hxxps://shoutout[.]wix[.]com/so/pixel/3c2dee32-86fa-473f-8743-28c00f44651d/42949e16-6f04-467c-a00e-5d810fd42cb6/a352e44b-5afc-4013-9a90-1f863b7c43bb/6e7df076-8394-4dfb-a45e-e5712f293a73/bottom/true

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
07-08-2023 04:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://shoutout.wix.com/so/pixel/3c2dee32-86fa-473f-8743-28c00f44651d/42949e16-6f04-467c-a00e-5d810fd42cb6/a352e44b-5afc-4013-9a90-1f863b7c43bb/6e7df076-8394-4dfb-a45e-e5712f293a73/bottom/true

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
3472	msedge.exe
3472	msedge.exe
1352	identity_helper.exe
1352	identity_helper.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe
3220	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe
3472	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 2376	3472	msedge.exe	81
PID 3472 wrote to memory of 2376	3472	msedge.exe	81
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 3748	3472	msedge.exe	83
PID 3472 wrote to memory of 4980	3472	msedge.exe	82
PID 3472 wrote to memory of 4980	3472	msedge.exe	82
PID 3472 wrote to memory of 2448	3472	msedge.exe	84
PID 3472 wrote to memory of 2448	3472	msedge.exe	84
PID 3472 wrote to memory of 2448	3472	msedge.exe	84
PID 3472 wrote to memory of 2448	3472	msedge.exe	84
PID 3472 wrote to memory of 2448	3472	msedge.exe	84
PID 3472 wrote to memory of 2448	3472	msedge.exe	84
PID 3472 wrote to memory of 2448	3472	msedge.exe	84
PID 3472 wrote to memory of 2448	3472	msedge.exe	84
PID 3472 wrote to memory of 2448	3472	msedge.exe	84
PID 3472 wrote to memory of 2448	3472	msedge.exe	84
PID 3472 wrote to memory of 2448	3472	msedge.exe	84
PID 3472 wrote to memory of 2448	3472	msedge.exe	84
PID 3472 wrote to memory of 2448	3472	msedge.exe	84
PID 3472 wrote to memory of 2448	3472	msedge.exe	84
PID 3472 wrote to memory of 2448	3472	msedge.exe	84
PID 3472 wrote to memory of 2448	3472	msedge.exe	84
PID 3472 wrote to memory of 2448	3472	msedge.exe	84
PID 3472 wrote to memory of 2448	3472	msedge.exe	84
PID 3472 wrote to memory of 2448	3472	msedge.exe	84
PID 3472 wrote to memory of 2448	3472	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://shoutout.wix.com/so/pixel/3c2dee32-86fa-473f-8743-28c00f44651d/42949e16-6f04-467c-a00e-5d810fd42cb6/a352e44b-5afc-4013-9a90-1f863b7c43bb/6e7df076-8394-4dfb-a45e-e5712f293a73/bottom/true
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffefa1646f8,0x7ffefa164708,0x7ffefa164718
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,12620955756660299704,12772325578451707342,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,12620955756660299704,12772325578451707342,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,12620955756660299704,12772325578451707342,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12620955756660299704,12772325578451707342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12620955756660299704,12772325578451707342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12620955756660299704,12772325578451707342,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12620955756660299704,12772325578451707342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,12620955756660299704,12772325578451707342,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,12620955756660299704,12772325578451707342,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12620955756660299704,12772325578451707342,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12620955756660299704,12772325578451707342,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,12620955756660299704,12772325578451707342,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3980 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8411007bafe7b1182af1ad3a1809b4f8

SHA1
4a78ee0762aadd53accae8bb211b8b18dc602070

SHA256
1f274d0d144942d00e43fb94f9c27fc91c68dce50cd374ac6be4472b08215ca3

SHA512
909e2e33b7614cb8bbd14e0dfff1b7f98f4abbf735f88292546ce3bfa665e4cb5ee4418561004e56afc5dd30d21483b05f6358dad5624c0dc3ab1ba9a3be18eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
184B

MD5
a0a106003cb7773adc8d4950c518f2f9

SHA1
5c4bcef701329b9bb626d3f69fc359e17bfb68f7

SHA256
440ef190d4730a08fe984b5ba8398435e40675fe2c30c192d767c706a457c026

SHA512
d8b59cd87409d603a7ede7160cc0d341e5fe4ff786d603f0a07a5279ba9b184e549382d71821be5d5d5968e97a0413f069c7f57649729d0f5648b5ce646bda10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
917d07f73515e658e9517b6b49dd93cb

SHA1
91b86929d3491e28ed7e6d9d832cc7fff44e4ee3

SHA256
b303257f64abdd1ddcea2ff7a5a2a4da918b10e320626f6a5cd3030c6c464e81

SHA512
b24d3b9a89d8e7f7db4910b0f7bfce68c31b66dcf60fa6dacd3f220b8507e51a84c9e5eda9c9782fd24718a01c737de213b6343bc3957fe7ffa9b4ed89f024c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f2f3ef62081a125dfc811d793481fec0

SHA1
a9abc1a0342d53bf2674f2fc02408d41561c4c45

SHA256
7fb5d06db346079f936da3e791753c9696d867ddbe180dc35fc98e1d9c3358a5

SHA512
05d33dd9d2a63d1b02bace1f597f82f03d0eac2f5931d080e945d02e7b9b6fbb6ec8621500ae15ed7539487ebea3f264fe47e7d62790bea0880966db7a8bcf45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c6a070ce07afc7b68bd6d31e9b2feb01

SHA1
33eb43805c173ab880d401a172edaa875c7bca60

SHA256
4337443027e1fe5380309dfbe3ab09d95c79a9f32504161fe90cf09ab868f9ad

SHA512
6813b4db9aae4e276c3e315ccac4f3609075573b3879a698a657dedfb5de7c80b13e9a974901975e8988069a51e06970213acdc05759cd72a1057b1c67066837

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
8caf4d73cc5a7d5e3fb3f9f1a9d4a0cc

SHA1
83f8586805286b716c70ddd14a2b7ec6a4d9d0fe

SHA256
0e0c905b688340512e84db6cf8af6dbdfe29195fefde15bd02e4917a2c5fda8c

SHA512
084ef25ea21ee1083735c61b758281ba84b607e42d0186c35c3700b24a176ada47bf2e76ed7dadd3846f2b458c977e83835ced01cda47cdd7ab2d00e5a1a294e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
e7a93fb0dcb0c5322c6dd13b3c092222

SHA1
91c35db0188e8863c2c0cf89d485cbcbcc52165f

SHA256
80e2c13c975131fd5382c0ec746f6138830de6729157fb9be67d4a0745a4745c

SHA512
2f171ead6ed589093d4c2c424120501c35e75a28bce1a124b7e9914c55f939497376d567aef943ff060eeb37b289f7b010852d3387df103a3a2a8b647d3178b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a8e795ffffffa4a30a1e0342e61c8ced

SHA1
071896db76d6ddabf1bf72001f21ef19750ac61a

SHA256
8e3a4cfe2190d9c707f9f605d42bb54cf518a237fda60cd53a0003f78da992c8

SHA512
ca5a918069a06a523f19a892bc243b63ed89c3da1d1e6679d7bd5d67f984d8f29705109a2c3b3116303b6e3b07d94eb4d03f8656d3e0cac44f73ed32c14945aa

Download Submit