hxxps://googllesecurity[.]net/admin/p/Z1lHL1ZYVHNOR1ZWb2ZBQXlaSTR1dz09

Analysis

max time kernel
146s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-04-2024 20:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://googllesecurity.net/admin/p/Z1lHL1ZYVHNOR1ZWb2ZBQXlaSTR1dz09

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1496	msedge.exe
1496	msedge.exe
4584	msedge.exe
4584	msedge.exe
4940	identity_helper.exe
4940	identity_helper.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4272	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4272	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe
4584	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 4896	4584	msedge.exe	84
PID 4584 wrote to memory of 4896	4584	msedge.exe	84
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 2792	4584	msedge.exe	85
PID 4584 wrote to memory of 1496	4584	msedge.exe	86
PID 4584 wrote to memory of 1496	4584	msedge.exe	86
PID 4584 wrote to memory of 1596	4584	msedge.exe	87
PID 4584 wrote to memory of 1596	4584	msedge.exe	87
PID 4584 wrote to memory of 1596	4584	msedge.exe	87
PID 4584 wrote to memory of 1596	4584	msedge.exe	87
PID 4584 wrote to memory of 1596	4584	msedge.exe	87
PID 4584 wrote to memory of 1596	4584	msedge.exe	87
PID 4584 wrote to memory of 1596	4584	msedge.exe	87
PID 4584 wrote to memory of 1596	4584	msedge.exe	87
PID 4584 wrote to memory of 1596	4584	msedge.exe	87
PID 4584 wrote to memory of 1596	4584	msedge.exe	87
PID 4584 wrote to memory of 1596	4584	msedge.exe	87
PID 4584 wrote to memory of 1596	4584	msedge.exe	87
PID 4584 wrote to memory of 1596	4584	msedge.exe	87
PID 4584 wrote to memory of 1596	4584	msedge.exe	87
PID 4584 wrote to memory of 1596	4584	msedge.exe	87
PID 4584 wrote to memory of 1596	4584	msedge.exe	87
PID 4584 wrote to memory of 1596	4584	msedge.exe	87
PID 4584 wrote to memory of 1596	4584	msedge.exe	87
PID 4584 wrote to memory of 1596	4584	msedge.exe	87
PID 4584 wrote to memory of 1596	4584	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://googllesecurity.net/admin/p/Z1lHL1ZYVHNOR1ZWb2ZBQXlaSTR1dz09
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad5df46f8,0x7ffad5df4708,0x7ffad5df4718
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,1402637543611472236,13025026127135287613,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,1402637543611472236,13025026127135287613,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,1402637543611472236,13025026127135287613,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,1402637543611472236,13025026127135287613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,1402637543611472236,13025026127135287613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2224,1402637543611472236,13025026127135287613,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,1402637543611472236,13025026127135287613,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,1402637543611472236,13025026127135287613,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,1402637543611472236,13025026127135287613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,1402637543611472236,13025026127135287613,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,1402637543611472236,13025026127135287613,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,1402637543611472236,13025026127135287613,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,1402637543611472236,13025026127135287613,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5528 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4908

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x328 0x32c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e494d16e4b331d7fc483b3ae3b2e0973

SHA1
d13ca61b6404902b716f7b02f0070dec7f36edbf

SHA256
a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165

SHA512
016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0764f5481d3c05f5d391a36463484b49

SHA1
2c96194f04e768ac9d7134bc242808e4d8aeb149

SHA256
cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3

SHA512
a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
b1fcdf7f87fafd3eb2d52c175865d6e8

SHA1
56f3f89bbd38eeb8784e7b9c151b4811eead6716

SHA256
8590fd3c2528f91f49312d30f194094480c301cbe860c3bfef515624f2dde8ca

SHA512
ebd6c53d195ed5241506f532713446850fd074f5394b8af152bfd13055520a6e7cde3878953a64d3ddf654cbfc3c55ef2c713a786861354f1503691740d89422

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1f685022bdf7c08dcb38d70e31817541

SHA1
f692e8e0ec0695460b78727e1ff3bf6e9889ac01

SHA256
50472268fa39e35801187fb10c6c92c93b6d7b477c2b9c5ef047598698964b6e

SHA512
e155131814ec90d79c297d4d81270eb200124a5aec1dcd4cf08cbd921295629aedda8d18c96b961c0f7084c3d443a17de33da6eadc0f7d8d5e764c28b9785264

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3e9c6f5554f9c8a0eb21154a87631860

SHA1
bf0f955b90289f13daa5a198f1b17fa34765c0c7

SHA256
269dc7f3fb5ed6eae60c1cebc34d2caeb68ac0089a18a59b81d0b37b4e5415a2

SHA512
e21276df4a91fe65e1d5caac73fa65f3e40e0208e27e01fba217cc985346735e1bbccbbdf21a84f09eadf2e51d4560993a4ea7ce5b42cae81e871cbdf4a04932

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
deacc4092d6520f50e5735883bef00a1

SHA1
195f99ac463496865a89ceb6d4849e9f09d97279

SHA256
2a49cb998d2a6b04209cc989aaa45147d834d3ddeb91d49d35c414fe0c556fc6

SHA512
984f8c3a92bc08f77e9d2e3b093dd716b0970f75cb527c1735a5b3efda5901078431ae7b7a0061864cf92526984a43aee0e394c343e91e72a443cb0dd23578cf

Download Submit