hxxp://gg[.]gg/1c0k56

Analysis

max time kernel
62s
max time network
67s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
08-09-2024 18:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://gg.gg/1c0k56

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3952	msedge.exe
3952	msedge.exe
3304	msedge.exe
3304	msedge.exe
5096	identity_helper.exe
5096	identity_helper.exe
1296	msedge.exe
1296	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 1552	3304	msedge.exe	79
PID 3304 wrote to memory of 1552	3304	msedge.exe	79
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 4996	3304	msedge.exe	80
PID 3304 wrote to memory of 3952	3304	msedge.exe	81
PID 3304 wrote to memory of 3952	3304	msedge.exe	81
PID 3304 wrote to memory of 4532	3304	msedge.exe	82
PID 3304 wrote to memory of 4532	3304	msedge.exe	82
PID 3304 wrote to memory of 4532	3304	msedge.exe	82
PID 3304 wrote to memory of 4532	3304	msedge.exe	82
PID 3304 wrote to memory of 4532	3304	msedge.exe	82
PID 3304 wrote to memory of 4532	3304	msedge.exe	82
PID 3304 wrote to memory of 4532	3304	msedge.exe	82
PID 3304 wrote to memory of 4532	3304	msedge.exe	82
PID 3304 wrote to memory of 4532	3304	msedge.exe	82
PID 3304 wrote to memory of 4532	3304	msedge.exe	82
PID 3304 wrote to memory of 4532	3304	msedge.exe	82
PID 3304 wrote to memory of 4532	3304	msedge.exe	82
PID 3304 wrote to memory of 4532	3304	msedge.exe	82
PID 3304 wrote to memory of 4532	3304	msedge.exe	82
PID 3304 wrote to memory of 4532	3304	msedge.exe	82
PID 3304 wrote to memory of 4532	3304	msedge.exe	82
PID 3304 wrote to memory of 4532	3304	msedge.exe	82
PID 3304 wrote to memory of 4532	3304	msedge.exe	82
PID 3304 wrote to memory of 4532	3304	msedge.exe	82
PID 3304 wrote to memory of 4532	3304	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gg.gg/1c0k56
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffee69a3cb8,0x7ffee69a3cc8,0x7ffee69a3cd8
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,3703299905815152536,10664616309131599031,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1784 /prefetch:2
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,3703299905815152536,10664616309131599031,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,3703299905815152536,10664616309131599031,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,3703299905815152536,10664616309131599031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,3703299905815152536,10664616309131599031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,3703299905815152536,10664616309131599031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,3703299905815152536,10664616309131599031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,3703299905815152536,10664616309131599031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,3703299905815152536,10664616309131599031,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,3703299905815152536,10664616309131599031,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,3703299905815152536,10664616309131599031,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,3703299905815152536,10664616309131599031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,3703299905815152536,10664616309131599031,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,3703299905815152536,10664616309131599031,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3280 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
0c6a1473a04c56b4ec79e431d3be579c

SHA1
9d63ca1320dd15dbf843fc4001d4ebcb3e8770fa

SHA256
1a218cbe6ae689ba21c745a1341a46e17730461577f42b9f86ec01064ea917ee

SHA512
9656412198b1ca66df82537d69a85ea418fcfb701f5226c3cb275bc69185bb40821049fc2e752039d30b5547b9f90edc00399dc25e6eefbd01427d81644dcd49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c3889d3f0d2246f800c495aec7c3f7c

SHA1
dd38e6bf74617bfcf9d6cceff2f746a094114220

SHA256
0a4781bca132edf11500537cbf95ff840c2b6fd33cd94809ca9929f00044bea4

SHA512
2d6cb23e2977c0890f69751a96daeb71e0f12089625f32b34b032615435408f21047b90c19de09f83ef99957681440fdc0c985e079bb196371881b5fdca68a37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c4a10f6df4922438ca68ada540730100

SHA1
4c7bfbe3e2358a28bf5b024c4be485fa6773629e

SHA256
f286c908fea67163f02532503b5555a939f894c6f2e683d80679b7e5726a7c02

SHA512
b4d407341989e0bbbe0cdd64f7757bea17f0141a89104301dd7ffe45e7511d3ea27c53306381a29c24df68bdb9677eb8c07d4d88874d86aba41bb6f0ce7a942c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
51b0ba7641a37b1428fcfd665b3d8759

SHA1
22a8d4e0ea6a24e852d22872fb482a324d68a9a5

SHA256
077cca130a7841bf1ce995e1c1d78872ca0b7b9bca36e65cb11b67ab4c8fda68

SHA512
2eee7426e51038a124164a12fe981b2d185f95d29099007df0aed554d9331f617ffa64b8707e4b0961118ee0db039da7dec5b726049b292442df69afb8ae9864

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ae398cbc1d3891ad2df220e0f45032e5

SHA1
808175453ecb588dfe4dfe46ee007c1f0e2445ce

SHA256
60ecf2b2271d47075242740de2c7db87c9898f966a9801bc025ea4be168350e6

SHA512
cecd3c98881e4095cba456a735534151adb62bbb6a3d153d1d2b2330ae104c705ecfd2219b271b5eddc392751812545ecb6eaa155365041d261c8d3ce2a0e590

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
375d2514ceeb4e5113f7ed53abd3fa81

SHA1
1b431d5248b4d69539a10dfb19c9a63273161011

SHA256
a395acd3def078fde7011ac71a9dc6a81ebf076012a85fc50cc431f4adb7d3c2

SHA512
8fa327e4b6b376a374198ebafb4906e8b39b9833c3edbfa6b67d2334594c555e07d735ffbebda9a48bf21a99059e7a3abe6d29130e8232bf010446a23b82244c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3e880c0ea6c25cb49780ea7f16cc4424

SHA1
9c2c0ed643e02985dec96bf60e1ccfd34b44095b

SHA256
eb956fa47c1ecfbf2eb04c02750aecd7d8aa765bee5a7a77a322093accf342b2

SHA512
69e5e3a7d72e2eb8d638d59ee06b7004df998f7dae7649c2c7712f6ac31b03a312efab237915a87ad55eba807eb024bab705dfcc4e8afda12509136b958bdc2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4da06611f2b8c411f2405d748e2f8c87

SHA1
d7cef8ab68e35a7c1a6b236b6a14d0b4eca4fc50

SHA256
6d85b1b2ffebf945e5533088230d75ad1464fdb14b0162875ca83030f42a4d71

SHA512
a1173bfc13ac5688eeaeeadf30ca08b062f309cbe7baa8f770515eb587f07fa443022e634783f4bb116b8fb50d198444925b6698d01f79f34e5eb8dba51553a0

Download Submit