a9ed58e94d250

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
e2ecad3fa2830133f318259234bde1e1

SHA1
503ae41a318b4a01ad93117cb3c4dd71175ddf3f

SHA256
30bce128eb95a1e1a8d4a9664b4ef34df6bf6f5c7b6c7e295891011a23180f46

SHA512
4275c2d5d4491fcc9491b2d7caa7ee20bef7d2cdaa3a165bffa20b990481272cc2d923639ae138f7e4a7a401241f882114accc5caf264dd8f83c99481a8b891e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7dc33fca9f5033256d95ec1c5dba6dcd

SHA1
6fc556d3e62300e00995fdae3ac84b5b56ae57d6

SHA256
74623b5f75c86f1d92aecf5ab9e534fd7ca95da40c489d18ea3676ae17627d35

SHA512
d9a26694a618774ad8935fd8559a0e59beed2afc9036e2378ff36fc7616783e97505f5f0749c3d5d4699d40562c90963b890d61b595fd6c92ac73266460752d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
97444285f24f572e0055295fbf314cd0

SHA1
28ebba712803e435ea9af22bb3715b993eb5d932

SHA256
d8127faed53dd5cf6b5a32b14f628c57d41a468f611fc525f308a8440cb4557b

SHA512
d6c18234dda659a85f92d47f9da4eb72594d7a6ff2b471a348c1df34334037278be4c569ba436047eef046fb590a3a400a62fde39c296740d90ad1c3b3f38470

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
68fe6f34e7d6603a3d2f4c95919f8408

SHA1
c7be30582f94d46f05338cc39726f72c9e2fa4cf

SHA256
8cba909149b2d3fc45315cf63cdb8fbe42a4b7c614347171ba00aaf859639c1a

SHA512
48eac2f55675b01ebeb28680ed9af6dcb9c558f76fd647cf05f8a7e1fa04ee57f7a8c70bc0ea882bdbca48b29d62ea7af74b76a03b09c19762e4c93118929be1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
daddb796a7bc5d949ad54e6513eb8caf

SHA1
aff53dc451559324b44431fb4d2c6b541010854e

SHA256
89e6dcff47f35da6a4b92656159248f2cb6bdc6c3ada4478692237b69497ab70

SHA512
91d751b800032bfdae0fa0871890ac27283f9ca0733c68f6c251e1a97abb6661a697473491ab783c30a85bc8b9761b2b22034962844134674be49d4fdf3986fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5911bc8a740e256f5cdd0d0360a2d92c

SHA1
962b57d19da55eb5b135e6c9b1e6e578bcd39a40

SHA256
9ba0b4f5778c5c967fa62f1e8a5c0e70d2b14bcbaa339badbe34d52902f58a70

SHA512
0b72ce4ae5686f1a89212dd1d63f8a899b750ae3a9c2fd01910fb980753442d06eab7cf061bfcf0377b8bb1619203b3f283f84773237b8f05454f5b9f4dd6710

Download Submit