hxxps://www[.]6sense[.]com/privacy-policy

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16/08/2023, 06:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.6sense.com/privacy-policy

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4172	msedge.exe
4172	msedge.exe
4652	msedge.exe
4652	msedge.exe
1812	identity_helper.exe
1812	identity_helper.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 4720	4652	msedge.exe	81
PID 4652 wrote to memory of 4720	4652	msedge.exe	81
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 2692	4652	msedge.exe	82
PID 4652 wrote to memory of 4172	4652	msedge.exe	83
PID 4652 wrote to memory of 4172	4652	msedge.exe	83
PID 4652 wrote to memory of 3460	4652	msedge.exe	84
PID 4652 wrote to memory of 3460	4652	msedge.exe	84
PID 4652 wrote to memory of 3460	4652	msedge.exe	84
PID 4652 wrote to memory of 3460	4652	msedge.exe	84
PID 4652 wrote to memory of 3460	4652	msedge.exe	84
PID 4652 wrote to memory of 3460	4652	msedge.exe	84
PID 4652 wrote to memory of 3460	4652	msedge.exe	84
PID 4652 wrote to memory of 3460	4652	msedge.exe	84
PID 4652 wrote to memory of 3460	4652	msedge.exe	84
PID 4652 wrote to memory of 3460	4652	msedge.exe	84
PID 4652 wrote to memory of 3460	4652	msedge.exe	84
PID 4652 wrote to memory of 3460	4652	msedge.exe	84
PID 4652 wrote to memory of 3460	4652	msedge.exe	84
PID 4652 wrote to memory of 3460	4652	msedge.exe	84
PID 4652 wrote to memory of 3460	4652	msedge.exe	84
PID 4652 wrote to memory of 3460	4652	msedge.exe	84
PID 4652 wrote to memory of 3460	4652	msedge.exe	84
PID 4652 wrote to memory of 3460	4652	msedge.exe	84
PID 4652 wrote to memory of 3460	4652	msedge.exe	84
PID 4652 wrote to memory of 3460	4652	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.6sense.com/privacy-policy
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7fffc51746f8,0x7fffc5174708,0x7fffc5174718
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,648573623106181678,14299931815932873167,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,648573623106181678,14299931815932873167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,648573623106181678,14299931815932873167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,648573623106181678,14299931815932873167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,648573623106181678,14299931815932873167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,648573623106181678,14299931815932873167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,648573623106181678,14299931815932873167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,648573623106181678,14299931815932873167,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,648573623106181678,14299931815932873167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,648573623106181678,14299931815932873167,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,648573623106181678,14299931815932873167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,648573623106181678,14299931815932873167,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a7ad9bb1054aa03e39b3554833d0c3ec

SHA1
cbd5b99ca100bc2f1292df23bf8e2a5a6f9640d9

SHA256
0c3eae39386b4117ad26187afc4933e254468cd12d813271f4b7420cee73c189

SHA512
d1d0b77e0bc412b4ee687e849531a7c9b70200d45d0bdbf38357b6fc59af835522e749b2fd8c2d4cde73518970568c38d73416c97381a11cc6029c14b1678276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
92983c48b3a5c81234de2700a0142deb

SHA1
12bd8c8597652f2f50167e5ddc739647b635a4bd

SHA256
e4ca0fa27131880a03d5a974ce9c316954ecdf02dfd11c0e04a21ec922e3038f

SHA512
05b6b84e6571d27e91f8e70820caeb45c0ddb8a4e2c355c9dfe947607aae26a238cb0a66358c0cbd2a181c42a81d0b073cc2091240ddde1a6a648b799daaf318

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3f74c2f3d98a9934b1e7d6b6cb9f11b5

SHA1
ecb6a8b3a98c3e478900b2c4e1ef8a3dc68451c4

SHA256
efa0191728a5c1bb5c1675cd1d74ec81c55ebea157935f6a09e7a57fbda3987b

SHA512
db4c937e9d35cba0d02e7bbcad492e7ec58b042f7d7d1326f8baaae58b3e6ee4d7365e66f9b156ae22914e204a60cb98a9cd1c41972af674d3a932cc8e8ee39d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8165ae90d13c2a5321c02c32d84b6a91

SHA1
b058f8fccc8d92739b06e20b5384ba48a6355c25

SHA256
74be3d54ab1ddd7d7d49f798561997c0c0ec621814a54f5e002276d6f813a1b6

SHA512
29258877b2c3a8220f1c1b5fa51b425a47b89ded1ffda67a061ab93fba2934af62019ff490f262813dd0d34d443c0875756144e686d6a97be26e537b614d6f0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f9e17e4017f58c8b8e983be1f611b60d

SHA1
78ba00a92c5105700e7d7f0801f863534ba822a7

SHA256
fad57e6260de1f4106274b8018982e6f913b953bf94a33390c9f8d9eec718c30

SHA512
967d6b81464fc7d83a440a109ed851ee93a69ea5a045b344cf1147cb21511a1cca41808ce5219a6c37b581636fcd18dbcabefb5296b6b2598006772a8abd4835

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fb652538-3988-4e2a-9bdc-268b5df4ad6c.tmp

Filesize
24KB

MD5
e62cc4051e1f8eaa0abda5d730a2496b

SHA1
d15346e40b196bc313cbfe5ac96b3c90b83345be

SHA256
ffb5b740b8777d010f0d32a120092084c3cd32eaceb937188d698ddc22df2fcb

SHA512
3e8f6d89c7c153177b2149d86cd8602ceafedf66f5335a86b19dfa46fc38c47f6ff9a272c3b71b4464a5921ebdf2461fba25692ca916b9715bac520bf1e81a22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
92a5c61fe5d38f36fc467af189c964ce

SHA1
a327b44626918f60ff47b0ef551adcf785e4fd80

SHA256
2c7856c95074f8dd139ae9ab715605ade12ac3c47a1cd5943fcccaa18fa73de1

SHA512
a72174b334063850469ddd42723db2142c628bc6a0e808163b8bb0e7884a43e334de672dc1f243975ecb14bf6c8c9b56f0bb770a22ea7be50e7eaed609391ae5

Download Submit