hxxps://123milhasfidelidade[.]com/loginjsf[.]php?98555=bcde2e1350e5b335de6b8f31d6ab7583&98555

Analysis

max time kernel
155s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
03-08-2023 02:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://123milhasfidelidade.com/loginjsf.php?98555=bcde2e1350e5b335de6b8f31d6ab7583&98555

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
4624	msedge.exe
4624	msedge.exe
4800	identity_helper.exe
4800	identity_helper.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 4552	4624	msedge.exe	85
PID 4624 wrote to memory of 4552	4624	msedge.exe	85
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 3128	4624	msedge.exe	86
PID 4624 wrote to memory of 5000	4624	msedge.exe	87
PID 4624 wrote to memory of 5000	4624	msedge.exe	87
PID 4624 wrote to memory of 4784	4624	msedge.exe	88
PID 4624 wrote to memory of 4784	4624	msedge.exe	88
PID 4624 wrote to memory of 4784	4624	msedge.exe	88
PID 4624 wrote to memory of 4784	4624	msedge.exe	88
PID 4624 wrote to memory of 4784	4624	msedge.exe	88
PID 4624 wrote to memory of 4784	4624	msedge.exe	88
PID 4624 wrote to memory of 4784	4624	msedge.exe	88
PID 4624 wrote to memory of 4784	4624	msedge.exe	88
PID 4624 wrote to memory of 4784	4624	msedge.exe	88
PID 4624 wrote to memory of 4784	4624	msedge.exe	88
PID 4624 wrote to memory of 4784	4624	msedge.exe	88
PID 4624 wrote to memory of 4784	4624	msedge.exe	88
PID 4624 wrote to memory of 4784	4624	msedge.exe	88
PID 4624 wrote to memory of 4784	4624	msedge.exe	88
PID 4624 wrote to memory of 4784	4624	msedge.exe	88
PID 4624 wrote to memory of 4784	4624	msedge.exe	88
PID 4624 wrote to memory of 4784	4624	msedge.exe	88
PID 4624 wrote to memory of 4784	4624	msedge.exe	88
PID 4624 wrote to memory of 4784	4624	msedge.exe	88
PID 4624 wrote to memory of 4784	4624	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://123milhasfidelidade.com/loginjsf.php?98555=bcde2e1350e5b335de6b8f31d6ab7583&98555
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9174346f8,0x7ff917434708,0x7ff917434718
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,1135831218015721249,4363230333088594151,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,1135831218015721249,4363230333088594151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,1135831218015721249,4363230333088594151,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3132 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1135831218015721249,4363230333088594151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1135831218015721249,4363230333088594151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1135831218015721249,4363230333088594151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1135831218015721249,4363230333088594151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,1135831218015721249,4363230333088594151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,1135831218015721249,4363230333088594151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1135831218015721249,4363230333088594151,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1135831218015721249,4363230333088594151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3840 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1135831218015721249,4363230333088594151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1135831218015721249,4363230333088594151,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1135831218015721249,4363230333088594151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1135831218015721249,4363230333088594151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1120 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,1135831218015721249,4363230333088594151,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5056 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8411007bafe7b1182af1ad3a1809b4f8

SHA1
4a78ee0762aadd53accae8bb211b8b18dc602070

SHA256
1f274d0d144942d00e43fb94f9c27fc91c68dce50cd374ac6be4472b08215ca3

SHA512
909e2e33b7614cb8bbd14e0dfff1b7f98f4abbf735f88292546ce3bfa665e4cb5ee4418561004e56afc5dd30d21483b05f6358dad5624c0dc3ab1ba9a3be18eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b872903d04ef4045b92631b4b993e350

SHA1
fc6f1e3edf5f61a6419fa654d7f528088038f56e

SHA256
548a684d7835050d4eb9566f27ad36abbabdc7d841f293a590f6e4976a0b3d07

SHA512
d747d887f0cb8e7bee0862d523f5936b674682629121dd94c295b95f6aabe0dc706a6f93e1bc27351d4d8af5d85fc689f021684fe9eae30517679edfd3807328

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4c362b3414385dcc6df07574b0ef05e2

SHA1
2d1bfef6b5ccc9439deb1a028889140c9a002cca

SHA256
5a58dabe966603295e1532895e345ca2d5eeb3267f7384101057b56d9113c440

SHA512
ae997bffb8961600b375b4b4c25b61348a1568c227fe692f5c7220af66720845652fa3e6adb8ef2086c3a083129f24605ed77dfe5d9ec6215f1d6dbbb58e0218

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
8caf4d73cc5a7d5e3fb3f9f1a9d4a0cc

SHA1
83f8586805286b716c70ddd14a2b7ec6a4d9d0fe

SHA256
0e0c905b688340512e84db6cf8af6dbdfe29195fefde15bd02e4917a2c5fda8c

SHA512
084ef25ea21ee1083735c61b758281ba84b607e42d0186c35c3700b24a176ada47bf2e76ed7dadd3846f2b458c977e83835ced01cda47cdd7ab2d00e5a1a294e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
5ff674e27324345b13535fd7a4f1d651

SHA1
25ec4c77fcd52c8c3f9b5a11f82da129a157d3e4

SHA256
1a4df3f4924dbb9a10a186759af8b40a3f34144f2366a67655f55fea8771b76c

SHA512
9169fae5650ae6717da67117b7d8c76cb6735757f81c7a67dd96388c62c7c69ed660dd0baa65bc07a0f4319df36b3f947a6b0038475d39e9c54981861de4be1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a033aef1c6e38ea6e4ac9bef70108a0e

SHA1
d837fce5a0eb1a29b49d9f694d63a674e8932a96

SHA256
3956202f505c372ff733db6bbff8c7232a268aff27dfd1d1d278eb089b714563

SHA512
871b993b373295d141732b81e088f406eddd96007acce7cc8bc8d1a97da03b746992cbb0129e994ce2b7fe74f5d1e5aeac9ae1115c087c409f6bdadb4b8c484b

Download Submit