hxxp://pinturasdalu[.]blogspot[.]com/2018/01/

Analysis

max time kernel
157s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2023, 23:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://pinturasdalu.blogspot.com/2018/01/

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
2172	msedge.exe
2172	msedge.exe
1384	identity_helper.exe
1384	identity_helper.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 4260	2172	msedge.exe	82
PID 2172 wrote to memory of 4260	2172	msedge.exe	82
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1700	2172	msedge.exe	84
PID 2172 wrote to memory of 1128	2172	msedge.exe	83
PID 2172 wrote to memory of 1128	2172	msedge.exe	83
PID 2172 wrote to memory of 336	2172	msedge.exe	85
PID 2172 wrote to memory of 336	2172	msedge.exe	85
PID 2172 wrote to memory of 336	2172	msedge.exe	85
PID 2172 wrote to memory of 336	2172	msedge.exe	85
PID 2172 wrote to memory of 336	2172	msedge.exe	85
PID 2172 wrote to memory of 336	2172	msedge.exe	85
PID 2172 wrote to memory of 336	2172	msedge.exe	85
PID 2172 wrote to memory of 336	2172	msedge.exe	85
PID 2172 wrote to memory of 336	2172	msedge.exe	85
PID 2172 wrote to memory of 336	2172	msedge.exe	85
PID 2172 wrote to memory of 336	2172	msedge.exe	85
PID 2172 wrote to memory of 336	2172	msedge.exe	85
PID 2172 wrote to memory of 336	2172	msedge.exe	85
PID 2172 wrote to memory of 336	2172	msedge.exe	85
PID 2172 wrote to memory of 336	2172	msedge.exe	85
PID 2172 wrote to memory of 336	2172	msedge.exe	85
PID 2172 wrote to memory of 336	2172	msedge.exe	85
PID 2172 wrote to memory of 336	2172	msedge.exe	85
PID 2172 wrote to memory of 336	2172	msedge.exe	85
PID 2172 wrote to memory of 336	2172	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pinturasdalu.blogspot.com/2018/01/
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde41246f8,0x7ffde4124708,0x7ffde4124718
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,2066233765506284990,17862204420960197929,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,2066233765506284990,17862204420960197929,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,2066233765506284990,17862204420960197929,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2066233765506284990,17862204420960197929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2066233765506284990,17862204420960197929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2066233765506284990,17862204420960197929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,2066233765506284990,17862204420960197929,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,2066233765506284990,17862204420960197929,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2066233765506284990,17862204420960197929,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2066233765506284990,17862204420960197929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2066233765506284990,17862204420960197929,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2066233765506284990,17862204420960197929,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,2066233765506284990,17862204420960197929,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\28d343ea-7bc7-43fd-bd9e-a2236b4f4e77.tmp

Filesize
12KB

MD5
ff88779202a537f16ef8d7cb5fe6676c

SHA1
889c1f87120153801cde0e0389769d1ea57ec8ad

SHA256
9f06643c99f2412af2d10383a1f320fea59121b455d01e9daf6921470454ca08

SHA512
6f9732d29eb63d09757212aae2f1e778d865dae2f9908128ac072c409efb6c157be5236f0592e9995f61cf58b025540fa933e8ea55a6bd35b5c9c9b8095acb5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b950ebe404eda736e529f1b0a975e8db

SHA1
4d2c020f1aa70e2bcb666a2dd144d1f3588430b8

SHA256
bcc60276d7110e8d002f24d66ebb043c5761e2a4b6ae7854983cef4beacd9bf4

SHA512
6ba228e5b6464c9602db81de8e1189302d0b2aed78a8b06248ccd9f095ede8621fc9d0faed0a7d079b8c7f4d1164b2895c4d0ef99c93cb95bbe210033e40295a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
21KB

MD5
defe241c5d1dc367f10d09ebb8fbaaaf

SHA1
6b9648c727043a10255355f825b41470f50f03d9

SHA256
505c2f6e0288f12d18d78640a13ea45c083a1a22a2dd268c3ee9b476214c79ec

SHA512
dd7dd571aac79f8afd099f961f0e0f94bffa3ad8f991c0bac8c5715978cb70784defde0172ae2aaa3107580ad1487b8b75565fee36e1468e2ceb2871be713454

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
45KB

MD5
5752eafa899d2315bb3dada9a494359c

SHA1
528f9494fa2e5701cdff2cacb369b059cd43a692

SHA256
545fd462507a145ffab50adae35c628724857de556e1815ac5e4e906760a29f9

SHA512
1ffc07e5dc0f791bc1806048017c856f705f52c3fbfa4e430de0194ba27a28e7e43d8dff2ba91af83f9f22d7c7411461339504bbeabfba3440a5e675f7e38865

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
abc998259a2a22f78819e810c8d16670

SHA1
93fe1df8a13129557d7de067cde5ad95ff7591df

SHA256
a9d731a1759cb0f140505a081cf8dca6231a34d3fc9225b222f716529784eab6

SHA512
3a49378c2a3ad995a464733ed94d4baf23e8a798c57e444c922fe489238f649ac7cf566f26eca573941df0d5de397b84e8f1d59ddd57d11b1b46577d229934ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
60dd959600e1fd46dfc474dd0ed92e91

SHA1
33889386cb4ea52fc99ca74a7457add91b81e245

SHA256
84f4e49b25718b79a44ab2ce7d4536403f1caacdcdf1bb08b389e56809de6723

SHA512
eeb145efa9efaa68d63abb7b61bdc410a9634c14652eced40a2ef00d7922750d8ed38180dffbcf33095d14391274010ad300a40c4bbf1c7575171ee6d0a20007

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cad062011190bcd7e0adf75e046bd321

SHA1
95eb45c80ee086e2559d76d03558577063b38309

SHA256
4921df7d1ddae2fd0a61b1dc2581e4c8b1bd96e58e44ac49c53b52b1fd579869

SHA512
3dd054e684963ee19d60b252bb4f3559ef432215a0df2a8a9627b916cc8990318d6786db7be4f26ab83d60ead6ea08ebd05c7279179e792cf20a6031c63a5e8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
574a96f0e27240862d4dd05da3a06871

SHA1
e113fa922a6de5c9142705a637265cf8807c80a9

SHA256
5fb90bc0e5a30952bfe2d6fe0c0d6b18e8c211a9c77de9d56cbc6b2a8a1aa90b

SHA512
558d9353cbb6199c00bd846c5dcb869f5659962309dbbf75b3f16c503da6793c92a447e4ee078a700e854e94a2af928d422bfd6eca4cdf080fdd53121180a32c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
ca36933e6dea7aa507a272121b34fdbb

SHA1
3b4741ca0308b345de5ecf6c3565b1dbacb0fb86

SHA256
fd14449eb781c58e6e7196a384caf25cba0c59ebdba3b10f8ca0ecfd0c076b5d

SHA512
5a9b186ecf085765caee97a2910008dda926ce412001042e165184083a52fb5fb70f05ca781cd2f7740ecbd938895c77c5aa0f9eb8d812b92f412f336212720e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit