Analysis
-
max time kernel
1721s -
max time network
1686s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
16/08/2024, 19:16
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://google.com
Resource
win10v2004-20240802-en
General
-
Target
http://google.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1480 msedge.exe 1480 msedge.exe 1724 msedge.exe 1724 msedge.exe 2392 identity_helper.exe 2392 identity_helper.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe 4572 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe 1724 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1724 wrote to memory of 1280 1724 msedge.exe 84 PID 1724 wrote to memory of 1280 1724 msedge.exe 84 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 2560 1724 msedge.exe 85 PID 1724 wrote to memory of 1480 1724 msedge.exe 86 PID 1724 wrote to memory of 1480 1724 msedge.exe 86 PID 1724 wrote to memory of 2948 1724 msedge.exe 87 PID 1724 wrote to memory of 2948 1724 msedge.exe 87 PID 1724 wrote to memory of 2948 1724 msedge.exe 87 PID 1724 wrote to memory of 2948 1724 msedge.exe 87 PID 1724 wrote to memory of 2948 1724 msedge.exe 87 PID 1724 wrote to memory of 2948 1724 msedge.exe 87 PID 1724 wrote to memory of 2948 1724 msedge.exe 87 PID 1724 wrote to memory of 2948 1724 msedge.exe 87 PID 1724 wrote to memory of 2948 1724 msedge.exe 87 PID 1724 wrote to memory of 2948 1724 msedge.exe 87 PID 1724 wrote to memory of 2948 1724 msedge.exe 87 PID 1724 wrote to memory of 2948 1724 msedge.exe 87 PID 1724 wrote to memory of 2948 1724 msedge.exe 87 PID 1724 wrote to memory of 2948 1724 msedge.exe 87 PID 1724 wrote to memory of 2948 1724 msedge.exe 87 PID 1724 wrote to memory of 2948 1724 msedge.exe 87 PID 1724 wrote to memory of 2948 1724 msedge.exe 87 PID 1724 wrote to memory of 2948 1724 msedge.exe 87 PID 1724 wrote to memory of 2948 1724 msedge.exe 87 PID 1724 wrote to memory of 2948 1724 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe72da46f8,0x7ffe72da4708,0x7ffe72da47182⤵PID:1280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,11919731709328677463,5932984450631720353,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵PID:2560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,11919731709328677463,5932984450631720353,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,11919731709328677463,5932984450631720353,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:82⤵PID:2948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11919731709328677463,5932984450631720353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:12⤵PID:4412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11919731709328677463,5932984450631720353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:4436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11919731709328677463,5932984450631720353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:12⤵PID:4364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,11919731709328677463,5932984450631720353,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:82⤵PID:4040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,11919731709328677463,5932984450631720353,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11919731709328677463,5932984450631720353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:12⤵PID:960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11919731709328677463,5932984450631720353,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:12⤵PID:3304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11919731709328677463,5932984450631720353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:12⤵PID:1496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,11919731709328677463,5932984450631720353,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:12⤵PID:756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,11919731709328677463,5932984450631720353,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4572
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4776
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:640
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e4f80e7950cbd3bb11257d2000cb885e
SHA110ac643904d539042d8f7aa4a312b13ec2106035
SHA2561184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124
SHA5122b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0
-
Filesize
152B
MD52dc1a9f2f3f8c3cfe51bb29b078166c5
SHA1eaf3c3dad3c8dc6f18dc3e055b415da78b704402
SHA256dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa
SHA512682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25
-
Filesize
209KB
MD53e552d017d45f8fd93b94cfc86f842f2
SHA1dbeebe83854328e2575ff67259e3fb6704b17a47
SHA25627d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6
SHA512e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize144B
MD56e8ed08983c4395e553be20f9278c836
SHA147a0d35aa7b0808ddd22869bb9549710c672eed8
SHA256994cec11b8413fd0df9ce36b3dd6b72f01bd9f995f5f6abbeefcb55885750cd9
SHA51254c04a6779388a2c41a8d74d27091f1025d755519ef363b3ce485d4d05c75d41d26a1f512ebdaa53bd5531c5d98b9b9e3763d2f9f37ea9e6cac46a871045d166
-
Filesize
815B
MD5ac04f75772d9a5f883e089704fe1d870
SHA12e5c99c7fa22532a0e3ec9088054b166498cead2
SHA256d660c3761b3e570acbc913020e7dcdb8e114fb071f9b9cc2e7f9135ebe0a97b6
SHA5128974fa0751ade98ffb6ae93a4f9d89c375132d34916ee6d350baa248409d84d3d16e895e5e793914a0913ee9ea3dbf1be2f1b3aa2b57df892ed728c3c4c26991
-
Filesize
5KB
MD5d173aa1a72661b44be0c545455b619a2
SHA1f81093fa4af9a584707c65ce90992b165a3a455f
SHA2568840442c16480685e3d4ed9f017a58af68c16150d5ce590ecfd8fef221382412
SHA5129dc22f3bc2559c0e82ab500b8028d58f19eb1b62f864fa7440d715c8ab2a1468c8e809f9591b81e0f4b1d87c6699f0aa4c91430bf3bf05e17f5eb53e5d36cb97
-
Filesize
6KB
MD547169993e32a3f64866af3a75ae3adf7
SHA121055c5ae1027977b91d7b27b0b4720d3c4cfef2
SHA256f5410d05810c43614947ca218d5fe3b7ae72e7945a678ba264b56af3f0f609e2
SHA5124c9a005236ff580cb52b1d55038c51d62e53ea618806b16c996befc841ca6d0d20e2d0241d6bfd923b1038cdcf4749647b4364c51ca4b8d636ed464fd43e3dde
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5932d3f3f8bdcfee3a80649be82cd8747
SHA11fdb46ac43d09aaeb9210b3c9a2de385d4a4e643
SHA25695a0697efd79ed94d2d1588dc9d67f0a6051c86a96c172344094ab36cf4d0720
SHA512157a8867597efa0f055ac799e24611b3ebdc10a30796a8e3db3e540a5044bbbffbee56c49f56547257a156bc1c02514783780b5e692ce9ff9c3e8b5253ec57d2