hxxps://www[.]google[.]ca/

Resubmissions

20/07/2024, 15:05

240720-sgn15a1gll 1

20/07/2024, 14:48

240720-r6jx2a1epj 10

Analysis

max time kernel
145s
max time network
138s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
20/07/2024, 15:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.google.ca/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
1068	msedge.exe
1068	msedge.exe
652	msedge.exe
652	msedge.exe
1440	identity_helper.exe
1440	identity_helper.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 4676	1068	msedge.exe	82
PID 1068 wrote to memory of 4676	1068	msedge.exe	82
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 2568	1068	msedge.exe	83
PID 1068 wrote to memory of 4040	1068	msedge.exe	84
PID 1068 wrote to memory of 4040	1068	msedge.exe	84
PID 1068 wrote to memory of 656	1068	msedge.exe	85
PID 1068 wrote to memory of 656	1068	msedge.exe	85
PID 1068 wrote to memory of 656	1068	msedge.exe	85
PID 1068 wrote to memory of 656	1068	msedge.exe	85
PID 1068 wrote to memory of 656	1068	msedge.exe	85
PID 1068 wrote to memory of 656	1068	msedge.exe	85
PID 1068 wrote to memory of 656	1068	msedge.exe	85
PID 1068 wrote to memory of 656	1068	msedge.exe	85
PID 1068 wrote to memory of 656	1068	msedge.exe	85
PID 1068 wrote to memory of 656	1068	msedge.exe	85
PID 1068 wrote to memory of 656	1068	msedge.exe	85
PID 1068 wrote to memory of 656	1068	msedge.exe	85
PID 1068 wrote to memory of 656	1068	msedge.exe	85
PID 1068 wrote to memory of 656	1068	msedge.exe	85
PID 1068 wrote to memory of 656	1068	msedge.exe	85
PID 1068 wrote to memory of 656	1068	msedge.exe	85
PID 1068 wrote to memory of 656	1068	msedge.exe	85
PID 1068 wrote to memory of 656	1068	msedge.exe	85
PID 1068 wrote to memory of 656	1068	msedge.exe	85
PID 1068 wrote to memory of 656	1068	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.ca/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffec7493cb8,0x7ffec7493cc8,0x7ffec7493cd8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,17802119286268883894,940481744674632012,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1956,17802119286268883894,940481744674632012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1956,17802119286268883894,940481744674632012,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,17802119286268883894,940481744674632012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,17802119286268883894,940481744674632012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,17802119286268883894,940481744674632012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1956,17802119286268883894,940481744674632012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3528 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1956,17802119286268883894,940481744674632012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,17802119286268883894,940481744674632012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,17802119286268883894,940481744674632012,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,17802119286268883894,940481744674632012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1956,17802119286268883894,940481744674632012,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1956,17802119286268883894,940481744674632012,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4572 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
afe63f44aa3aa9393e4251b4b74226e3

SHA1
29eef15e4d60afed127861deebc7196e97d19e4a

SHA256
7787181844d106768f78847869b5e784f07c1b65109d59b46932979bac823cd3

SHA512
f0f7951b5d55c2cbb71add5ab0c2ed3617a6fdf93f2c81ee9dd15d9f7c67881b42cbfd97cc4d2f17ba8a383624b23da1897fee069ddcee34233c1f625062a1cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b0c53c5fe6ad2ee4ffbde1b3384d027

SHA1
0c9ae4f75a65ed95159b6eb75c3c7b48971f3e71

SHA256
2e9fc3b050296902d0bb0ce6b8acc0bb54440f75f54f1f04ae95c9956108171f

SHA512
29f62e085d685d3b4902515790ab4f298454d0f8d53b6234fae9f9a0edffdd0d4edee57261e8eb0b94a4af8e86d3f7ab8b044c6f259576b89f91183002e58b42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
211KB

MD5
151fb811968eaf8efb840908b89dc9d4

SHA1
7ec811009fd9b0e6d92d12d78b002275f2f1bee1

SHA256
043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed

SHA512
83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
a96ecddf6eae3d4360352dd74b206b3a

SHA1
92008ded4101a37e51c0fa918297d5c21b151e60

SHA256
d832200c94967aaa814151216f80162848705bf8da46c4867074fb97af89b985

SHA512
41a3cc00273cb1ef275040911acb74c06e5da0d2a7e89f7158ca91ca5db2485807dc8550e9ed2c772213de21945c672dcf4f5cf1cca04612290efa83f24ab56d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
aa301eea6de7ffe82775979b61c470cf

SHA1
b7d73fe8e8218afdc5f0b9417d16caf94fbb79f6

SHA256
fd2847836707a8a65feee024ac3b251e8749361360142235d939a0141f2cce11

SHA512
27408bff0eb8a48370e1aa30d4052185f46f76bee8391464b0ea6fbdf74a282ca9880807ef3086a43d288b40aba1f91a25fbbfa0bec4edce55a2085ca73110e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
54beb8f53bc145601842c9b52cc2b86b

SHA1
98100ecec39095738f7ff54324953b1258ffeb8f

SHA256
3372dcdf38d6628249be683dafba3cdcb484651c00bbfcdb67c99f9bcc513083

SHA512
62d8e4caa4b9f479622067b412ba0033452951b2dedc8596728e3a64702422d434696f3a095555c789bc78fb2028a9373ba2edce8c201d43d0887c7c666ceef6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bb69ab5c12391e0087d16c3fa92d1e06

SHA1
f9ce7545cc730c9883077c178818d605e7a41849

SHA256
607032510844e06ad7ef2cc29bf267dc5e3463a32a74dbeaf4ebe0993c2a18f9

SHA512
04a9ca4df939ce1a0cc884b65ade9cf6f63ec9872c15fcdebe7d2e3ef1f9df0e5390a21765aaa3c5e5659414bcd861b4c911ed93194124b64634f3649015b7ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7bbb68a5f202999ae5f5775aa5828918

SHA1
8c847ea983de506c81a14c3c28b455800eee0887

SHA256
140e4370caa701785be45fd22926573b53fb7728c79a2a3a68cc4714084c4d29

SHA512
4b04c30b8f705d6c74260fcb182d89a766e6e1efc5fa7be4b6d3ed3bc88597b53ab30781f2248827c2c91de39cdd326ee00c7e2f80c2177dec20418888ab1a3f

Download Submit