hxxps://tryback[.]s1-tastewp[.]com/dr054

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2023, 05:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://tryback.s1-tastewp.com/dr054

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
2940	msedge.exe
2940	msedge.exe
2460	identity_helper.exe
2460	identity_helper.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 4956	2940	msedge.exe	82
PID 2940 wrote to memory of 4956	2940	msedge.exe	82
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 680	2940	msedge.exe	85
PID 2940 wrote to memory of 4744	2940	msedge.exe	84
PID 2940 wrote to memory of 4744	2940	msedge.exe	84
PID 2940 wrote to memory of 3260	2940	msedge.exe	83
PID 2940 wrote to memory of 3260	2940	msedge.exe	83
PID 2940 wrote to memory of 3260	2940	msedge.exe	83
PID 2940 wrote to memory of 3260	2940	msedge.exe	83
PID 2940 wrote to memory of 3260	2940	msedge.exe	83
PID 2940 wrote to memory of 3260	2940	msedge.exe	83
PID 2940 wrote to memory of 3260	2940	msedge.exe	83
PID 2940 wrote to memory of 3260	2940	msedge.exe	83
PID 2940 wrote to memory of 3260	2940	msedge.exe	83
PID 2940 wrote to memory of 3260	2940	msedge.exe	83
PID 2940 wrote to memory of 3260	2940	msedge.exe	83
PID 2940 wrote to memory of 3260	2940	msedge.exe	83
PID 2940 wrote to memory of 3260	2940	msedge.exe	83
PID 2940 wrote to memory of 3260	2940	msedge.exe	83
PID 2940 wrote to memory of 3260	2940	msedge.exe	83
PID 2940 wrote to memory of 3260	2940	msedge.exe	83
PID 2940 wrote to memory of 3260	2940	msedge.exe	83
PID 2940 wrote to memory of 3260	2940	msedge.exe	83
PID 2940 wrote to memory of 3260	2940	msedge.exe	83
PID 2940 wrote to memory of 3260	2940	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://tryback.s1-tastewp.com/dr054
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffea3ec46f8,0x7ffea3ec4708,0x7ffea3ec4718
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,9771622381884293766,2652873581964115555,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,9771622381884293766,2652873581964115555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,9771622381884293766,2652873581964115555,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9771622381884293766,2652873581964115555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9771622381884293766,2652873581964115555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9771622381884293766,2652873581964115555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9771622381884293766,2652873581964115555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9771622381884293766,2652873581964115555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9771622381884293766,2652873581964115555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,9771622381884293766,2652873581964115555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,9771622381884293766,2652873581964115555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9771622381884293766,2652873581964115555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,9771622381884293766,2652873581964115555,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2836

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a7ad9bb1054aa03e39b3554833d0c3ec

SHA1
cbd5b99ca100bc2f1292df23bf8e2a5a6f9640d9

SHA256
0c3eae39386b4117ad26187afc4933e254468cd12d813271f4b7420cee73c189

SHA512
d1d0b77e0bc412b4ee687e849531a7c9b70200d45d0bdbf38357b6fc59af835522e749b2fd8c2d4cde73518970568c38d73416c97381a11cc6029c14b1678276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
190B

MD5
1d402e895de1a0e98c7944a0c3c7dd87

SHA1
8353ad5a3f4719235426ed48c266bbb68b3d2529

SHA256
172f44180520dc3e0ce2b6f7470ee26b99b599bd57551d05056fa6148b4cd3c7

SHA512
ff87b8f3325ac5885fb849e24dd3565e3ecbaa3daa913d107973ebdad9411c51fe16d8069b68739ac26599099f390bb30e1bfa36a58d259c3b8f7c3e60b3b9bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
79b3b74e881243272c3b7090733fcbaa

SHA1
d8e28984cfb5b5763f2e08fa7a7d6dd79abfd6ad

SHA256
d36818b7d260a51a23d453acc3ef16d39561a84a2331b4044eecbc8df9a34b21

SHA512
bd72cc41e799d05d45fa658d43dbf83b3ade54ba00eb5b63fdd8cad04062b9b91e17bd7747da1a02e81c8750d0c154ffb780e620ae92a47ec39176154f6e9bd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b86bb5313446b50bd90cd29fb3da6695

SHA1
a71d3abb0822462e87e6247bda50a2fcfe4da989

SHA256
eaffd36624645ae4b2d0cd738296a4f38afae9c62ac48f68003cfe2f53425ca8

SHA512
f3f43dde69dbe3a71a21ff4789af25a26c07ce65ed1ecbc3e17fc9cd1f2a81bd37b385455bb8e114fe32141a79334d04a8c273a2b47223ce7b5fdbc4a55beee6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e62cc4051e1f8eaa0abda5d730a2496b

SHA1
d15346e40b196bc313cbfe5ac96b3c90b83345be

SHA256
ffb5b740b8777d010f0d32a120092084c3cd32eaceb937188d698ddc22df2fcb

SHA512
3e8f6d89c7c153177b2149d86cd8602ceafedf66f5335a86b19dfa46fc38c47f6ff9a272c3b71b4464a5921ebdf2461fba25692ca916b9715bac520bf1e81a22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ff313a74729492549f2f549a2051d851

SHA1
ed24e927e2ec357934ee343aa09598e05517f816

SHA256
c66f95fcfe75a500214fa0983f75b75990c6253f424fef5e33b635b01ef852c4

SHA512
8b75375d64af8960eb65876bb4917dbda8fea61722f1f064cb8312030233be4b378b7af51a980fd2f688f532b53df0297cce6ba7f498395a42d3a37b12bc85bf

Download Submit