hxxp://serve[.]adsilo[.]pro

Analysis

max time kernel
147s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16/08/2023, 13:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://serve.adsilo.pro

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4120	msedge.exe
4120	msedge.exe
2696	msedge.exe
2696	msedge.exe
4292	identity_helper.exe
4292	identity_helper.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe
2696	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 4684	2696	msedge.exe	82
PID 2696 wrote to memory of 4684	2696	msedge.exe	82
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 3732	2696	msedge.exe	83
PID 2696 wrote to memory of 4120	2696	msedge.exe	84
PID 2696 wrote to memory of 4120	2696	msedge.exe	84
PID 2696 wrote to memory of 1908	2696	msedge.exe	86
PID 2696 wrote to memory of 1908	2696	msedge.exe	86
PID 2696 wrote to memory of 1908	2696	msedge.exe	86
PID 2696 wrote to memory of 1908	2696	msedge.exe	86
PID 2696 wrote to memory of 1908	2696	msedge.exe	86
PID 2696 wrote to memory of 1908	2696	msedge.exe	86
PID 2696 wrote to memory of 1908	2696	msedge.exe	86
PID 2696 wrote to memory of 1908	2696	msedge.exe	86
PID 2696 wrote to memory of 1908	2696	msedge.exe	86
PID 2696 wrote to memory of 1908	2696	msedge.exe	86
PID 2696 wrote to memory of 1908	2696	msedge.exe	86
PID 2696 wrote to memory of 1908	2696	msedge.exe	86
PID 2696 wrote to memory of 1908	2696	msedge.exe	86
PID 2696 wrote to memory of 1908	2696	msedge.exe	86
PID 2696 wrote to memory of 1908	2696	msedge.exe	86
PID 2696 wrote to memory of 1908	2696	msedge.exe	86
PID 2696 wrote to memory of 1908	2696	msedge.exe	86
PID 2696 wrote to memory of 1908	2696	msedge.exe	86
PID 2696 wrote to memory of 1908	2696	msedge.exe	86
PID 2696 wrote to memory of 1908	2696	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://serve.adsilo.pro
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef7c846f8,0x7ffef7c84708,0x7ffef7c84718
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,8411198441815641932,9534269635949221686,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,8411198441815641932,9534269635949221686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,8411198441815641932,9534269635949221686,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8411198441815641932,9534269635949221686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8411198441815641932,9534269635949221686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8411198441815641932,9534269635949221686,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8411198441815641932,9534269635949221686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8411198441815641932,9534269635949221686,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8411198441815641932,9534269635949221686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,8411198441815641932,9534269635949221686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3592 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,8411198441815641932,9534269635949221686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3592 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,8411198441815641932,9534269635949221686,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1408 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8411007bafe7b1182af1ad3a1809b4f8

SHA1
4a78ee0762aadd53accae8bb211b8b18dc602070

SHA256
1f274d0d144942d00e43fb94f9c27fc91c68dce50cd374ac6be4472b08215ca3

SHA512
909e2e33b7614cb8bbd14e0dfff1b7f98f4abbf735f88292546ce3bfa665e4cb5ee4418561004e56afc5dd30d21483b05f6358dad5624c0dc3ab1ba9a3be18eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
bba96aa53737e5b4c19a4d8af43af287

SHA1
60f6afd9809b4edbd694eb4b61e1be8c88dff761

SHA256
51e17894144509a8680aed25673ad21d30abbb15286a1b0d4d356632bf146e7a

SHA512
8aeccbb63f965ad367fc92cb06d8777bee39950f00a327c5ff87772c4c680c13804e2861e6d404f180075e86f4ff70e18d105c77845c9fa41fc238c7352071ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
380B

MD5
9690d17e4792daf1fc0c3d3cd33d04b0

SHA1
330239346aa6eee50fa165d02ede2090390e4322

SHA256
7fe12930614ff8700070f1887e062def1e522a1dc0c7b7036b977596eefd2ccf

SHA512
3b5a345d47e6fb87c813596227879bd1f0d22c3f7ea66194e939b84529dab325adaa5de6cc6dcd1ca84323ad8998eb54eb9ec6564a5defd229cec4defd344575

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5fb4d9dfb2244878c63998aa28d7cd22

SHA1
9c2e46f64f44cafde17a7b48c2d748c141efa3d5

SHA256
4e14f766d02e0dbc59f0d7b3af1f9c344a1ef80b13b3e4e8ebee585fa4bf5581

SHA512
8494bbe75a4261b3317eed8e13a13ebb0e61b00ce9b394018e4d2bab2dd0057e160a37b3158c849be860a6d680805b460501b16cd6ae0c60e72a8ae2618f9dd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
40a52ff8aaf2787cd1ae3ffbba446084

SHA1
5d5c76491be5354a4b318f18feb1aeb9e756633b

SHA256
029aa4ace87acedf7f02e5983643fdd8720749ca16cd0ff42daac8f61ec5ab9d

SHA512
4ad331d907702b006a3e91c23bce28f446a44af985add16cd1828456aae489acc035425577b82a351e39802277b774a29759a39e93aad54aaa4e15b8600dd81e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
177805284a4e61e2bf5ed8abff6dfacb

SHA1
f3b32e72d008ec52eaed78294d82e75f53b6bf90

SHA256
ca07bfdad23a383be14932db15596dfdbfcf3b164a19679058eed9cbca267297

SHA512
b8c4220067975251ac283955236cb96f44c4a6b186cb97a63e43abd02cd6f25b3ed6acd505a68c9b657d488b5645beb94b180aa1698880fd563e759f0844dba1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a5c44a4b241ffd93cd1dd1964e913092

SHA1
9ebac50d0ad24c1e62f5a8f25f3a955ab6312c43

SHA256
95b525ad3270e81db792f917bae7b04d340ac054ebe76d3fc2168c26bb40e16d

SHA512
39ea2d6934a39a3123d85112bd2bb0cf624bb99721ac9195007e1b5bf2b077e5ecfc3a334897a65063f5c8139d30cebe4cbd9342d01446413b131d4d3d5c8c40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
8caf4d73cc5a7d5e3fb3f9f1a9d4a0cc

SHA1
83f8586805286b716c70ddd14a2b7ec6a4d9d0fe

SHA256
0e0c905b688340512e84db6cf8af6dbdfe29195fefde15bd02e4917a2c5fda8c

SHA512
084ef25ea21ee1083735c61b758281ba84b607e42d0186c35c3700b24a176ada47bf2e76ed7dadd3846f2b458c977e83835ced01cda47cdd7ab2d00e5a1a294e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d743d4f3c17de82f077fc010aa6f81c1

SHA1
45ed4b70ac7ae399e99b901c12d9829b22c822e9

SHA256
de92e86bea69f0cd27a21efa6f43e8736fe0b17103ac2ae978f895202efcca72

SHA512
b5fe3fafc96ff5dc0931b137f4f26970f63206e0ec141ef3681d8a3ca0018828627e2b9906716467459667199ffb629470ff3f74dfe73fe9330bb9b80e021742

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
6fc9bfcb7f72702f1d45ca7497bf12da

SHA1
743e3056718e25350adfa3720e67873fc692b163

SHA256
a12b747fc10f9addd2c3560b620e04ecf9ec03df9edb369b802f0326fd09aa97

SHA512
59a1779405f54e91d04a1319eeb0e7ffc8993d5a174b8816504408606fff49f4f4f3e211dfe36c8e8fd8607cdbff4f01ab3ae5f066b8a4e803ef5687a5647339

Download Submit