hxxp://now[.]gg

Analysis

max time kernel
1772s
max time network
1774s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-02-2024 15:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://now.gg

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
34	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe
4908	msedge.exe
4908	msedge.exe
2976	identity_helper.exe
2976	identity_helper.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 2684	4908	msedge.exe	19
PID 4908 wrote to memory of 2684	4908	msedge.exe	19
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 5052	4908	msedge.exe	87
PID 4908 wrote to memory of 4228	4908	msedge.exe	85
PID 4908 wrote to memory of 4228	4908	msedge.exe	85
PID 4908 wrote to memory of 1588	4908	msedge.exe	86
PID 4908 wrote to memory of 1588	4908	msedge.exe	86
PID 4908 wrote to memory of 1588	4908	msedge.exe	86
PID 4908 wrote to memory of 1588	4908	msedge.exe	86
PID 4908 wrote to memory of 1588	4908	msedge.exe	86
PID 4908 wrote to memory of 1588	4908	msedge.exe	86
PID 4908 wrote to memory of 1588	4908	msedge.exe	86
PID 4908 wrote to memory of 1588	4908	msedge.exe	86
PID 4908 wrote to memory of 1588	4908	msedge.exe	86
PID 4908 wrote to memory of 1588	4908	msedge.exe	86
PID 4908 wrote to memory of 1588	4908	msedge.exe	86
PID 4908 wrote to memory of 1588	4908	msedge.exe	86
PID 4908 wrote to memory of 1588	4908	msedge.exe	86
PID 4908 wrote to memory of 1588	4908	msedge.exe	86
PID 4908 wrote to memory of 1588	4908	msedge.exe	86
PID 4908 wrote to memory of 1588	4908	msedge.exe	86
PID 4908 wrote to memory of 1588	4908	msedge.exe	86
PID 4908 wrote to memory of 1588	4908	msedge.exe	86
PID 4908 wrote to memory of 1588	4908	msedge.exe	86
PID 4908 wrote to memory of 1588	4908	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://now.gg
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ff9406b46f8,0x7ff9406b4708,0x7ff9406b4718
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,9560923491160536504,3013568883484371660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,9560923491160536504,3013568883484371660,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,9560923491160536504,3013568883484371660,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9560923491160536504,3013568883484371660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9560923491160536504,3013568883484371660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9560923491160536504,3013568883484371660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,9560923491160536504,3013568883484371660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,9560923491160536504,3013568883484371660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9560923491160536504,3013568883484371660,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9560923491160536504,3013568883484371660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9560923491160536504,3013568883484371660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9560923491160536504,3013568883484371660,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,9560923491160536504,3013568883484371660,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4836 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bcaf436ee5fed204f08c14d7517436eb

SHA1
637817252f1e2ab00275cd5b5a285a22980295ff

SHA256
de776d807ae7f2e809af69746f85ea99e0771bbdaaed78a764a6035dabe7f120

SHA512
7e6cf2fdffdcf444f6ef4a50a6f9ef1dfb853301467e3f4784c9ee905c3bf159dc3ee9145d77dbf72637d5b99242525eb951b91c020e5f4e5cfcfd965443258c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
7fcd237e4309a9437e63b7668e36f763

SHA1
f0d7a09b9abb80b76c2aebc9cb05b48b750748f3

SHA256
e967d016e8494f9cd92970c9d91398ff4e7145f1a9104c31d2c528864ff95725

SHA512
f03e1261793fd2378211fa84f56f600fe33eb801c9e1489228b306526d9051fb4049612f6c82e1973c0d87d43d0867286a375895cb57147e2943473131636d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
447699fe6311dd5e9ce7da8e39092104

SHA1
59017e67b35df77a8073fff6dff9447eb0c09f08

SHA256
d410bb2a8dd46940b995bfdbe0b062c6c8b6865815888c8dac470230d1ef540c

SHA512
dddc08829fafc29adaa224db5332d61af8d48a5098883beeab280c69786cd3c4ac3e81e60172aef827f153aa3a038b4c098efad52e9204567119151b32759ecf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f7ab547915ce58a75773824c55420ec4

SHA1
a9fb5fbd3b3a50a82f10ea3f8897cec1827c01e8

SHA256
e45d69fd394e2edcd56e85bdedd7bafd2f3b11705d8c8037cb08b1c7f8a546a9

SHA512
a404c99ee237607edcc6448c5f4e2caa8514b242eb6219d4d893884cee939986c3ef79731ae22d184326ed6d43a7aa6cdcae9a159a0edd9a76aaa47dd8dca9a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0b9949c47955ff3d554833727b8914b8

SHA1
2717564cf3acd55677fa508d0903fda74269efb8

SHA256
9e7398041ac58a0400f5cb0865c9f32948b6fce8ec370442bd5cbf5043636ba6

SHA512
cdd6508b675d4dcd93c5f3d91259a942bf95cd1166dfea930c1eb36cd320cd086160176202553558ece562566c653258264b5c14e6f3fe07966997f36219d2fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
b0ba6f0eee8f998b4d78bc4934f5fd17

SHA1
589653d624de363d3e8869c169441b143c1f39ad

SHA256
4b5ee509e727accbd11493dda2c1d512e7dbfaff66c4f5f7ea9c2d2ccd06151f

SHA512
e9a165da246c6b80fc38431538203cf03f95794184ff63f00c9500f8919a2028b803f64b670e685185eed72df0509e3185c9b434fdbf2bc7af36021d46bd08d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
570c8d1b3228a99b522d7cb3ca527c35

SHA1
32910661f76da4c854a233f37ff8acbad0b27373

SHA256
63cf9b61808c6c19b279e8b67f6611c0130b88d1a87a6ee03aa738de26516204

SHA512
2676da8805cf715947bf03879039685951af8caf37b9f4f2d9fbf3e75a235c632c0add96ed3239da4baee2be27ee4896514b861eef9b86df7451ba47fa2fc519

Download Submit