hxxp://outsourcebookkeepingindia[.]com/wp-content/uploads/2022/06/autocom_delphi_ds150e_keygen_generator_top[.]pdf

Analysis

max time kernel
156s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16/08/2023, 00:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://outsourcebookkeepingindia.com/wp-content/uploads/2022/06/autocom_delphi_ds150e_keygen_generator_top.pdf

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4896	msedge.exe
4896	msedge.exe
4360	msedge.exe
4360	msedge.exe
364	identity_helper.exe
364	identity_helper.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 3564	4360	msedge.exe	82
PID 4360 wrote to memory of 3564	4360	msedge.exe	82
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4936	4360	msedge.exe	83
PID 4360 wrote to memory of 4896	4360	msedge.exe	86
PID 4360 wrote to memory of 4896	4360	msedge.exe	86
PID 4360 wrote to memory of 5088	4360	msedge.exe	87
PID 4360 wrote to memory of 5088	4360	msedge.exe	87
PID 4360 wrote to memory of 5088	4360	msedge.exe	87
PID 4360 wrote to memory of 5088	4360	msedge.exe	87
PID 4360 wrote to memory of 5088	4360	msedge.exe	87
PID 4360 wrote to memory of 5088	4360	msedge.exe	87
PID 4360 wrote to memory of 5088	4360	msedge.exe	87
PID 4360 wrote to memory of 5088	4360	msedge.exe	87
PID 4360 wrote to memory of 5088	4360	msedge.exe	87
PID 4360 wrote to memory of 5088	4360	msedge.exe	87
PID 4360 wrote to memory of 5088	4360	msedge.exe	87
PID 4360 wrote to memory of 5088	4360	msedge.exe	87
PID 4360 wrote to memory of 5088	4360	msedge.exe	87
PID 4360 wrote to memory of 5088	4360	msedge.exe	87
PID 4360 wrote to memory of 5088	4360	msedge.exe	87
PID 4360 wrote to memory of 5088	4360	msedge.exe	87
PID 4360 wrote to memory of 5088	4360	msedge.exe	87
PID 4360 wrote to memory of 5088	4360	msedge.exe	87
PID 4360 wrote to memory of 5088	4360	msedge.exe	87
PID 4360 wrote to memory of 5088	4360	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://outsourcebookkeepingindia.com/wp-content/uploads/2022/06/autocom_delphi_ds150e_keygen_generator_top.pdf
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa227f46f8,0x7ffa227f4708,0x7ffa227f4718
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,3272419759292475402,4332367973089141652,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,3272419759292475402,4332367973089141652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,3272419759292475402,4332367973089141652,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3272419759292475402,4332367973089141652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3272419759292475402,4332367973089141652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,3272419759292475402,4332367973089141652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,3272419759292475402,4332367973089141652,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3272419759292475402,4332367973089141652,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3272419759292475402,4332367973089141652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3272419759292475402,4332367973089141652,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,3272419759292475402,4332367973089141652,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,3272419759292475402,4332367973089141652,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5988 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b950ebe404eda736e529f1b0a975e8db

SHA1
4d2c020f1aa70e2bcb666a2dd144d1f3588430b8

SHA256
bcc60276d7110e8d002f24d66ebb043c5761e2a4b6ae7854983cef4beacd9bf4

SHA512
6ba228e5b6464c9602db81de8e1189302d0b2aed78a8b06248ccd9f095ede8621fc9d0faed0a7d079b8c7f4d1164b2895c4d0ef99c93cb95bbe210033e40295a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
a122752c395d10eadd9653b58a90ec24

SHA1
a2a16e932d0f893f6b1e4dd16744d829d8ff06b1

SHA256
bf75d79e45cfa8c527b6f5a459f36c63ac09249a672aa2352095311c63412f71

SHA512
d57f77005d13ed98497040f0b9f2ea9c717be4aae2b21b3b888852dab47fc0af66b74ac324e2b65733db5a0fe8b1d1494f63b9397291427057d4a88d72d22b58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
837B

MD5
76f399c30a1e403ed47e9e5f1a959402

SHA1
a658de2fe4d6628c04f887dbf46faba72f4ccc4b

SHA256
a3d6a0f21b413f6fe4c4cb9caeeed2ccc8046fe9162a68ee6a5ea47c5f70f86d

SHA512
07c04ed3966044b87eea3e920a44df0d15f03ef04414b27721305acc4d5c05194f6b7dc277310b9dad7bc6a5bbfd946944871afba78974d62fc4472a6f5ff150

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9ae5c530d91711b42439073251eb554e

SHA1
ee288c9d82a27d6b5bba66b616b57d07b99281c9

SHA256
f36e3f391471a016174aac4a9a030df4673699f1ae8f2bec49bdb32f0df749f2

SHA512
6dc79275d727bac3cad67d1489a34b77e61655c9ad0486a5285cf38eb45a12416812ea354496ddd50cf090a5695d5bd6cf4a18b8e88db0107f69984af845970d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0e55692f54b8c706d791e92bf10874eb

SHA1
4e2b834cf8cd66cdfc4d220fc317184fd9ea1a4a

SHA256
75acc54892c47898df0c6a13e5ee3a242f476eb90472abe2e71f7619f77d5098

SHA512
5f2f27ea6777d710482b624b74ca45e6c741875c569d24617b88c23ea1f9fac15249103cb575f36f85e1a5699989fb993234f221562eee0c87d44725cd512f1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6389b9179eee19b9de82f68698a488c7

SHA1
ddd0d9773c8371d10e95f1ec1f62a20dce50706b

SHA256
ba085bfa09fc4245afa864811dd16c1b7c7deae91b117fecfaf080a2cd30dd34

SHA512
43bf2b879222f9169d87009979f2a608d317a6dc3994f02d5eee2e5870295b51ab8ac86ccb06562e14c4406cd64726a018d837a3908c711c250d7cd9b6d52de8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
ca36933e6dea7aa507a272121b34fdbb

SHA1
3b4741ca0308b345de5ecf6c3565b1dbacb0fb86

SHA256
fd14449eb781c58e6e7196a384caf25cba0c59ebdba3b10f8ca0ecfd0c076b5d

SHA512
5a9b186ecf085765caee97a2910008dda926ce412001042e165184083a52fb5fb70f05ca781cd2f7740ecbd938895c77c5aa0f9eb8d812b92f412f336212720e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d853be0a2aee1c0699d2f290df704d64

SHA1
62a647ce2997fcde65286d848e3003d365c57c07

SHA256
b0f39965a8558dd54d8b8b354bc0556ec5ceafed50e459615a03f59c8c56b69e

SHA512
4746027e6f6780ca0bf6b2c78fe62d3ae0f8ed88306599612997b41d405a19d837e1bc620295e64607a958003407f00263d18b4884d69948603b57bec119d9ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
675a100a1d4d99c64147930ecb053646

SHA1
ebd082de2ef90b4030a15ca2f4e0dec9b5c74813

SHA256
a59aaf79aaadb3c36938d0b796fb059a85e190c26690213b05cbbd117fac4078

SHA512
fd16dc6eb7e8ec77a6aa79d422328ba6994128efa16e09f6542d92b7c0802eb478ebfb2311652806a26743463c0ab59b7d59ecbbf0f1308e6a8b013d4c4b5a8e

Download Submit