hxxps://www[.]vibeaccount[.]com/profile/confirmEmailAddress[.]do?code=ECpmanBLXqVw6FZjLa08tE1bD268496945

Analysis

max time kernel
147s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2023, 17:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.vibeaccount.com/profile/confirmEmailAddress.do?code=ECpmanBLXqVw6FZjLa08tE1bD268496945

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1408	msedge.exe
1408	msedge.exe
1584	msedge.exe
1584	msedge.exe
4516	identity_helper.exe
4516	identity_helper.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe
1860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe
1584	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 3660	1584	msedge.exe	80
PID 1584 wrote to memory of 3660	1584	msedge.exe	80
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1956	1584	msedge.exe	82
PID 1584 wrote to memory of 1408	1584	msedge.exe	81
PID 1584 wrote to memory of 1408	1584	msedge.exe	81
PID 1584 wrote to memory of 4868	1584	msedge.exe	83
PID 1584 wrote to memory of 4868	1584	msedge.exe	83
PID 1584 wrote to memory of 4868	1584	msedge.exe	83
PID 1584 wrote to memory of 4868	1584	msedge.exe	83
PID 1584 wrote to memory of 4868	1584	msedge.exe	83
PID 1584 wrote to memory of 4868	1584	msedge.exe	83
PID 1584 wrote to memory of 4868	1584	msedge.exe	83
PID 1584 wrote to memory of 4868	1584	msedge.exe	83
PID 1584 wrote to memory of 4868	1584	msedge.exe	83
PID 1584 wrote to memory of 4868	1584	msedge.exe	83
PID 1584 wrote to memory of 4868	1584	msedge.exe	83
PID 1584 wrote to memory of 4868	1584	msedge.exe	83
PID 1584 wrote to memory of 4868	1584	msedge.exe	83
PID 1584 wrote to memory of 4868	1584	msedge.exe	83
PID 1584 wrote to memory of 4868	1584	msedge.exe	83
PID 1584 wrote to memory of 4868	1584	msedge.exe	83
PID 1584 wrote to memory of 4868	1584	msedge.exe	83
PID 1584 wrote to memory of 4868	1584	msedge.exe	83
PID 1584 wrote to memory of 4868	1584	msedge.exe	83
PID 1584 wrote to memory of 4868	1584	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.vibeaccount.com/profile/confirmEmailAddress.do?code=ECpmanBLXqVw6FZjLa08tE1bD268496945
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff03df46f8,0x7fff03df4708,0x7fff03df4718
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,10600052514774529343,5004637890080426027,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,10600052514774529343,5004637890080426027,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,10600052514774529343,5004637890080426027,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10600052514774529343,5004637890080426027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10600052514774529343,5004637890080426027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10600052514774529343,5004637890080426027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,10600052514774529343,5004637890080426027,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,10600052514774529343,5004637890080426027,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10600052514774529343,5004637890080426027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10600052514774529343,5004637890080426027,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10600052514774529343,5004637890080426027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10600052514774529343,5004637890080426027,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10600052514774529343,5004637890080426027,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,10600052514774529343,5004637890080426027,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3028 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b950ebe404eda736e529f1b0a975e8db

SHA1
4d2c020f1aa70e2bcb666a2dd144d1f3588430b8

SHA256
bcc60276d7110e8d002f24d66ebb043c5761e2a4b6ae7854983cef4beacd9bf4

SHA512
6ba228e5b6464c9602db81de8e1189302d0b2aed78a8b06248ccd9f095ede8621fc9d0faed0a7d079b8c7f4d1164b2895c4d0ef99c93cb95bbe210033e40295a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
b7ff0dde3da79ffbe0104b38c030a29d

SHA1
dd1c692d9d2f4404250552c27d4806e460742108

SHA256
47295f41dd863d7e1a935b15f1bb22903625677b13b73600a99bcc75fe56a8b2

SHA512
ad2809e310dca882ed9829e73e4cf192f3ffd977914384ee8f1a1de8fe95d0deeed27f31e85b9eeb0d2bd2788d563740bb6cd302775bf8ee67ded737aa8c553c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
fb01562907849fd8abcdde9484b8fea4

SHA1
3077f8fa00c415990481c7e4863d22e5b6463ef7

SHA256
3354399b103b3c63d9d1a7a1f81f964d12e1f09cb3c9c554731ea718e452a815

SHA512
0df7c20ec01576fe7c78abad07fec0bb6f19fdaeae3a11ab6f1f7e682110e7d23f24bc4f9c87bb554df84a0785cfb9500c306905c6cae83f35513ad640bee422

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
583652e9b772d23789fb48d56c27c1e5

SHA1
aa6086340f4853b7841687f86745468ddb3bb85f

SHA256
fc6c1910f891d0ebf1555dc551b95ec9bea6c44c7d3152820c42657269bdfb36

SHA512
47897e679dfcd5de9dfb53b5f14c2335a3bf01f7559236646a81ea1be6ebd7ed64277690ab22e18f92f96af4725b10926664a86810f01856458ac2528e17b4f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f9a3f75be3278f6b3a8ef707584a7d76

SHA1
a25b4dcf59c1bbf15dd6403a7e851316c37f6882

SHA256
8526ecc3a2057e93b69ec28218e455ac4f2493b212dc79c85fe71dd4e3e56289

SHA512
63a85fd21644bb94a11a49f3880d75eef00d463e78cab89230350d0db1321e1f8805416d641d9764b23568b0970e11baa6ba3f5e30d8057ba7e51d29027d533a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
ca36933e6dea7aa507a272121b34fdbb

SHA1
3b4741ca0308b345de5ecf6c3565b1dbacb0fb86

SHA256
fd14449eb781c58e6e7196a384caf25cba0c59ebdba3b10f8ca0ecfd0c076b5d

SHA512
5a9b186ecf085765caee97a2910008dda926ce412001042e165184083a52fb5fb70f05ca781cd2f7740ecbd938895c77c5aa0f9eb8d812b92f412f336212720e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d24b1264549ae1286561bb15a8eb3bf7

SHA1
8917f299c419516aed986e1479901560213548a6

SHA256
86274dc9718531d5c8d9b8442e1ce57342cc9e7360365028cac140418aae2446

SHA512
635874ed1e5c6967c61d32d62053ae99f59fe6f75ff2487ac50b39a47a50a159014bf1442f1fdf270cd99b068fdd33b92eceea3375c40b41dbe397148af5101a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580579.TMP

Filesize
1KB

MD5
a1632682410691531ede8dd2eec4d83f

SHA1
549e34912272ffcea4044ed427536f93e48d7e76

SHA256
129ee0eaccfe01ab88f79730d4d6dba130b9e93b79668a6ab47dbdd8f7a1b75d

SHA512
6211c65e91fc812f2cecd1c4a4654730a0d509892d032034a85fa82e826c2fd3e71d13a28322d544719eca5581ecf1200083e9ac5583ede0b286c5f994c1ff70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
b5442028a4ea011b306fc7dde3786141

SHA1
7fcecbe790af06504c11e858b4e9edc1b081066d

SHA256
916c9595c8713173af6d26925acc02a73f9d72df4aee0f8ea5f13fb540a57e45

SHA512
f399c1bd54e4c1130d7ed44bd5b8fd9d1ffe457c389a3858a4307aa8b0c4e34858ce6b0be0f58414ba0f4453dc36a5e49c0715d7c4a668448d79d614deef3e5c

Download Submit