hxxps://dyniegh-knauern-spraiorly[.]yolasite[.]com/

Resubmissions

25/08/2023, 23:49

230825-3t8amshd3t 1

25/08/2023, 23:44

230825-3rb5eshc8w 1

Analysis

max time kernel
131s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2023, 23:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://dyniegh-knauern-spraiorly.yolasite.com/

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
1176	msedge.exe
1176	msedge.exe
1276	identity_helper.exe
1276	identity_helper.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 5040	1176	msedge.exe	39
PID 1176 wrote to memory of 5040	1176	msedge.exe	39
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 2588	1176	msedge.exe	83
PID 1176 wrote to memory of 3976	1176	msedge.exe	82
PID 1176 wrote to memory of 3976	1176	msedge.exe	82
PID 1176 wrote to memory of 4088	1176	msedge.exe	84
PID 1176 wrote to memory of 4088	1176	msedge.exe	84
PID 1176 wrote to memory of 4088	1176	msedge.exe	84
PID 1176 wrote to memory of 4088	1176	msedge.exe	84
PID 1176 wrote to memory of 4088	1176	msedge.exe	84
PID 1176 wrote to memory of 4088	1176	msedge.exe	84
PID 1176 wrote to memory of 4088	1176	msedge.exe	84
PID 1176 wrote to memory of 4088	1176	msedge.exe	84
PID 1176 wrote to memory of 4088	1176	msedge.exe	84
PID 1176 wrote to memory of 4088	1176	msedge.exe	84
PID 1176 wrote to memory of 4088	1176	msedge.exe	84
PID 1176 wrote to memory of 4088	1176	msedge.exe	84
PID 1176 wrote to memory of 4088	1176	msedge.exe	84
PID 1176 wrote to memory of 4088	1176	msedge.exe	84
PID 1176 wrote to memory of 4088	1176	msedge.exe	84
PID 1176 wrote to memory of 4088	1176	msedge.exe	84
PID 1176 wrote to memory of 4088	1176	msedge.exe	84
PID 1176 wrote to memory of 4088	1176	msedge.exe	84
PID 1176 wrote to memory of 4088	1176	msedge.exe	84
PID 1176 wrote to memory of 4088	1176	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dyniegh-knauern-spraiorly.yolasite.com/
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd61e146f8,0x7ffd61e14708,0x7ffd61e14718
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,6976016070560327043,1573260019842373661,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,6976016070560327043,1573260019842373661,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,6976016070560327043,1573260019842373661,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6976016070560327043,1573260019842373661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6976016070560327043,1573260019842373661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,6976016070560327043,1573260019842373661,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,6976016070560327043,1573260019842373661,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6976016070560327043,1573260019842373661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6976016070560327043,1573260019842373661,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6976016070560327043,1573260019842373661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6976016070560327043,1573260019842373661,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,6976016070560327043,1573260019842373661,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a7ad9bb1054aa03e39b3554833d0c3ec

SHA1
cbd5b99ca100bc2f1292df23bf8e2a5a6f9640d9

SHA256
0c3eae39386b4117ad26187afc4933e254468cd12d813271f4b7420cee73c189

SHA512
d1d0b77e0bc412b4ee687e849531a7c9b70200d45d0bdbf38357b6fc59af835522e749b2fd8c2d4cde73518970568c38d73416c97381a11cc6029c14b1678276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
e64861c87998d5c6a6df32ae1f3fb90a

SHA1
becec98c4c6c051efec9b4215c9530a26b66654a

SHA256
c6386901e094ad8b395e0908a244b554292b16d313617a29c5d83eb2a8249dda

SHA512
80b1f85fd83feaf649f18f9a765b4cc1ec6144b93ec9d8edf8cef4d665e56abf4d3ccb0d2b0f8fa90e2d1fdc23a6543c42eaef9fc510c32ded8d64dd3f6fb06a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
671B

MD5
31fd2b5f939f07ae50b7fcba4051643b

SHA1
37e83a2c4e19e661656cc749f059e725fe393393

SHA256
9b185564dc08b1e52e6df8847a6885293730c60c1d4b65e089b87f7bdd34c43c

SHA512
746f4d1c919507c61e9ee02bd3f0a8f946ff563796ce484052e351972ad5675160be108ec6f63f14a2a4b6c8e2fcd64eda5687d7717fd6ee94d1dab9212c54bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e3b41aab7a6e94755890bc4def8c0d52

SHA1
3de22dcd1e9938489cbc2e18dc8c7b62a2097083

SHA256
ca1c6f51ae397814c4c03b9069952472db1a903d6e605690ecba6941d5bb2e35

SHA512
aa14d317b70230a2129c608c3309ff84369072fa582c1061ac5b1f6f0ae2b7cc2fde623648c7bb2d1e607fada6f52890a660def6b4d188e4e5161ca0caed6773

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3b9eb6532ed8f1072313317723492ecf

SHA1
a30fe136a32e53ed3d60f54808e2c8f8b42c26b0

SHA256
e2f905072539d60f0bd170ee4968871d1de1740c8163e701e9f77065b7481e4a

SHA512
856b3b9e71f51811501bec0da0c887c54365e4c8ff1026ed386d2f5c07827518a158fce3b193794ad23c0c9076bbf6ef17b73a8e7e83701d918522770836d7b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5ea981cb4c0fd2cff4595f8531418920

SHA1
eae9a1be319025c18fd42136457ae9e45d6d9418

SHA256
4986366e35d249de27ebd80eb7ec188cb8d6b444a45eaba5a066390854c3ab3b

SHA512
d175c701236d524814c5ebead3b57aa09535089a1c3bd957e0c8530ae795ce65d69eaf96f78068f02978f57f31c465d555c4c0175994b2f12cec44e4b13bb965

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e62cc4051e1f8eaa0abda5d730a2496b

SHA1
d15346e40b196bc313cbfe5ac96b3c90b83345be

SHA256
ffb5b740b8777d010f0d32a120092084c3cd32eaceb937188d698ddc22df2fcb

SHA512
3e8f6d89c7c153177b2149d86cd8602ceafedf66f5335a86b19dfa46fc38c47f6ff9a272c3b71b4464a5921ebdf2461fba25692ca916b9715bac520bf1e81a22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c5b187fd802d80b1e2259df54c7e0270

SHA1
eacb22aa355776d17345c19ebeb61012ec49621b

SHA256
f8ca92191630fe39331cd7f4282c687ab809e78e99e7b4ecc3b03cf80fba7bdf

SHA512
e77bfd8e4c9da41c30636b4aa0954db5bdb545465435a0f15c3979819ea25ae48a533bd968d1555cf3c551bbf11a15df8c80a9dabdaf16b69bd3c233f13436b1

Download Submit