hxxp://hochzeitsshop[.]org

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
07-08-2023 12:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://hochzeitsshop.org

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
416	msedge.exe
416	msedge.exe
3448	msedge.exe
3448	msedge.exe
2756	identity_helper.exe
2756	identity_helper.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe
3448	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 956	3448	msedge.exe	82
PID 3448 wrote to memory of 956	3448	msedge.exe	82
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 4628	3448	msedge.exe	84
PID 3448 wrote to memory of 416	3448	msedge.exe	83
PID 3448 wrote to memory of 416	3448	msedge.exe	83
PID 3448 wrote to memory of 2764	3448	msedge.exe	85
PID 3448 wrote to memory of 2764	3448	msedge.exe	85
PID 3448 wrote to memory of 2764	3448	msedge.exe	85
PID 3448 wrote to memory of 2764	3448	msedge.exe	85
PID 3448 wrote to memory of 2764	3448	msedge.exe	85
PID 3448 wrote to memory of 2764	3448	msedge.exe	85
PID 3448 wrote to memory of 2764	3448	msedge.exe	85
PID 3448 wrote to memory of 2764	3448	msedge.exe	85
PID 3448 wrote to memory of 2764	3448	msedge.exe	85
PID 3448 wrote to memory of 2764	3448	msedge.exe	85
PID 3448 wrote to memory of 2764	3448	msedge.exe	85
PID 3448 wrote to memory of 2764	3448	msedge.exe	85
PID 3448 wrote to memory of 2764	3448	msedge.exe	85
PID 3448 wrote to memory of 2764	3448	msedge.exe	85
PID 3448 wrote to memory of 2764	3448	msedge.exe	85
PID 3448 wrote to memory of 2764	3448	msedge.exe	85
PID 3448 wrote to memory of 2764	3448	msedge.exe	85
PID 3448 wrote to memory of 2764	3448	msedge.exe	85
PID 3448 wrote to memory of 2764	3448	msedge.exe	85
PID 3448 wrote to memory of 2764	3448	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hochzeitsshop.org
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb0fda46f8,0x7ffb0fda4708,0x7ffb0fda4718
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1976,15284661524592501575,8192139035881358486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,15284661524592501575,8192139035881358486,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1976,15284661524592501575,8192139035881358486,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,15284661524592501575,8192139035881358486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,15284661524592501575,8192139035881358486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1976,15284661524592501575,8192139035881358486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1976,15284661524592501575,8192139035881358486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,15284661524592501575,8192139035881358486,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,15284661524592501575,8192139035881358486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,15284661524592501575,8192139035881358486,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,15284661524592501575,8192139035881358486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,15284661524592501575,8192139035881358486,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1336 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3423d7e71b832850019e032730997f69

SHA1
bbc91ba3960fb8f7f2d5a190e6585010675d9061

SHA256
53770e40359b9738d8898520d7e4a57c28498edddbadf76ec4a599837aa0c649

SHA512
03d5fee4152300d6c5e9f72c059955c944c7e6d207e433e9fdd693639e63ea699a01696d7bbf56d2033fd52ad260c9ae36a2c5c888112d81bf7e04a3f273e65d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
00a455d9d155394bfb4b52258c97c5e5

SHA1
2761d0c955353e1982a588a3df78f2744cfaa9df

SHA256
45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

SHA512
9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a85ef9199909b71e55341fe31719910a

SHA1
0eea453342a88b5ab13634ede33ef0228520db29

SHA256
2c7e724ab9fd4a7deea64c16805c61a798bd5d7466bd9ab58951df4cc7d43cf4

SHA512
1c0fd83ffe6194a3f5865f5e4fb5229973b67579bd78eaf4dcce1b50229cf8a22068b344ffd819812730a7eac658718eabd492c801d88a2c553c80796740ccef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c009d138c2922d432d226e56ea621742

SHA1
d94edf5c783956379ef4bbd73b6afffc97a114b6

SHA256
879134470e9e12d9dd1d77e52ae94f55595595b6ab83732719da78e61e2e8710

SHA512
b15304ac2846f64a1df4c1b41f6eb2eb42e9316c2519728aaabce26a3ee2a971158a973fed19239ab20ea81a4d04081a592fd9f8e6b39f90de41123c4e517205

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3f3359029c4991909b09376484f3ad38

SHA1
3d61d61bbe957351ee330aab11eea982b75c476d

SHA256
fba524d633d9cc8ee4336fef6fe60fb5bec0dedc6cb87b01688c20f9596253b0

SHA512
1abb52a828672a503675cfe7c55c0ca36263c08ae14f4afe35e90223fa99f98f6530d0c9da7aea2f174a9f1844d0476963cf1052138cac1f00b1193239e670a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
0e78f9a3ece93ae9434c64ea2bff51dc

SHA1
a0e4c75fe32417fe2df705987df5817326e1b3b9

SHA256
5c8ce4455f2a3e5f36f30e7100f85bdd5e44336a8312278769f89f68b8d60e68

SHA512
9d1686f0b38e3326ad036c8b218b61428204910f586dccf8b62ecbed09190f7664a719a89a6fbc0ecb429aecf5dd0ec06de44be3a1510369e427bde0626fd51d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
18049d2ffa3d07c9a5eb9e3787db3b02

SHA1
8d72cf9bc078e18b53be9b3b469dbb195ebd6450

SHA256
da83a19aa0f60872c9396da1902e169d391e95de5efb6874d42745dc02e7a22c

SHA512
fa21e1c3588270cb4abf972e613c806c301f78d4619ec2f6e0577d2cccf60eddc8ebb5f8d5165b3894ef9c51410857c593805cda60f90a0496defc98421869a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
47ac53c5710c0aac76b28a6cf030c7cb

SHA1
3edbae5ba7938f41924b4f38f358e3f3443b6242

SHA256
e5285baae7a6e8d16fd6c7e9c7ed079f50135151338351f55961efa7213d1adf

SHA512
63503b357c1fc24129ff8e2329187df995032e401fad9cbc6c2034edb3c642901d717a6d81c5c6a28389aafaf54d4853e6d11840ddbd2be5573d425e00613b2f

Download Submit