Analysis Overview
Threat Level: Known bad
The file https://dreamrentalsbyowner.com/ was found to be: Known bad.
Malicious Activity Summary
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2023-08-24 19:57
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2023-08-24 19:57
Reported
2023-08-24 20:00
Platform
win10v2004-20230703-en
Max time kernel
146s
Max time network
146s
Command Line
Signatures
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dreamrentalsbyowner.com/
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7fff759446f8,0x7fff75944708,0x7fff75944718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,18288413792898563534,16841469054131344918,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,18288413792898563534,16841469054131344918,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,18288413792898563534,16841469054131344918,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18288413792898563534,16841469054131344918,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18288413792898563534,16841469054131344918,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,18288413792898563534,16841469054131344918,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,18288413792898563534,16841469054131344918,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18288413792898563534,16841469054131344918,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18288413792898563534,16841469054131344918,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18288413792898563534,16841469054131344918,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18288413792898563534,16841469054131344918,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,18288413792898563534,16841469054131344918,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6088 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,18288413792898563534,16841469054131344918,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5000 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 158.240.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | dreamrentalsbyowner.com | udp |
| US | 185.160.67.68:443 | dreamrentalsbyowner.com | tcp |
| US | 8.8.8.8:53 | 68.67.160.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 134.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 2.136.104.51.in-addr.arpa | udp |
| US | 185.160.67.68:443 | dreamrentalsbyowner.com | tcp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 185.160.67.68:443 | dreamrentalsbyowner.com | tcp |
| US | 185.160.67.68:443 | dreamrentalsbyowner.com | tcp |
| US | 8.8.8.8:53 | 203.151.224.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 27.178.89.13.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | b950ebe404eda736e529f1b0a975e8db |
| SHA1 | 4d2c020f1aa70e2bcb666a2dd144d1f3588430b8 |
| SHA256 | bcc60276d7110e8d002f24d66ebb043c5761e2a4b6ae7854983cef4beacd9bf4 |
| SHA512 | 6ba228e5b6464c9602db81de8e1189302d0b2aed78a8b06248ccd9f095ede8621fc9d0faed0a7d079b8c7f4d1164b2895c4d0ef99c93cb95bbe210033e40295a |
\??\pipe\LOCAL\crashpad_2488_MOXLQAMMQMXOBXIH
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | f5ab65f9151905989db3420245a1a43e |
| SHA1 | 31729f1841a2a41780a748fd371664809732718e |
| SHA256 | 83c566a45118835d1b3ab362826e55f07aae4a213b92b151e6dd1807635cee71 |
| SHA512 | 82bdb40ead7d02c31e31a711b84f0ee88bb040ff8ed61e748ea1cf9c03ecbb792e4385e18ae5092e94214669d030adf33dff48fc16f3f4b40efa6b6bf11be7d6 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | d2cffdc313517b7e534b79b692729d10 |
| SHA1 | 1f8a9038c2a7f468f1596cd74e48de1d963afeb9 |
| SHA256 | e19673ef17728e62387711b242f28be5d00cc1691a668550e2c82aa14cd7ca0e |
| SHA512 | 8767cb9cd476eafeefb9b83f320b66a5427c8780287db6dc60efbbdc3051b0d9caa2728467a118a9e423c796760dd8cef64c193a1a44af22a2770090c6bb7087 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 401f969b59c6e63a72bc199eb5208eee |
| SHA1 | f573f57b0d1d147793d2e2fc190d3869f74a5c5b |
| SHA256 | 9a5cfeb904143a158b5d9c6de6ef0f0485e6a2ac068401127598d5c057e8b1f8 |
| SHA512 | 2cdb8c3f7533f418570381581da77857cc9503191051dc33cc80d4a868043fe5be166e7e3b118a95b5c570117eaf01a216e249687755372ab513fc6a61e2e252 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
