hxxp://google[.]com

Analysis

max time kernel
562s
max time network
491s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 18:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe
820	msedge.exe
820	msedge.exe
1032	identity_helper.exe
1032	identity_helper.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe
820	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 4048	820	msedge.exe	82
PID 820 wrote to memory of 4048	820	msedge.exe	82
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 2484	820	msedge.exe	83
PID 820 wrote to memory of 4216	820	msedge.exe	84
PID 820 wrote to memory of 4216	820	msedge.exe	84
PID 820 wrote to memory of 2000	820	msedge.exe	85
PID 820 wrote to memory of 2000	820	msedge.exe	85
PID 820 wrote to memory of 2000	820	msedge.exe	85
PID 820 wrote to memory of 2000	820	msedge.exe	85
PID 820 wrote to memory of 2000	820	msedge.exe	85
PID 820 wrote to memory of 2000	820	msedge.exe	85
PID 820 wrote to memory of 2000	820	msedge.exe	85
PID 820 wrote to memory of 2000	820	msedge.exe	85
PID 820 wrote to memory of 2000	820	msedge.exe	85
PID 820 wrote to memory of 2000	820	msedge.exe	85
PID 820 wrote to memory of 2000	820	msedge.exe	85
PID 820 wrote to memory of 2000	820	msedge.exe	85
PID 820 wrote to memory of 2000	820	msedge.exe	85
PID 820 wrote to memory of 2000	820	msedge.exe	85
PID 820 wrote to memory of 2000	820	msedge.exe	85
PID 820 wrote to memory of 2000	820	msedge.exe	85
PID 820 wrote to memory of 2000	820	msedge.exe	85
PID 820 wrote to memory of 2000	820	msedge.exe	85
PID 820 wrote to memory of 2000	820	msedge.exe	85
PID 820 wrote to memory of 2000	820	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb263f46f8,0x7ffb263f4708,0x7ffb263f4718
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,7847281184674049762,6282801097531917677,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,7847281184674049762,6282801097531917677,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,7847281184674049762,6282801097531917677,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7847281184674049762,6282801097531917677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7847281184674049762,6282801097531917677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7847281184674049762,6282801097531917677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,7847281184674049762,6282801097531917677,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,7847281184674049762,6282801097531917677,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7847281184674049762,6282801097531917677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7847281184674049762,6282801097531917677,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7847281184674049762,6282801097531917677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2988 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7847281184674049762,6282801097531917677,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,7847281184674049762,6282801097531917677,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\23dbfc51-62a6-47f1-ac72-64b4b436b7d4.tmp

Filesize
5KB

MD5
aa69619964ae1bba2d505fa601542cda

SHA1
b2c6ab3be4d66dc18be7c63be70736e3c419ed88

SHA256
fb435dc0d9839a086f5af0bd5abbf90780d1ef4dccfe25d0371133920eeede7c

SHA512
d5c3d74342a4005f77f8f8327d71ad74bf44843100aead2d2811056423e4b3b8619ecc75b931f606316902c97a76870cc4f83dc6059715a4d32b4a6999b8e668

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
9a4547d77f288f12d643f3b44af56882

SHA1
7eb2051268191f11c54ef495455ab7a7e684efcf

SHA256
96d6fb627af8a3ec78089365fb1930771ecb23940846f0b0ce83010fe473667b

SHA512
8970f10daad03ef0e2775a8b3df8ea6a2a08532069776afe09a1c35985bb68e019f37f50352792d3f93d12ba4746f05d31a2cf2e9964f1481942575596aaa257

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
560b253550b6e78bd205f3466e440e97

SHA1
a330e0eb5ccd3e86ec86c7b7e2306755a89baa31

SHA256
5153b871fdcdfa6149efb87543b7a8a6d95a691f126a82091a4532a82307e412

SHA512
55eb8e9bc48cefcd3596ca681bacb2d8387ea1c526dd41b7241af830d8a08e330d025b44b8ad3e4718d21f8712f13bfc0710bd855a4195a47324a96a362e2320

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4300fdd2ad0562ee2ff27ba0eabd453e

SHA1
4b48314ec4e76c9e430a491be9b9958ce100bcc6

SHA256
ce8f9bc871305dcdcab22e8d4c8230943b5e0d9d924a53f84b053d2b31329228

SHA512
72300e5bd8107f4827c993c99e4d76b3dd48a0111229d78492394490c78c5e68fc0d4ec3cf1e197af980eca42b91a82a1f8e6e0ffa890831c10b54b3a1451f6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7fdb550e0392f45664617af51e4ef3d7

SHA1
2c2469b66f1b899dfa7f1609b99317dca22dcde7

SHA256
a426d9bfc9fb8e2c9385314f3520b64b622a3475b4507413b25655f5c9a5b6d7

SHA512
becd0f0146bb8b5d6bcb380a5c85c179b00888276e377a036f855f27cef84ae731a76aaaac4d633965466633be2ca63c4d68fa69a89fe7192021a9707aa8f57f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
74246af361a7f6e99f02bcd5a6bcc179

SHA1
052d4cd88c84ce42dadc7645cf3a24f64310bebe

SHA256
22c2431c7b514c35e8138e74053c35088356131007ecfff18ce3a49faf3977d9

SHA512
976904bf37512d9ba1fff0e854d7d8f4257ef08bf89e9990532a1f8b3f9f98db3490f64e14b2cf39026a4760d4dad995a5ffee3b3e801348938cfb85ea40c0bd

Download Submit