hxxp://dpdgroup[.]com

Analysis

max time kernel
34s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2023, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://dpdgroup.com

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
3920	msedge.exe
3920	msedge.exe
2756	identity_helper.exe
2756	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 4568	4436	msedge.exe	80
PID 4436 wrote to memory of 4568	4436	msedge.exe	80
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3676	4436	msedge.exe	82
PID 4436 wrote to memory of 3920	4436	msedge.exe	81
PID 4436 wrote to memory of 3920	4436	msedge.exe	81
PID 4436 wrote to memory of 3396	4436	msedge.exe	83
PID 4436 wrote to memory of 3396	4436	msedge.exe	83
PID 4436 wrote to memory of 3396	4436	msedge.exe	83
PID 4436 wrote to memory of 3396	4436	msedge.exe	83
PID 4436 wrote to memory of 3396	4436	msedge.exe	83
PID 4436 wrote to memory of 3396	4436	msedge.exe	83
PID 4436 wrote to memory of 3396	4436	msedge.exe	83
PID 4436 wrote to memory of 3396	4436	msedge.exe	83
PID 4436 wrote to memory of 3396	4436	msedge.exe	83
PID 4436 wrote to memory of 3396	4436	msedge.exe	83
PID 4436 wrote to memory of 3396	4436	msedge.exe	83
PID 4436 wrote to memory of 3396	4436	msedge.exe	83
PID 4436 wrote to memory of 3396	4436	msedge.exe	83
PID 4436 wrote to memory of 3396	4436	msedge.exe	83
PID 4436 wrote to memory of 3396	4436	msedge.exe	83
PID 4436 wrote to memory of 3396	4436	msedge.exe	83
PID 4436 wrote to memory of 3396	4436	msedge.exe	83
PID 4436 wrote to memory of 3396	4436	msedge.exe	83
PID 4436 wrote to memory of 3396	4436	msedge.exe	83
PID 4436 wrote to memory of 3396	4436	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://dpdgroup.com
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc9cc646f8,0x7ffc9cc64708,0x7ffc9cc64718
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,5893967125355801385,10604243945653668727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,5893967125355801385,10604243945653668727,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,5893967125355801385,10604243945653668727,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,5893967125355801385,10604243945653668727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,5893967125355801385,10604243945653668727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,5893967125355801385,10604243945653668727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,5893967125355801385,10604243945653668727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,5893967125355801385,10604243945653668727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,5893967125355801385,10604243945653668727,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,5893967125355801385,10604243945653668727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,5893967125355801385,10604243945653668727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,5893967125355801385,10604243945653668727,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:1064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8411007bafe7b1182af1ad3a1809b4f8

SHA1
4a78ee0762aadd53accae8bb211b8b18dc602070

SHA256
1f274d0d144942d00e43fb94f9c27fc91c68dce50cd374ac6be4472b08215ca3

SHA512
909e2e33b7614cb8bbd14e0dfff1b7f98f4abbf735f88292546ce3bfa665e4cb5ee4418561004e56afc5dd30d21483b05f6358dad5624c0dc3ab1ba9a3be18eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
912B

MD5
0830449ef8cad0ba34292b13b8811780

SHA1
53e6b6fb77703471c4a33572857091e592288d83

SHA256
769bb05db1424d70041b98fef013064fd47ec9fed3e5749b87bb779432beb55a

SHA512
89ed71302885fce2d991f66a5558952441a26236ef9db4b4206b162aa5dd26f8af8b7a3ad997351da2710391690293493b7a59b41a7f6d53e350e69fb353947a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6ff89a7db1990de3c67bee420df6e7d4

SHA1
7e0118b0f9938aa20b1935b5aff9a10790ba8a5a

SHA256
530bb859806b9981b31a76c121f64ddfbb54f7c516ee216eac024ccad44e6a95

SHA512
6097f2c5b2a876e4ea978d5f7b5b5709dc63494283cdd66c63f77d28957360677a8657eebedd17880842d09d63b02895b4b03ba8eb2ce214574d059e1ff8fd53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d9129d4e532de68db26b1a4e2ac51be8

SHA1
b9139fcecbba71fa39469fbc8d457468d3529d87

SHA256
84c6cb83ebcb8170821f6aa4c17d46e96c36bc7c2374f07bde6ae7fb9d612ec8

SHA512
626236fb0ec2965fb1d91fe1736b0e26090bae20c48177a5f75c62831444b45abc79e301becb6eb4e07099765ad550305ca18094dce5fabc288e0aca80b62668

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
8caf4d73cc5a7d5e3fb3f9f1a9d4a0cc

SHA1
83f8586805286b716c70ddd14a2b7ec6a4d9d0fe

SHA256
0e0c905b688340512e84db6cf8af6dbdfe29195fefde15bd02e4917a2c5fda8c

SHA512
084ef25ea21ee1083735c61b758281ba84b607e42d0186c35c3700b24a176ada47bf2e76ed7dadd3846f2b458c977e83835ced01cda47cdd7ab2d00e5a1a294e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
13404a571b02fc3e5001d695527c44bc

SHA1
f69e60f6ae6455af28c14d68eb1662ae8e0ed3d4

SHA256
cae8273514422089765b42bca7db50f71f6ba10996334a717b011ea6b01081d4

SHA512
64a23ad2726c9a66031d111a83c534a63e995f68f813b9284a4361ab7cca70c6e102c8f956481865173cb8c7c9b9dd2ffe43e73cd406d8637038d6d24de95a28

Download Submit