hxxp://gtsdzypv[.]elementor[.]cloud

Analysis

max time kernel
34s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2023, 18:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://gtsdzypv.elementor.cloud

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4868	msedge.exe
4868	msedge.exe
4460	msedge.exe
4460	msedge.exe
2348	identity_helper.exe
2348	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 1348	4460	msedge.exe	81
PID 4460 wrote to memory of 1348	4460	msedge.exe	81
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 884	4460	msedge.exe	83
PID 4460 wrote to memory of 4868	4460	msedge.exe	82
PID 4460 wrote to memory of 4868	4460	msedge.exe	82
PID 4460 wrote to memory of 5008	4460	msedge.exe	84
PID 4460 wrote to memory of 5008	4460	msedge.exe	84
PID 4460 wrote to memory of 5008	4460	msedge.exe	84
PID 4460 wrote to memory of 5008	4460	msedge.exe	84
PID 4460 wrote to memory of 5008	4460	msedge.exe	84
PID 4460 wrote to memory of 5008	4460	msedge.exe	84
PID 4460 wrote to memory of 5008	4460	msedge.exe	84
PID 4460 wrote to memory of 5008	4460	msedge.exe	84
PID 4460 wrote to memory of 5008	4460	msedge.exe	84
PID 4460 wrote to memory of 5008	4460	msedge.exe	84
PID 4460 wrote to memory of 5008	4460	msedge.exe	84
PID 4460 wrote to memory of 5008	4460	msedge.exe	84
PID 4460 wrote to memory of 5008	4460	msedge.exe	84
PID 4460 wrote to memory of 5008	4460	msedge.exe	84
PID 4460 wrote to memory of 5008	4460	msedge.exe	84
PID 4460 wrote to memory of 5008	4460	msedge.exe	84
PID 4460 wrote to memory of 5008	4460	msedge.exe	84
PID 4460 wrote to memory of 5008	4460	msedge.exe	84
PID 4460 wrote to memory of 5008	4460	msedge.exe	84
PID 4460 wrote to memory of 5008	4460	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://gtsdzypv.elementor.cloud
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe2cd846f8,0x7ffe2cd84708,0x7ffe2cd84718
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,14098251682928403558,2464709511778517478,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,14098251682928403558,2464709511778517478,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,14098251682928403558,2464709511778517478,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14098251682928403558,2464709511778517478,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14098251682928403558,2464709511778517478,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14098251682928403558,2464709511778517478,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,14098251682928403558,2464709511778517478,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4640 /prefetch:8
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,14098251682928403558,2464709511778517478,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4640 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14098251682928403558,2464709511778517478,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14098251682928403558,2464709511778517478,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14098251682928403558,2464709511778517478,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,14098251682928403558,2464709511778517478,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:2660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a7ad9bb1054aa03e39b3554833d0c3ec

SHA1
cbd5b99ca100bc2f1292df23bf8e2a5a6f9640d9

SHA256
0c3eae39386b4117ad26187afc4933e254468cd12d813271f4b7420cee73c189

SHA512
d1d0b77e0bc412b4ee687e849531a7c9b70200d45d0bdbf38357b6fc59af835522e749b2fd8c2d4cde73518970568c38d73416c97381a11cc6029c14b1678276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
6aadcab67099880667206f34833dbabb

SHA1
8609ca7d614a55ad67477189d74231ba71968481

SHA256
9ba6f394f727687cfe511c63314702f8b612531fe47325c3e7981301d8461718

SHA512
1422a54b1277e6f3f91771935f75f474204ca0622e3a144dc747387f273710533bde15399fceee42e34e6ad437bfe2b845475744fcc6dcefdd1844162631bac7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
94f48ffde897fd9e451988168899e2ce

SHA1
8fe4be2535dda132783bf3bf47e836653af8c169

SHA256
2b0515d6617b58fed88f2abe4cdf9f0153541be1e39536b6795f57de2e01b9b8

SHA512
fada63459eab222f2755178b04a05196bafa6398b9714c085a07d34dad111df847279e2ed22db1fb0b3d083aa1d2c1b7cbb73912722bc0d4f278f8fb5bf53704

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e664b6adfe763f08b02cd6e776421cb3

SHA1
6cfd7f96205e4ec13f9b54e62bbc51c3d0edb4a0

SHA256
d387c51e994bbe23421a552df9e3bb4d4fb2daa818a42529d4000b1a4c844837

SHA512
c2e45d2e728c19e64b886f9d117bf6fbf0c0513ec40cae01ad9c5bb964d266bcd1c3c0846b98fd734766099f18aeff32255f4db789830c95b9fafa90ba8ad1c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e62cc4051e1f8eaa0abda5d730a2496b

SHA1
d15346e40b196bc313cbfe5ac96b3c90b83345be

SHA256
ffb5b740b8777d010f0d32a120092084c3cd32eaceb937188d698ddc22df2fcb

SHA512
3e8f6d89c7c153177b2149d86cd8602ceafedf66f5335a86b19dfa46fc38c47f6ff9a272c3b71b4464a5921ebdf2461fba25692ca916b9715bac520bf1e81a22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
1f6f2c500619f5da56f366f4eab3b168

SHA1
7e766cb5a20ed47601bcb2edcdab61388698e308

SHA256
c85736f8a29fa4b039092dafb94434e690363da4b0d6d46d0e38ffbe4e05c4e8

SHA512
d68e3145887e34cd6e02b4cd8084ac14660aa593290f5897df6a7f516a6809c4543a3ae51d56f92bbaff816b2b17ede414481cfce1b3188f3ca5183056b4cb27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
4080f5099c66a1165cdbfaeb9003782a

SHA1
26bf5b363b9044549794c2db384f876b10b28bff

SHA256
42be20ed9a8ba573e544f4e1fd776830c129bfa04bed7798c39eea20f5526f61

SHA512
d4dbbb19678df68b97255b249b4a3433c46db65673f4d45779da75cc41cc09cfb0f555b84018c9406a0cd7b76a612c52022a2681212ad9ae04798653e05eecbc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit