hxxps://trhhomerental[.]com/wp-content/uploads/2023/01/is-it-illegal-to-download-photoshop-for-free-better[.]pdf

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16/08/2023, 00:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://trhhomerental.com/wp-content/uploads/2023/01/is-it-illegal-to-download-photoshop-for-free-better.pdf

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2340	msedge.exe
2340	msedge.exe
4980	msedge.exe
4980	msedge.exe
4652	identity_helper.exe
4652	identity_helper.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe
3048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 2024	4980	msedge.exe	83
PID 4980 wrote to memory of 2024	4980	msedge.exe	83
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 3900	4980	msedge.exe	84
PID 4980 wrote to memory of 2340	4980	msedge.exe	85
PID 4980 wrote to memory of 2340	4980	msedge.exe	85
PID 4980 wrote to memory of 1984	4980	msedge.exe	86
PID 4980 wrote to memory of 1984	4980	msedge.exe	86
PID 4980 wrote to memory of 1984	4980	msedge.exe	86
PID 4980 wrote to memory of 1984	4980	msedge.exe	86
PID 4980 wrote to memory of 1984	4980	msedge.exe	86
PID 4980 wrote to memory of 1984	4980	msedge.exe	86
PID 4980 wrote to memory of 1984	4980	msedge.exe	86
PID 4980 wrote to memory of 1984	4980	msedge.exe	86
PID 4980 wrote to memory of 1984	4980	msedge.exe	86
PID 4980 wrote to memory of 1984	4980	msedge.exe	86
PID 4980 wrote to memory of 1984	4980	msedge.exe	86
PID 4980 wrote to memory of 1984	4980	msedge.exe	86
PID 4980 wrote to memory of 1984	4980	msedge.exe	86
PID 4980 wrote to memory of 1984	4980	msedge.exe	86
PID 4980 wrote to memory of 1984	4980	msedge.exe	86
PID 4980 wrote to memory of 1984	4980	msedge.exe	86
PID 4980 wrote to memory of 1984	4980	msedge.exe	86
PID 4980 wrote to memory of 1984	4980	msedge.exe	86
PID 4980 wrote to memory of 1984	4980	msedge.exe	86
PID 4980 wrote to memory of 1984	4980	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://trhhomerental.com/wp-content/uploads/2023/01/is-it-illegal-to-download-photoshop-for-free-better.pdf
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff377e46f8,0x7fff377e4708,0x7fff377e4718
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,548378072698174627,10688219917949040022,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,548378072698174627,10688219917949040022,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,548378072698174627,10688219917949040022,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,548378072698174627,10688219917949040022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,548378072698174627,10688219917949040022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,548378072698174627,10688219917949040022,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,548378072698174627,10688219917949040022,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,548378072698174627,10688219917949040022,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,548378072698174627,10688219917949040022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,548378072698174627,10688219917949040022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,548378072698174627,10688219917949040022,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,548378072698174627,10688219917949040022,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b5f5369274e3bfbc449588bbb57bd383

SHA1
58bb46d57bd70c1c0bcbad619353cbe185f34c3b

SHA256
4190bd2ec2c0c65a2b8b97782cd3ae1d6cead80242f3595f06ebc6648c3e3464

SHA512
04a3816af6c5a335cde99d97019a3f68ade65eba70e4667c4d7dd78f78910481549f1dad23a46ccf9efa2e25c6e7a7c78c592b6ace951e1aab106ba06a10fcd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
532b8aab710169b83ffdb02ac7a1072e

SHA1
d43538214b8d8f714b804ba142d35df2c14c5b28

SHA256
1ef0d6bf070462f6051f0d4ef1894d0a2c9581503280fb2d5b5b7215ea261e4f

SHA512
ea6f62abf77664e6d2415f61908f98c83911f87fa39613d86ca9bf0b2fa125a93886f049caac86a5e12cc8367a138a95804ddb2d881b9536c189e6db21a2e44f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
900B

MD5
e6c6be99746ec332fdf433baf53db028

SHA1
a76a1adbe12e76a66b680c9748e4212973bd9b26

SHA256
c0ccc0aaf5641361840899aa8c2640a4e128409f9494f716d798950bad2df31a

SHA512
c772daf4c4299005b3dacff3d9d02793624cdf71cd72eb600881706f49f5f704889ced3a59334ffc0887d8f0a39e5fa1fdbcb5780ab40446cb25a7778d133458

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
12b8ab0c17ed939c80a6543c91c12847

SHA1
b91557339221ab587960711da8f144ad26fc21e9

SHA256
54c3652939296fc9cbd3ecf505d2452eaaf5ca349cffce27dcf63cf42a7f2ff1

SHA512
a6dd7cf2f511b7ab1e481b0f99af340371d7b794692ab8a40cea4ff65b522eccefec72df8544947751fd9da82308c4d806562a1b9ab328ddfbb71f53399d7bfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d06df7cf751be2c6515b06608f659fd9

SHA1
d1c6ba33da41406248759c5d6114afe29f857e2b

SHA256
948215395a2182bc7a9e2c3e4caedf30146d2ebdb4a24ddc71017dd46c8d758a

SHA512
2be45e4950ac856f3ea64748fda17e0e87a1bd3ec548904182dc1b16c38508224454ac50bf0e5dd336b10b1790801a4e0ba5a2773758ed510a7c0bb567395d91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
29213338df67d29d6454ee5d61ad3970

SHA1
8c69ca76a2e639060d5ce835a9600e6ea3764a83

SHA256
d29fc0d97fa74d382d0f557ecea4e42b7d50dbce43915bfc0c114c16e532aa51

SHA512
14db25eba8a863d390b97fce4315402ed7c249598ff6c31d5a191b0f71c274eead42ba0658403e744110de072e6ff1cac3bccee1e48875bde6b1fe39a60d2407

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2d27c5a56930defac49ebb8231102868

SHA1
54c1e0bd51e1598adee9bdfac6cb96327517d10e

SHA256
88a83874411db55c380df4708f969f28de5a41ed7d20754f8723f458ffa50183

SHA512
6161eae1c11fbf3b7ed9de61264b7643204ae36f28410f1544258559b8269dc7f6b158b59af4654abc35e2707c7a2daacddbffbc5185f7275c914f4f386570b4

Download Submit