hxxp://serve[.]adsilo[.]pro

Analysis

max time kernel
146s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16/08/2023, 12:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://serve.adsilo.pro

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1220	msedge.exe
1220	msedge.exe
1776	msedge.exe
1776	msedge.exe
4824	identity_helper.exe
4824	identity_helper.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 4264	1776	msedge.exe	71
PID 1776 wrote to memory of 4264	1776	msedge.exe	71
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 3100	1776	msedge.exe	82
PID 1776 wrote to memory of 1220	1776	msedge.exe	81
PID 1776 wrote to memory of 1220	1776	msedge.exe	81
PID 1776 wrote to memory of 2920	1776	msedge.exe	83
PID 1776 wrote to memory of 2920	1776	msedge.exe	83
PID 1776 wrote to memory of 2920	1776	msedge.exe	83
PID 1776 wrote to memory of 2920	1776	msedge.exe	83
PID 1776 wrote to memory of 2920	1776	msedge.exe	83
PID 1776 wrote to memory of 2920	1776	msedge.exe	83
PID 1776 wrote to memory of 2920	1776	msedge.exe	83
PID 1776 wrote to memory of 2920	1776	msedge.exe	83
PID 1776 wrote to memory of 2920	1776	msedge.exe	83
PID 1776 wrote to memory of 2920	1776	msedge.exe	83
PID 1776 wrote to memory of 2920	1776	msedge.exe	83
PID 1776 wrote to memory of 2920	1776	msedge.exe	83
PID 1776 wrote to memory of 2920	1776	msedge.exe	83
PID 1776 wrote to memory of 2920	1776	msedge.exe	83
PID 1776 wrote to memory of 2920	1776	msedge.exe	83
PID 1776 wrote to memory of 2920	1776	msedge.exe	83
PID 1776 wrote to memory of 2920	1776	msedge.exe	83
PID 1776 wrote to memory of 2920	1776	msedge.exe	83
PID 1776 wrote to memory of 2920	1776	msedge.exe	83
PID 1776 wrote to memory of 2920	1776	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://serve.adsilo.pro
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe381646f8,0x7ffe38164708,0x7ffe38164718
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1420,6934741493122234324,2081649084345454097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1420,6934741493122234324,2081649084345454097,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1420,6934741493122234324,2081649084345454097,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1420,6934741493122234324,2081649084345454097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1420,6934741493122234324,2081649084345454097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1420,6934741493122234324,2081649084345454097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1420,6934741493122234324,2081649084345454097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1420,6934741493122234324,2081649084345454097,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1420,6934741493122234324,2081649084345454097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1420,6934741493122234324,2081649084345454097,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1420,6934741493122234324,2081649084345454097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1420,6934741493122234324,2081649084345454097,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a7ad9bb1054aa03e39b3554833d0c3ec

SHA1
cbd5b99ca100bc2f1292df23bf8e2a5a6f9640d9

SHA256
0c3eae39386b4117ad26187afc4933e254468cd12d813271f4b7420cee73c189

SHA512
d1d0b77e0bc412b4ee687e849531a7c9b70200d45d0bdbf38357b6fc59af835522e749b2fd8c2d4cde73518970568c38d73416c97381a11cc6029c14b1678276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\66c08449-8495-4a6a-b2f6-e9f97dae6c0c.tmp

Filesize
5KB

MD5
1156b51e83a0176c3cc844e6416cf633

SHA1
f03435c4c8e88166a465db8046877c85324a6f86

SHA256
3d190726f4ebf8484c2d2c7c0818c0a80058803b0048dbb0ca6f0261f21a6436

SHA512
76138729b334d412568dc7ff5a6ad552fa9decc76e7600208b4eb6477e080ac15c0e7308c76d5002994f61836d193b2b2ecba9ce2d36588fa5df9320d8c47656

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
43f81341a5a03dc59d396cec1c87d865

SHA1
a7285c493418876ab581e241bb8f0243fc2a50ea

SHA256
d9ea9a0c94afc9b5fb540574f548c6c8c03bfa81ee0d8667915ff48bee5dcd94

SHA512
bee770229d4f5e7d7e082c0e4fa012f8b75e89aab294f7da57263cd714bbf38d56018c068ab1000d4af690978acfc16d1c4dabaa935b120d137662e86095a0a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
380B

MD5
ff5f4e6defd25c1c206ec70eebb5760f

SHA1
e084f3abacc5e841e37d3245f266679d3aa928af

SHA256
53e43abff36c3c2dad05706a6a54fed5756f2770a996c012617aac52869d63ad

SHA512
73b6b5c5b5b045ef1852eda00797e3f36af92f47c2fff49079c2ed501c512e580444c896e33c646010f8a13ede18b377cf135d255d1e6f3f05cd07fbcefaa418

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ea2788d8e5a8dbc06a36d4282b1db13e

SHA1
e011ca13ae5db3b2e412fd0ada9560095a771e6f

SHA256
ecca06fae12283466141a4d4b01c98ee851b46a712fa60a96cd462f82e76dcf3

SHA512
b7cbee4317390ff9169fe6b6cea5ce14ffad5c0fa283744894beebc5ca8b66694864435a6608d9ae5f638e2209fc016a9fa6e6ec8aa0ed3388589460ab8e146d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b3d3fcacdbdba0c0475f28e53c929c20

SHA1
689e0211287685b4f79db06f807d31f17268981a

SHA256
ebc63753153f00af3d96ccbc41c1eb72adb03c94c72269422d44c89958fdfa54

SHA512
2620a6121f355e9303f52aa7c793ede34c6cab64ff33ff0ddfb4804aff4591e99e4248298ad08652f0b0b92a53496dda67352a39c6439b1aeb87c08579469b05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e62cc4051e1f8eaa0abda5d730a2496b

SHA1
d15346e40b196bc313cbfe5ac96b3c90b83345be

SHA256
ffb5b740b8777d010f0d32a120092084c3cd32eaceb937188d698ddc22df2fcb

SHA512
3e8f6d89c7c153177b2149d86cd8602ceafedf66f5335a86b19dfa46fc38c47f6ff9a272c3b71b4464a5921ebdf2461fba25692ca916b9715bac520bf1e81a22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a2ba2db589d26d6cb9223cf97bac06cd

SHA1
39b14ff4ee3a9729d11dc8bad04af75187c85949

SHA256
452289e81029eb98e99a92f5a82dcd6474084b013b2f98861d71d72de8236e2a

SHA512
11f7e9d57db84fc401a2fe9c4b7cc57e4d752bc287d8d46722e394fe0b59726b5ef134cb01c1dc8a4fe9c93bf293065640fb2ee3e952e3b95a023cbeffc0adf8

Download Submit