| MD5 | ca36933e6dea7aa507a272121b34fdbb |
| SHA1 | 3b4741ca0308b345de5ecf6c3565b1dbacb0fb86 |
| SHA256 | fd14449eb781c58e6e7196a384caf25cba0c59ebdba3b10f8ca0ecfd0c076b5d |
| SHA512 | 5a9b186ecf085765caee97a2910008dda926ce412001042e165184083a52fb5fb70f05ca781cd2f7740ecbd938895c77c5aa0f9eb8d812b92f412f336212720e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | 285252a2f6327d41eab203dc2f402c67 |
| SHA1 | acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6 |
| SHA256 | 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026 |
| SHA512 | 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | ce229a94645d755c1e8bfdf4689220fb |
| SHA1 | 96b7b84b864c7940643b12797e5245837be8a0be |
| SHA256 | 1766ef156bbbd7e62655fca1ddb80b9531c79d8cee294aeab8ce2bdf81b5c08f |
| SHA512 | 3c466942c50e5f5bc00141dbd41e674ff0ef0d1e3fb5f0e75b51412ad6df13f154b33b8c862f3e2169d66d03ac1bdc9cf2857cd8e6122a39d5e2489949feb336 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580ba3.TMP
| MD5 | e4a300651d7f78d1ea1ea460bdbf01d7 |
| SHA1 | 1b3a1f20b426bf65924f2d4d008de3cb19589c06 |
| SHA256 | 5bb4c77e15022d7d9dcbf856484d6818060f8ca805035fc2c5b23e50c33a36dd |
| SHA512 | 4efc1b86add0efbd06c11318f2d9a9ea909d34790f11576acf914527c8a4a09cd8329ab5827307ca51ba4adfd505733cce5ea7d45a6c8d47ded1057e047c7234 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | b7c165f0abe872d0958f11d185c14702 |
| SHA1 | 787f842dfd767a43f1c74715400f66cb548075db |
| SHA256 | ec82e9758ebc93124f379d7323f707cc755636685efb4f8c61d880aeb8880f18 |
| SHA512 | 01f8f400aa3e2e4d1607dcb7dd22b99d0da4f52e2909bc1633371b5c96bee498ad190e033f36917f601763eed7738a775e1fa381b2e3b763fa263b5ce519a2fb |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | 900919969731a978625b3c3020e8c19d |
| SHA1 | 0d3174fc08fa87998d0bd0229a231b6b85388f1b |
| SHA256 | b8ba8fd37714c568d9069808a14af381d3110c14a612040217662ca051a097ab |
| SHA512 | 96275628e15b5e4b2191e074a189917f23c8b161adc0b92096f631a5f7a75dce32bb4df0dcdeff38a93435d277272d572a6b8f769bcf8cbcf02ab4d9e3f02ce6 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 85b4e7159b6598ccac98cd277987e978 |
| SHA1 | c8a19e9f5c1313ed28412a9d23bdd66b2c69b387 |
| SHA256 | fbb927cacd14adb28446704f7e6c084d77e935532224f0e1b37adf2e0e804c80 |
| SHA512 | 7865e98a907b83e75696fc44f9824c8b2e0c2effef2495a6b68320f60823ca7e66085d0a4644e7d1567c9e336a8dfb4f8a26094be7cec43e2a4176d641b38eb7 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
| MD5 | 8707311ee31897502bca895b1cd7c01c |
| SHA1 | 59c83a349bcab7493ba3cd5e2883d1f0cefc3c02 |
| SHA256 | 58781a66bb67723599bae860ed5d032a61b664b75e788c5711da12a15aaf8057 |
| SHA512 | 57cb1c1ccb6b21030822b9a5775361ecb8c2e6fadec33e3754dbf23dd10fac4a42dd9a19cb91ec521781da764ff0e9dc16fef11f4c094f9cf3f5b04b27320285 |
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
| MD5 | d48cc96c5b037b333db535083a9e7931 |
| SHA1 | 75c1899c548a5e74f700d5a77b526bda6239c062 |
| SHA256 | 2680fa0cbfa9a41ec7b81669a8e8d47860a76c949250f66d67f23fba41efe2e1 |
| SHA512 | 8885660c01e2c48277d31a5fba3507a23579d4253bddaea67dfc23545b5f8c6569062cb8da8b6a62dc11a7a36163995da1ad93cee4792778d949f09dd12a8a05 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 12052c8419f7e49876143a7ccd840a7a |
| SHA1 | d962ae694a49753bbfddf8558906c82c2ff4cfba |
| SHA256 | a3e8990dfa963e6fbfb0dbd6091e202643d46f1c61a820fc1c71092223fd8380 |
| SHA512 | dc24e6302a7feecd54234d9cf3510ebe84ccdaf154958e905ae97c8583b25ff6e6fc50a5fd01ba58c02b42a40799cc06099a6438228b1419839689deced59e07 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
| MD5 | dcb24674c1c40988bab9582898c4d96b |
| SHA1 | 63d3d858d07dc9d659a5a912224f58444d960329 |
| SHA256 | ab176141e375a21cb4a07a651f4bb069eb7e387d6fa6bab716622af2dfa2e237 |
| SHA512 | 77dd82750a08d492d0efd5427f79fa3d4b4769d8ce083c733e0d5a5d07e4cd9c0c4e2e245e6a416ea2e2b94e1a0e4e61d5cd9b646c7e29d1915a61150b018f2d |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
| MD5 | eb740bfa39ef588fddf9dbff85638407 |
| SHA1 | 8981c5d1bd79817bdd12ea9a8f4a174bd88648db |
| SHA256 | 1b1d7282ec0133068922c22f2c041533bdbe55e5f2ecdb9fcecafe0d436d70fb |
| SHA512 | b8aad4f309ced3f0f734e3587f88e8ff16dbe06bba8e928bf93eead918532b90e9648e1bfdf8659a95b0649dec9a35d20488f265ed5dc9faddcf9bd8e0913c69 |