Analysis
-
max time kernel
600s -
max time network
484s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/08/2024, 23:41
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://Google.com
Resource
win10v2004-20240802-en
General
-
Target
http://Google.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2956 msedge.exe 2956 msedge.exe 2164 msedge.exe 2164 msedge.exe 2296 identity_helper.exe 2296 identity_helper.exe 5060 msedge.exe 5060 msedge.exe 5060 msedge.exe 5060 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe 2164 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2164 wrote to memory of 4472 2164 msedge.exe 81 PID 2164 wrote to memory of 4472 2164 msedge.exe 81 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 3440 2164 msedge.exe 82 PID 2164 wrote to memory of 2956 2164 msedge.exe 83 PID 2164 wrote to memory of 2956 2164 msedge.exe 83 PID 2164 wrote to memory of 3064 2164 msedge.exe 84 PID 2164 wrote to memory of 3064 2164 msedge.exe 84 PID 2164 wrote to memory of 3064 2164 msedge.exe 84 PID 2164 wrote to memory of 3064 2164 msedge.exe 84 PID 2164 wrote to memory of 3064 2164 msedge.exe 84 PID 2164 wrote to memory of 3064 2164 msedge.exe 84 PID 2164 wrote to memory of 3064 2164 msedge.exe 84 PID 2164 wrote to memory of 3064 2164 msedge.exe 84 PID 2164 wrote to memory of 3064 2164 msedge.exe 84 PID 2164 wrote to memory of 3064 2164 msedge.exe 84 PID 2164 wrote to memory of 3064 2164 msedge.exe 84 PID 2164 wrote to memory of 3064 2164 msedge.exe 84 PID 2164 wrote to memory of 3064 2164 msedge.exe 84 PID 2164 wrote to memory of 3064 2164 msedge.exe 84 PID 2164 wrote to memory of 3064 2164 msedge.exe 84 PID 2164 wrote to memory of 3064 2164 msedge.exe 84 PID 2164 wrote to memory of 3064 2164 msedge.exe 84 PID 2164 wrote to memory of 3064 2164 msedge.exe 84 PID 2164 wrote to memory of 3064 2164 msedge.exe 84 PID 2164 wrote to memory of 3064 2164 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://Google.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9937e46f8,0x7ff9937e4708,0x7ff9937e47182⤵PID:4472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,10509859047144719594,18114722436120298333,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:3440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,10509859047144719594,18114722436120298333,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,10509859047144719594,18114722436120298333,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:82⤵PID:3064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10509859047144719594,18114722436120298333,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:5004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10509859047144719594,18114722436120298333,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:3020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10509859047144719594,18114722436120298333,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:12⤵PID:4344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,10509859047144719594,18114722436120298333,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:82⤵PID:4312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,10509859047144719594,18114722436120298333,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10509859047144719594,18114722436120298333,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:12⤵PID:2248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10509859047144719594,18114722436120298333,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:12⤵PID:5020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10509859047144719594,18114722436120298333,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:12⤵PID:2172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10509859047144719594,18114722436120298333,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:12⤵PID:1576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,10509859047144719594,18114722436120298333,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2608 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5060
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2952
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f9664c896e19205022c094d725f820b6
SHA1f8f1baf648df755ba64b412d512446baf88c0184
SHA2567121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e
SHA5123fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae
-
Filesize
152B
MD5847d47008dbea51cb1732d54861ba9c9
SHA1f2099242027dccb88d6f05760b57f7c89d926c0d
SHA25610292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1
SHA512bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f
-
Filesize
209KB
MD53e552d017d45f8fd93b94cfc86f842f2
SHA1dbeebe83854328e2575ff67259e3fb6704b17a47
SHA25627d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6
SHA512e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize144B
MD5173c4754ac61152f2d0c7d71633a289f
SHA19127388c25f4d90c26f5a97a11961dc4465db8d5
SHA25606988a515765897e41aaa5af78c75e2a9d1ac87e78d4aca9f1ac8174eee95236
SHA512b524b6b3bd6158897d583d1a0c139fee13ba0ff087804675a1560ae3647c60fbd96c8839554df017682dc35c2474d2c715d2959c85ff44504c1db13b1459f121
-
Filesize
814B
MD5f8715d07567eb286f5872f0292310758
SHA1b6a6f72b183d7a36694731a2c795953e28d9a541
SHA2560c09b27c7691f0983da2cbcdc9ee22c7b77bedf0326b29e91c4de8e371588c91
SHA512bf493eb9768d0c56bd226a87977d19b0eb32e15b8254c21ef4fdcd756a0ffe964dde4fe74fa0ae5515e5b88c113e7d92f9e9f0605163971c1c951d4f9578be65
-
Filesize
6KB
MD5e0342641fdc4bea799e9bb849dbecdc1
SHA16517eb433227926a1c6fb35dc68df979e71f94ed
SHA2568360882de6f5ca139331dca73d731a04e6bb3ac1c96eb1ea0e1b4458d1b9fe05
SHA512ad7956b84ad09f3621bddaea190ac188b67c30cdf3cab682fb8f82180c501e1ed7c79ef70e318a5b73ac9f221e4a60d25423d3b35beb2fc0ab25da2b287b4955
-
Filesize
6KB
MD5e1a8aa6bd6c71b37c466cc9929b87ce3
SHA1b1ec2578128e96e5b38f3f1446eed024364f0e69
SHA256a522ec0ac29623f4d3210a2bacc0d1c74ad72023add3c71703dacf11ad964aaa
SHA512d97dae75f9626ff772449e50b6efce6f93553bab20bf80730d71de061e0b0416f745baea78a3effbb9acae9c398c895b30d1eb33e1f9875de2d082aeb53fab62
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD50866008ae3553698d44790f15ffd5032
SHA18c3d6ee5e1cb9967bf275be2cfd070be332b66b7
SHA2564212401a42ad5bd1e7274242526cbb0d3cb902af7db63e35d2f3d1432d3c79aa
SHA51226a5be5243251aa0e2e13e99f9892d6930e30e272fa94ec12532fd936cfdc11940297068054113b26ccf477f5317b77e005073472ef6f6597a1e0d8a365d38a5