hxxp://www[.]bullzip[.]com

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2023, 15:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.bullzip.com

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
408	msedge.exe
408	msedge.exe
4588	msedge.exe
4588	msedge.exe
2268	identity_helper.exe
2268	identity_helper.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 1864	4588	msedge.exe	45
PID 4588 wrote to memory of 1864	4588	msedge.exe	45
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 4912	4588	msedge.exe	86
PID 4588 wrote to memory of 408	4588	msedge.exe	87
PID 4588 wrote to memory of 408	4588	msedge.exe	87
PID 4588 wrote to memory of 2272	4588	msedge.exe	88
PID 4588 wrote to memory of 2272	4588	msedge.exe	88
PID 4588 wrote to memory of 2272	4588	msedge.exe	88
PID 4588 wrote to memory of 2272	4588	msedge.exe	88
PID 4588 wrote to memory of 2272	4588	msedge.exe	88
PID 4588 wrote to memory of 2272	4588	msedge.exe	88
PID 4588 wrote to memory of 2272	4588	msedge.exe	88
PID 4588 wrote to memory of 2272	4588	msedge.exe	88
PID 4588 wrote to memory of 2272	4588	msedge.exe	88
PID 4588 wrote to memory of 2272	4588	msedge.exe	88
PID 4588 wrote to memory of 2272	4588	msedge.exe	88
PID 4588 wrote to memory of 2272	4588	msedge.exe	88
PID 4588 wrote to memory of 2272	4588	msedge.exe	88
PID 4588 wrote to memory of 2272	4588	msedge.exe	88
PID 4588 wrote to memory of 2272	4588	msedge.exe	88
PID 4588 wrote to memory of 2272	4588	msedge.exe	88
PID 4588 wrote to memory of 2272	4588	msedge.exe	88
PID 4588 wrote to memory of 2272	4588	msedge.exe	88
PID 4588 wrote to memory of 2272	4588	msedge.exe	88
PID 4588 wrote to memory of 2272	4588	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.bullzip.com
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xe0,0xe4,0xd8,0xdc,0x108,0x7ffc3cbc46f8,0x7ffc3cbc4708,0x7ffc3cbc4718
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,5172046791589889555,16977144002840399592,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,5172046791589889555,16977144002840399592,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,5172046791589889555,16977144002840399592,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5172046791589889555,16977144002840399592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5172046791589889555,16977144002840399592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5172046791589889555,16977144002840399592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,5172046791589889555,16977144002840399592,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,5172046791589889555,16977144002840399592,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5172046791589889555,16977144002840399592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5172046791589889555,16977144002840399592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5172046791589889555,16977144002840399592,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5172046791589889555,16977144002840399592,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5172046791589889555,16977144002840399592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,5172046791589889555,16977144002840399592,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4868 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b5f5369274e3bfbc449588bbb57bd383

SHA1
58bb46d57bd70c1c0bcbad619353cbe185f34c3b

SHA256
4190bd2ec2c0c65a2b8b97782cd3ae1d6cead80242f3595f06ebc6648c3e3464

SHA512
04a3816af6c5a335cde99d97019a3f68ade65eba70e4667c4d7dd78f78910481549f1dad23a46ccf9efa2e25c6e7a7c78c592b6ace951e1aab106ba06a10fcd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
d063287ab9b65983dfa497fda1859f19

SHA1
f6ad014838f57a574cc89905aaee01c8e5f2f54f

SHA256
b2e08009f68ca3587a2dd656a10ba92352f085879be7d12d3547ed348a043d02

SHA512
21bd1deab579afe85c5f44ba11779774c725a4918818a4bdbeeb84a48cace2074ac2f0b634eccf3b9e9c41c4b2aeaa3d02a3bc08e835c9fe3750a080f958098e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
262675bd865548cd7283cb1372bd82e8

SHA1
927ac2c7abdd436a19a8a75b559659f72c7df5e0

SHA256
5c2705aabcff56ebac956d28a5373d44201fdbae65e875949e53ffb3480c04db

SHA512
c66f5abf1a131a1921b81871b48726c0d3a5de5477f6d20e3a275d767ec2fbb211c3a46ca8d8b7a82233aa354a033873ba18fe5c82811dad9e0fdbd365451fc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9b5c80f92b7d96d23ded79bb64e16b38

SHA1
de10a830edd48968ad7f8cac45d024fa7b3cbc70

SHA256
03e233dc776f0e27c09d3cdfda46cadd24611f1888ff61ec6a7a7b5e23f1e10d

SHA512
067268337216437ad7b1a212526d19a1cad286c9b5a291b07299d628d36049c1c1462d726c66968621313959e1ca293981515a947d78252435de9f20d2c7a5c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
24572c3d440816b34e5f33a1265ccbce

SHA1
93e5b41651b96fdd46f1df24a5908f31f5bfa6a6

SHA256
a4f7723a3087b8534bc63a7419ee473fb5b1b21eac36225501f16ec5bd6348b2

SHA512
b26cf06d963245433a8e97648b63cbb51c30814468d863b11ccf06e5c3ee9d953935011a4179754235d3e7c90d38eb5f1998204c12bf19354483bd32c738b1d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
29213338df67d29d6454ee5d61ad3970

SHA1
8c69ca76a2e639060d5ce835a9600e6ea3764a83

SHA256
d29fc0d97fa74d382d0f557ecea4e42b7d50dbce43915bfc0c114c16e532aa51

SHA512
14db25eba8a863d390b97fce4315402ed7c249598ff6c31d5a191b0f71c274eead42ba0658403e744110de072e6ff1cac3bccee1e48875bde6b1fe39a60d2407

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
3c2c7ec6b216bec8f7d7e76b8b8cfb89

SHA1
0f86952a11397f23002f73511899ffd6942ea6b9

SHA256
27998ed763dd370082b735cb85902216c7b886453f9b0bd38e77c38f4e8c63ca

SHA512
b7cecad9ca4a8eb3788fb0111bda87710cb69cfb12e9a379703a742b203bf8e59752db7e26e0b555866090d9f54fdc570c720810f92fa9b1ebf6da6d86a5b57e

Download Submit