hxxps://docs[.]google[.]com/presentation/d/e/2PACX-1vSJUSFifoEMNM4fmmaaxc31n8Dv2TmkzzQ0_NOxxMD7L7FflOxqlerCQQe7nIF6QXoaMrzhjqDvbZbm/pub?start=false&loop=false&delayms=3000

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 06:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://docs.google.com/presentation/d/e/2PACX-1vSJUSFifoEMNM4fmmaaxc31n8Dv2TmkzzQ0_NOxxMD7L7FflOxqlerCQQe7nIF6QXoaMrzhjqDvbZbm/pub?start=false&loop=false&delayms=3000

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2944	msedge.exe
2944	msedge.exe
3020	msedge.exe
3020	msedge.exe
3452	identity_helper.exe
3452	identity_helper.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe
3488	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 4768	3020	msedge.exe	91
PID 3020 wrote to memory of 4768	3020	msedge.exe	91
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 3684	3020	msedge.exe	92
PID 3020 wrote to memory of 2944	3020	msedge.exe	93
PID 3020 wrote to memory of 2944	3020	msedge.exe	93
PID 3020 wrote to memory of 504	3020	msedge.exe	94
PID 3020 wrote to memory of 504	3020	msedge.exe	94
PID 3020 wrote to memory of 504	3020	msedge.exe	94
PID 3020 wrote to memory of 504	3020	msedge.exe	94
PID 3020 wrote to memory of 504	3020	msedge.exe	94
PID 3020 wrote to memory of 504	3020	msedge.exe	94
PID 3020 wrote to memory of 504	3020	msedge.exe	94
PID 3020 wrote to memory of 504	3020	msedge.exe	94
PID 3020 wrote to memory of 504	3020	msedge.exe	94
PID 3020 wrote to memory of 504	3020	msedge.exe	94
PID 3020 wrote to memory of 504	3020	msedge.exe	94
PID 3020 wrote to memory of 504	3020	msedge.exe	94
PID 3020 wrote to memory of 504	3020	msedge.exe	94
PID 3020 wrote to memory of 504	3020	msedge.exe	94
PID 3020 wrote to memory of 504	3020	msedge.exe	94
PID 3020 wrote to memory of 504	3020	msedge.exe	94
PID 3020 wrote to memory of 504	3020	msedge.exe	94
PID 3020 wrote to memory of 504	3020	msedge.exe	94
PID 3020 wrote to memory of 504	3020	msedge.exe	94
PID 3020 wrote to memory of 504	3020	msedge.exe	94

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://docs.google.com/presentation/d/e/2PACX-1vSJUSFifoEMNM4fmmaaxc31n8Dv2TmkzzQ0_NOxxMD7L7FflOxqlerCQQe7nIF6QXoaMrzhjqDvbZbm/pub?start=false&loop=false&delayms=3000
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffffaa846f8,0x7ffffaa84708,0x7ffffaa84718
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,17863602485625578923,8814820196464715628,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,17863602485625578923,8814820196464715628,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,17863602485625578923,8814820196464715628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17863602485625578923,8814820196464715628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17863602485625578923,8814820196464715628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,17863602485625578923,8814820196464715628,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,17863602485625578923,8814820196464715628,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17863602485625578923,8814820196464715628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17863602485625578923,8814820196464715628,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17863602485625578923,8814820196464715628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17863602485625578923,8814820196464715628,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,17863602485625578923,8814820196464715628,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7740a919423ddc469647f8fdd981324d

SHA1
c1bc3f834507e4940a0b7594e34c4b83bbea7cda

SHA256
bdd4adaa418d40558ab033ac0005fd6c2312d5f1f7fdf8b0e186fe1d65d78221

SHA512
7ad98d5d089808d9a707d577e76e809a223d3007778a672734d0a607c2c3ac5f93bc72adb6e6c7f878a577d3a1e69a16d0cd871eb6f58b8d88e2ea25f77d87b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f44d6f922f830d04d7463189045a5a3

SHA1
2e9ae7188ab8f88078e83ba7f42a11a2c421cb1c

SHA256
0ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a

SHA512
7c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
642488ab24b8aadf07e8856ddadb608f

SHA1
ec5a35a3d58f4a963b5a8d9d8d9d7c4ac4c2ca89

SHA256
d83f0ce061db841b5d47d80b75ec745e08ee11c3f593098b7b7681a4b0ea22a6

SHA512
15766357a36b399535d28d9b0a4c0fda14626c0a51b11628b812adbdc3208205eb5c2f3da61f811c12b3bc8bbf70cc3165690f41e3afeccae5e08fd648d07618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6a6f374750da717cd504d2c5af813c85

SHA1
d77c2988f0da72471bb4b1c259e145907823bbd7

SHA256
f6508fa07ef98b9ae48209448eb87275c888da5d2ddb9ed4dbfa3ae9d39a9edc

SHA512
e55d3bce921feb921c8099674a19c4513707eccf754f43393c551bb4e3964c8c5138b33056cee247ecb8283e9d5fd3a85ca6ac9acba69e2c239c61e7ba235c46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b246959db0032dd3bd167a0d73adde02

SHA1
429a0df7e90e5721357082f399db12eec70387a6

SHA256
861e73ff4365cc36e91d5b7a40d8513a39c38425d78206361cc273b464d85ef2

SHA512
fd1f858db8d474fbe108c4cade1ccf70a019132bca08ea20f381d1e0bcbb27e4d368319fc24643f4113e6617d6ca3d94a3cbd9ebfc4e48882e34629bd1719e02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bc06cb78651a3e0962bda9133f8b622a

SHA1
0e2515986ed74eec6960926f63dcee4f991bc530

SHA256
9d7ec791676de533dde3f0db6ed9c64ec469d27bc0fc79889c09298cc46ab51e

SHA512
e8fbe89349435e10cc6839566dee9fb82e48b5088a6e844b98a073ef42977c5105b55e533aef38ac4e1bd867927cfc9e79e2cbe84c85372d033a2ee8004e7ba5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ab897aeb35943d7e67e1451a2d9230da

SHA1
12b85f284573517d8c22d37a66222999af78f0e8

SHA256
7b9207b45add6b3d447357100bb9550f14ae44b35d8423569a32130d104a8f1c

SHA512
834674e2221f09a27f559d1daf651b607419089f67ff9f1824c291663104bf674294e6fd60700958843b5c5246e224ecc3fc8666bb56ce5da91b24077edeb17e

Download Submit