hxxps://ad-freegames[.]github[.]io/

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
24/06/2024, 09:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://ad-freegames.github.io/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe
1844	msedge.exe
1844	msedge.exe
3628	identity_helper.exe
3628	identity_helper.exe
3724	msedge.exe
3724	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe
1844	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 1096	1844	msedge.exe	77
PID 1844 wrote to memory of 1096	1844	msedge.exe	77
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3240	1844	msedge.exe	78
PID 1844 wrote to memory of 3736	1844	msedge.exe	79
PID 1844 wrote to memory of 3736	1844	msedge.exe	79
PID 1844 wrote to memory of 4684	1844	msedge.exe	80
PID 1844 wrote to memory of 4684	1844	msedge.exe	80
PID 1844 wrote to memory of 4684	1844	msedge.exe	80
PID 1844 wrote to memory of 4684	1844	msedge.exe	80
PID 1844 wrote to memory of 4684	1844	msedge.exe	80
PID 1844 wrote to memory of 4684	1844	msedge.exe	80
PID 1844 wrote to memory of 4684	1844	msedge.exe	80
PID 1844 wrote to memory of 4684	1844	msedge.exe	80
PID 1844 wrote to memory of 4684	1844	msedge.exe	80
PID 1844 wrote to memory of 4684	1844	msedge.exe	80
PID 1844 wrote to memory of 4684	1844	msedge.exe	80
PID 1844 wrote to memory of 4684	1844	msedge.exe	80
PID 1844 wrote to memory of 4684	1844	msedge.exe	80
PID 1844 wrote to memory of 4684	1844	msedge.exe	80
PID 1844 wrote to memory of 4684	1844	msedge.exe	80
PID 1844 wrote to memory of 4684	1844	msedge.exe	80
PID 1844 wrote to memory of 4684	1844	msedge.exe	80
PID 1844 wrote to memory of 4684	1844	msedge.exe	80
PID 1844 wrote to memory of 4684	1844	msedge.exe	80
PID 1844 wrote to memory of 4684	1844	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ad-freegames.github.io/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9a6713cb8,0x7ff9a6713cc8,0x7ff9a6713cd8
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1852,7214588168559091031,3528469637340188439,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1860 /prefetch:2
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1852,7214588168559091031,3528469637340188439,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1852,7214588168559091031,3528469637340188439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,7214588168559091031,3528469637340188439,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,7214588168559091031,3528469637340188439,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1852,7214588168559091031,3528469637340188439,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1852,7214588168559091031,3528469637340188439,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,7214588168559091031,3528469637340188439,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2448 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,7214588168559091031,3528469637340188439,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,7214588168559091031,3528469637340188439,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1852,7214588168559091031,3528469637340188439,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1852,7214588168559091031,3528469637340188439,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4816 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6876cbd342d4d6b236f44f52c50f780f

SHA1
a215cf6a499bfb67a3266d211844ec4c82128d83

SHA256
ca5a6320d94ee74db11e55893a42a52c56c8f067cba35594d507b593d993451e

SHA512
dff3675753b6b733ffa2da73d28a250a52ab29620935960673d77fe2f90d37a273c8c6afdf87db959bdb49f31b69b41f7aa4febac5bbdd43a9706a4dd9705039

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c1c7e2f451eb3836d23007799bc21d5f

SHA1
11a25f6055210aa7f99d77346b0d4f1dc123ce79

SHA256
429a870d582c77c8a661c8cc3f4afa424ed5faf64ce722f51a6a74f66b21c800

SHA512
2ca40bbbe76488dff4b10cca78a81ecf2e97d75cd65f301da4414d93e08e33f231171d455b0dbf012b2d4735428e835bf3631f678f0ab203383e315da2d23a34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
841B

MD5
980dddf4cfd83107ca039573ceef2f69

SHA1
1253afe05c8fd707ecd1fba14e3009dbccc25184

SHA256
2a20546184885504e8e6cb6865054b738b50194837e61bb8a50c398e43b2209f

SHA512
441fb776d2ebdf8ee47b231c222ff0a4d82820a4e6810ee549630ea8974fc7e9dc8976a494839e381c5dc9aeabaa7de25cfb6f05a8e7fa2534df3974b87f61a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2dd58651932e8ceee0f4103f70d8207d

SHA1
36ff60f55336d8d96b69e5772baebad84a8d1ef8

SHA256
a65a2430039b952eb6389a111164ee93192b9f6e7b98d9194a6ce15e23f23d31

SHA512
5502a86234116c6eec9211692700823ef776c25b144d8a7570555bc6271c46ee00d172dd7d10f5e5feae20e3989440b30596da12cd9a0168d11f5ee65243cb0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ff85e1edb35e0e95ff630da36149d22c

SHA1
e275c2928829f46e5cfc9f6870cd47818ae81f06

SHA256
c417b9cb69f5f02da5085dad6058b2bddf52023f297aebcdfbe5c8643a84f2f6

SHA512
4f5d42cbf1d5bf7340644c55f9b2f06853f643a0a84885e6f51eff07cc762008ea22b60c4dab88d463090ca8f03e830c643e9236d42b5ee17409a2a79ba9e3a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0f2bebecc7668324c75689c8d5823ed3

SHA1
826a3b222aee7bf0a688f6bcbf5e203e9b8fb473

SHA256
27c02af1ae3641d76093483bdf71e29b320f87c29f4f4e17437818e18c6faaaf

SHA512
dc0982fccb37d6600b323dcb561ab6985aa6521b48c5107b7a142ace215708a7b8e70ae0825eb0e795ad666fa4c1e47a0a36686a05f8c27b55f2a13d6d554f4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7fa434aeb6b40323083d1bf7bd891f01

SHA1
5450e521edac2734965b35450e98ccdfa463ac50

SHA256
c7203b82080d27ab716d8bc6f8cae6659cde33c31b145543a3b15bd73c1c9565

SHA512
afe5dc52fbbb6e5069675db4098e962b2d26c724527e6d0e9b4299b9d77048484747ca4c1429ef0c1caf2827217d1405f8ba5601c39610bea88908d65f8ad660

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
13d81f77596c13afe4aa1a54080a6bd5

SHA1
e53fe3aec28969634d884a88782d5766ccbe1a1a

SHA256
3febf756d263f641365b277ff46ea76c7b5cc8c0b1cd90f4c1ec0d05338a3d4b

SHA512
b86965a7cbc6a27a5bc6262b2d953e22be9e876ffccf8c4392a9aa76b9ffb7f6641ed15c32ab4313100e8b4eebb663de193ec58b9ad0fc32d7544ba004ccf06a

Download Submit