hxxps://resources-storage[.]ams3[.]cdn[.]digitaloceanspaces[.]com/prod/landing/gallery/logo/ToneBodies[.]com-1d1ce4f024ccbe76c1f1dd4d42bedfa4[.]png

Analysis

max time kernel
188s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2023, 10:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://resources-storage.ams3.cdn.digitaloceanspaces.com/prod/landing/gallery/logo/ToneBodies.com-1d1ce4f024ccbe76c1f1dd4d42bedfa4.png

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1676	msedge.exe
1676	msedge.exe
4368	msedge.exe
4368	msedge.exe
924	identity_helper.exe
924	identity_helper.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 3032	4368	msedge.exe	84
PID 4368 wrote to memory of 3032	4368	msedge.exe	84
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 4972	4368	msedge.exe	87
PID 4368 wrote to memory of 1676	4368	msedge.exe	88
PID 4368 wrote to memory of 1676	4368	msedge.exe	88
PID 4368 wrote to memory of 2996	4368	msedge.exe	89
PID 4368 wrote to memory of 2996	4368	msedge.exe	89
PID 4368 wrote to memory of 2996	4368	msedge.exe	89
PID 4368 wrote to memory of 2996	4368	msedge.exe	89
PID 4368 wrote to memory of 2996	4368	msedge.exe	89
PID 4368 wrote to memory of 2996	4368	msedge.exe	89
PID 4368 wrote to memory of 2996	4368	msedge.exe	89
PID 4368 wrote to memory of 2996	4368	msedge.exe	89
PID 4368 wrote to memory of 2996	4368	msedge.exe	89
PID 4368 wrote to memory of 2996	4368	msedge.exe	89
PID 4368 wrote to memory of 2996	4368	msedge.exe	89
PID 4368 wrote to memory of 2996	4368	msedge.exe	89
PID 4368 wrote to memory of 2996	4368	msedge.exe	89
PID 4368 wrote to memory of 2996	4368	msedge.exe	89
PID 4368 wrote to memory of 2996	4368	msedge.exe	89
PID 4368 wrote to memory of 2996	4368	msedge.exe	89
PID 4368 wrote to memory of 2996	4368	msedge.exe	89
PID 4368 wrote to memory of 2996	4368	msedge.exe	89
PID 4368 wrote to memory of 2996	4368	msedge.exe	89
PID 4368 wrote to memory of 2996	4368	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://resources-storage.ams3.cdn.digitaloceanspaces.com/prod/landing/gallery/logo/ToneBodies.com-1d1ce4f024ccbe76c1f1dd4d42bedfa4.png
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeeb8b46f8,0x7ffeeb8b4708,0x7ffeeb8b4718
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,7601499979687035838,15331807129249273964,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,7601499979687035838,15331807129249273964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,7601499979687035838,15331807129249273964,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7601499979687035838,15331807129249273964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7601499979687035838,15331807129249273964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,7601499979687035838,15331807129249273964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,7601499979687035838,15331807129249273964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7601499979687035838,15331807129249273964,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7601499979687035838,15331807129249273964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7601499979687035838,15331807129249273964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7601499979687035838,15331807129249273964,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,7601499979687035838,15331807129249273964,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5324 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8411007bafe7b1182af1ad3a1809b4f8

SHA1
4a78ee0762aadd53accae8bb211b8b18dc602070

SHA256
1f274d0d144942d00e43fb94f9c27fc91c68dce50cd374ac6be4472b08215ca3

SHA512
909e2e33b7614cb8bbd14e0dfff1b7f98f4abbf735f88292546ce3bfa665e4cb5ee4418561004e56afc5dd30d21483b05f6358dad5624c0dc3ab1ba9a3be18eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
217B

MD5
b8fd1e88e01571b9f2637d76b8f0206e

SHA1
c4d2bbe042c3de3832ccd1b31e91d74b6ade8bed

SHA256
d976a453c171c28f6ca6614c7d5de6242c457d4ed461285a9d95b1798b5297ca

SHA512
a8405ebd0b3e6d825f744a3b80b65e499866517f25f769af70489432a5ea9087b5d3d40666bbd9b7a03d3df6c0f1b0891793c1adfdd777d60c6e32987777fa7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1bf7164225d57b71971ca338d2752979

SHA1
72610a352ef583f9bf2d5f69e3a81140ae231fd4

SHA256
654f0ad10a26f19d839654b238d7256b6c667f97c294332d7d9b3c2b100cc64b

SHA512
0b279b1466632b4270c9fef08fc00d4256efb962d2aff307012d9c7dd9a87f7ff2fc913b48b665a80fadacd361029bde30058b5f0a7c96721b7c0876a6c831bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c1add0b8d4190d23fa593505cdfa35de

SHA1
c3ce7d331a340139279db8d222481dfd27fdf765

SHA256
fb3babd30fd4cbad0b0010f6c36967bd540322030dfcaa7dd7f495fbeb942a44

SHA512
6e8338555e3ffd88cc662410fad82ac689d122f570808ee5bff6e56fa50fa48434ed4f7688300c3b02188e868bdf015d685621c7f05bec4095f640b6a7676830

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
8caf4d73cc5a7d5e3fb3f9f1a9d4a0cc

SHA1
83f8586805286b716c70ddd14a2b7ec6a4d9d0fe

SHA256
0e0c905b688340512e84db6cf8af6dbdfe29195fefde15bd02e4917a2c5fda8c

SHA512
084ef25ea21ee1083735c61b758281ba84b607e42d0186c35c3700b24a176ada47bf2e76ed7dadd3846f2b458c977e83835ced01cda47cdd7ab2d00e5a1a294e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f768514559e1d43fcc5c02070898b07f

SHA1
172bdfa888449ded13d22339a6b82c0e67d1e061

SHA256
c83d17c48d8f8122eebeb50c053445b40718a7b45a199ef535b9415b4ffeeaf8

SHA512
0c5ccb43195a4b715d3230ad002adb23fbf3d8fd3d36b0f2b4d2427fd5508f56c049d1a39a761bef5b16cede717031ea3157be2bf4f99344956aee563385b50e

Download Submit