hxxp://gog-games[.]to

Analysis

max time kernel
88s
max time network
88s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 15:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://gog-games.to

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2868	msedge.exe
2868	msedge.exe
2100	msedge.exe
2100	msedge.exe
3736	identity_helper.exe
3736	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe
2100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 556	2100	msedge.exe	84
PID 2100 wrote to memory of 556	2100	msedge.exe	84
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2328	2100	msedge.exe	85
PID 2100 wrote to memory of 2868	2100	msedge.exe	86
PID 2100 wrote to memory of 2868	2100	msedge.exe	86
PID 2100 wrote to memory of 1948	2100	msedge.exe	87
PID 2100 wrote to memory of 1948	2100	msedge.exe	87
PID 2100 wrote to memory of 1948	2100	msedge.exe	87
PID 2100 wrote to memory of 1948	2100	msedge.exe	87
PID 2100 wrote to memory of 1948	2100	msedge.exe	87
PID 2100 wrote to memory of 1948	2100	msedge.exe	87
PID 2100 wrote to memory of 1948	2100	msedge.exe	87
PID 2100 wrote to memory of 1948	2100	msedge.exe	87
PID 2100 wrote to memory of 1948	2100	msedge.exe	87
PID 2100 wrote to memory of 1948	2100	msedge.exe	87
PID 2100 wrote to memory of 1948	2100	msedge.exe	87
PID 2100 wrote to memory of 1948	2100	msedge.exe	87
PID 2100 wrote to memory of 1948	2100	msedge.exe	87
PID 2100 wrote to memory of 1948	2100	msedge.exe	87
PID 2100 wrote to memory of 1948	2100	msedge.exe	87
PID 2100 wrote to memory of 1948	2100	msedge.exe	87
PID 2100 wrote to memory of 1948	2100	msedge.exe	87
PID 2100 wrote to memory of 1948	2100	msedge.exe	87
PID 2100 wrote to memory of 1948	2100	msedge.exe	87
PID 2100 wrote to memory of 1948	2100	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gog-games.to
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc9c6946f8,0x7ffc9c694708,0x7ffc9c694718
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,9717238281288939013,15072272568259101628,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,9717238281288939013,15072272568259101628,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,9717238281288939013,15072272568259101628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,9717238281288939013,15072272568259101628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,9717238281288939013,15072272568259101628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,9717238281288939013,15072272568259101628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1892,9717238281288939013,15072272568259101628,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3512 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,9717238281288939013,15072272568259101628,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4212 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,9717238281288939013,15072272568259101628,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,9717238281288939013,15072272568259101628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,9717238281288939013,15072272568259101628,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,9717238281288939013,15072272568259101628,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,9717238281288939013,15072272568259101628,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:4644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
74c8e80f15da8a12214af9a3d9d56852

SHA1
64be59cfe0eaa7af531488a63100612341c349d3

SHA256
1b07b4e9825349e1426c7957cf8ad511dd0b9cf0030d7ef7b4392959fc7c3556

SHA512
9689d9cf5adc8563e51a031a7e398dfd66411a3b55146219cab83bf3f49fd73a0c601235b1aafbf9631e9c061d740d7ccb720482985478ffccc6ac47cce33732

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
820B

MD5
046207cdbe9eb68f5b1c18e0fe6946a2

SHA1
d0f1348382b299c0575677546fcab94725330133

SHA256
3003c1fdcbfe8c9a15e64ffc715d59ebdf75ca1b240a76c5e1082505d50ba880

SHA512
0c73f6b3674323d1fbba87e46b9f68b2daa6828456f4e8283ee4a9d34d0424680a6c76a5de99606d51d3969b972da074129b837e715c05ccabbad7d1ef3b7da6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
08ab11b1e63b91dadc6965e3fa378966

SHA1
f6fd0de6346a53ec349007ceb2e2be0d15add299

SHA256
2bfb3d22122ceb0a1f92816b9227dfc2f69c97c2de94d8e3143d43e8ced0c3ae

SHA512
31e3c3dc3a014c1444b3541b053202907aa964d217b69d4970fed57a3ab0612234c2856d2b3f51b9f9b9c10f656314056053af6598f6fd342a0cdd904197318e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2f3d557c28a5b2ad3c91d97d59ccbf5f

SHA1
4af15a8a86ec8a3de37b41ca25c054824631dce3

SHA256
0149d4f61dcf74d7d0ee40dc707f249394e5d05528f97e29f099aae9399b4e06

SHA512
8676ce47810b38baf7c3ae60c5b635713822aa93cd86b1e02035f615851ddb15acc93eff1e9f717948da8b60ac8115c6f1db0d40783ed650f73b1f3516763dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e60e88127fbab36ffed308322f453571

SHA1
fc3878626fab1579ef819f4c97906286e62be90b

SHA256
54f301dc314efc030cd5e90aa666c69c92940857c0b542f22348375ff4e79c03

SHA512
d5f01d24c8adfac6f8a971f5d75e594469f2a0b88b19f1a1f83bc42f20cceb6f77b544e4a5b2972e8d562556d89011da22b80c1ca65c3db3f660e8b150645dba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2a9a0a1f0ad99f3508c24bc7ddc233c5

SHA1
715e4c4ca7124c72e587923eeb6c3cabebac3c22

SHA256
73202b0663743213102de3b01b766df3202aa4620778e7c88c0ae004578222f7

SHA512
46e7b553c76d320968fb4fea646e35bbbfa417779c5960b7e77fea51dec63274028711e254edb8b1f97ebe01a1c175cb4c78cf194b430f9eafcf736b5f54105a

Download Submit