hxxp://restoremyato[.]com/

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2023, 05:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://restoremyato.com/

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4892	msedge.exe
4892	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
1556	identity_helper.exe
1556	identity_helper.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 4628	2832	msedge.exe	82
PID 2832 wrote to memory of 4628	2832	msedge.exe	82
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 1164	2832	msedge.exe	83
PID 2832 wrote to memory of 4892	2832	msedge.exe	84
PID 2832 wrote to memory of 4892	2832	msedge.exe	84
PID 2832 wrote to memory of 3208	2832	msedge.exe	85
PID 2832 wrote to memory of 3208	2832	msedge.exe	85
PID 2832 wrote to memory of 3208	2832	msedge.exe	85
PID 2832 wrote to memory of 3208	2832	msedge.exe	85
PID 2832 wrote to memory of 3208	2832	msedge.exe	85
PID 2832 wrote to memory of 3208	2832	msedge.exe	85
PID 2832 wrote to memory of 3208	2832	msedge.exe	85
PID 2832 wrote to memory of 3208	2832	msedge.exe	85
PID 2832 wrote to memory of 3208	2832	msedge.exe	85
PID 2832 wrote to memory of 3208	2832	msedge.exe	85
PID 2832 wrote to memory of 3208	2832	msedge.exe	85
PID 2832 wrote to memory of 3208	2832	msedge.exe	85
PID 2832 wrote to memory of 3208	2832	msedge.exe	85
PID 2832 wrote to memory of 3208	2832	msedge.exe	85
PID 2832 wrote to memory of 3208	2832	msedge.exe	85
PID 2832 wrote to memory of 3208	2832	msedge.exe	85
PID 2832 wrote to memory of 3208	2832	msedge.exe	85
PID 2832 wrote to memory of 3208	2832	msedge.exe	85
PID 2832 wrote to memory of 3208	2832	msedge.exe	85
PID 2832 wrote to memory of 3208	2832	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://restoremyato.com/
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc2e5346f8,0x7ffc2e534708,0x7ffc2e534718
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,7157938386675208081,12408570370217224671,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,7157938386675208081,12408570370217224671,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2548 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,7157938386675208081,12408570370217224671,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7157938386675208081,12408570370217224671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7157938386675208081,12408570370217224671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7157938386675208081,12408570370217224671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2268 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,7157938386675208081,12408570370217224671,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,7157938386675208081,12408570370217224671,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7157938386675208081,12408570370217224671,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7157938386675208081,12408570370217224671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7157938386675208081,12408570370217224671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,7157938386675208081,12408570370217224671,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,7157938386675208081,12408570370217224671,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3452 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f6f47b83c67fe32ee32811d6611d269c

SHA1
b32353d1d0ed26e0dd5b5f1f402ffd41a105d025

SHA256
ac1866f15ff34d1df4dafa761dbb7dc2c712fe01ac0e171706ef29e205549cbc

SHA512
6ee068efa9fbd3c972169427be2f6377a1204bf99b61579e4d78643e89e729ad65f2abcc70007fd0dd38428e7cd39010a253d6f9cd5e90409e207ddaf5d6720d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
896d90d6d6a621970125aa227bb5e8ba

SHA1
bb25860d2fae6e32870ffa51fe7a98697f5af59a

SHA256
6f9f4bc8b75c14e58fe44aae3f29043705d5cbb95a49677192554276d28eae7b

SHA512
9162d94bbc643a2e863889fd5dc31d8f4127d2ea02483f942638efcc5d56578fcc727dcce5ecb356e83a6a1442afb4d84fc8086e60ca94a9eef74750efbe755a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
876B

MD5
9858ffefebe7fcdc4446112001d66b36

SHA1
2691f48e74f7b3b698563cb0efb72d0046b471ab

SHA256
37d39cc3c9043c1f188a45437cda1d1a7d3b8bfb308f0cf364e2c4deb54f4afd

SHA512
2d8256e7418fcb64f72e622df2e8984200bbf0371a9446b3d18ede3b6bd820319f6a71a43b21c0af0f8520b275fe4003eb36c62d721ef5effb24d691e6d02d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fc08d726f4ebecd9338eb359b27c6e98

SHA1
c7b4e86c273b99f912b1709704db00aa4bd3a4d4

SHA256
5fa8fd5fe5a666ed809af5c3f69d26f33dc053cf8c850b6a1842d21cfbe3ff95

SHA512
d5ac58f5834fe809c0c3ca3b512a7a94315534a4393a2f5bd6ef9c3b524e259f68602929abd4163a9567fa664235333d90df1a4ca3cca42d8d9658db68837e80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fbbd609588c6dfd52aaa5599f682a09f

SHA1
c3331feb4df7258dd1487283ad1d39d0de91bc6d

SHA256
b9c072e1e8829700f3e58b7fa2d57d6d494a501ae95937933affe4f59b3d50f6

SHA512
ede225c3c6772195a16b5499abf600abf509c9d7c993dbd71a6a58573378d6d08a7c7cc5c361f98b744f70bdbd6209e64ab97892d9d919a77620c84b1574eb73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5544c64f2a8f49dabc19eb84267b1c9b

SHA1
c5b78d63a8bab1c7b985f7ea2f268d0d7809071e

SHA256
a1fcfee2974a77e76a7431a2069db301861ab42dd41769cead8697f41f5a497f

SHA512
38c80d7c810441fc87beff38929473088cf426b0a25a30820d8a060f493350d99bb8521b314afe00578ea54648fce2aa4e55880a83a4f1048c56307991726565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c1d9e760aa92c2756b4ed2481ef8bbd3

SHA1
69d5cb5f48c41a0aa79c72a3e70e22076923d54e

SHA256
b36019466e412358535d06bfe4817b29d88cd695365668df2beac2fe606c437a

SHA512
da79179391ccef71e49a9c0e9629cc6b46dd7efc46d282bf616ad01cb6e0769d8203cc569519e3ce11baca890ce09457ce0aa6a3477b68479e5274e53f25df42

Download Submit