hxxp://che[.]c[.]com[.]co

Analysis

max time kernel
481s
max time network
489s
platform
windows10-2004_x64
resource
win10v2004-20230703-es
resource tags

arch:x64arch:x86image:win10v2004-20230703-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
15/08/2023, 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://che.c.com.co

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2944	msedge.exe
2944	msedge.exe
1508	msedge.exe
1508	msedge.exe
3500	identity_helper.exe
3500	identity_helper.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 1924	1508	msedge.exe	82
PID 1508 wrote to memory of 1924	1508	msedge.exe	82
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 1888	1508	msedge.exe	84
PID 1508 wrote to memory of 2944	1508	msedge.exe	83
PID 1508 wrote to memory of 2944	1508	msedge.exe	83
PID 1508 wrote to memory of 2580	1508	msedge.exe	85
PID 1508 wrote to memory of 2580	1508	msedge.exe	85
PID 1508 wrote to memory of 2580	1508	msedge.exe	85
PID 1508 wrote to memory of 2580	1508	msedge.exe	85
PID 1508 wrote to memory of 2580	1508	msedge.exe	85
PID 1508 wrote to memory of 2580	1508	msedge.exe	85
PID 1508 wrote to memory of 2580	1508	msedge.exe	85
PID 1508 wrote to memory of 2580	1508	msedge.exe	85
PID 1508 wrote to memory of 2580	1508	msedge.exe	85
PID 1508 wrote to memory of 2580	1508	msedge.exe	85
PID 1508 wrote to memory of 2580	1508	msedge.exe	85
PID 1508 wrote to memory of 2580	1508	msedge.exe	85
PID 1508 wrote to memory of 2580	1508	msedge.exe	85
PID 1508 wrote to memory of 2580	1508	msedge.exe	85
PID 1508 wrote to memory of 2580	1508	msedge.exe	85
PID 1508 wrote to memory of 2580	1508	msedge.exe	85
PID 1508 wrote to memory of 2580	1508	msedge.exe	85
PID 1508 wrote to memory of 2580	1508	msedge.exe	85
PID 1508 wrote to memory of 2580	1508	msedge.exe	85
PID 1508 wrote to memory of 2580	1508	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://che.c.com.co
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd22ba46f8,0x7ffd22ba4708,0x7ffd22ba4718
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,7345109177411532503,10647540832849452485,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,7345109177411532503,10647540832849452485,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,7345109177411532503,10647540832849452485,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7345109177411532503,10647540832849452485,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7345109177411532503,10647540832849452485,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7345109177411532503,10647540832849452485,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,7345109177411532503,10647540832849452485,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,7345109177411532503,10647540832849452485,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7345109177411532503,10647540832849452485,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7345109177411532503,10647540832849452485,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7345109177411532503,10647540832849452485,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,7345109177411532503,10647540832849452485,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,7345109177411532503,10647540832849452485,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4508 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f6f47b83c67fe32ee32811d6611d269c

SHA1
b32353d1d0ed26e0dd5b5f1f402ffd41a105d025

SHA256
ac1866f15ff34d1df4dafa761dbb7dc2c712fe01ac0e171706ef29e205549cbc

SHA512
6ee068efa9fbd3c972169427be2f6377a1204bf99b61579e4d78643e89e729ad65f2abcc70007fd0dd38428e7cd39010a253d6f9cd5e90409e207ddaf5d6720d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
ad167d179a65cca873899c3fcb137932

SHA1
eed375a3f1e45b123118a9edb185f664ecab52a6

SHA256
4d5970742b749a64c2ca072b45f9ec9d5e4d720e57073dfa24840c85cab43d51

SHA512
34282c4ec53c06f2accbe80fa9d4ae8fb29ebadc6beeb4b8fa2faa2b1ff6646fac276e32503438d999da4a0ded956be383cb43b4aa37d752d7325d4d8eac37d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1009B

MD5
e60c641989019e652255173af60d6095

SHA1
daac6c1d1afc166be2c5300d9261bbc460dafc8a

SHA256
2f819cf5b7caaa087c5553e750758bb7f592d0d65a2216015c2af52ef2ad2168

SHA512
5acddaaf7630fe58ee662f9f29227af2d456bb2d835896c4469871ac4c418990103e6f5a4e0ccd21c8ed7a4486f2179fd6b1f0b95ed2f6bdd8dab9e3c0102215

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
813bcb3bb9caa24c7ea09659c515c81f

SHA1
09c81ad69a73762e6f282175cdb52f5964d6e04b

SHA256
4df615efda3722e141c8efd790db58388bbdea2c4443638479d28d8a5136750f

SHA512
3dd053d61fd48bdeb752ff34e86e4f588c626f8e06710b313a7bef1bf8e3cfe3f9580c17437057468a81ab74c587e8e888ac47a76c5c01a326163e7a598e48c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1f4f67778fceb3e2036cef95ce000299

SHA1
c05496d51c8b2eddfde9740a6a37ac9ccb81e0ed

SHA256
a4371fa8b1f3266c88c2d9cd94bcedafe092a4e9d894a644de2a320e5b1b31ce

SHA512
fc5bec1f63324dba57a2ff30e3061b9aa12ceadf3c7c7fd00c202fda8c1413e025ca1182a1b25eb1726305e52478fb974e3ef51b78c7955ae4c4a6920d3b20f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a371cadf6c822aa86a862d9ac1ddfbec

SHA1
8d13ea0f349fc7902394f94c7b6d63e2a943cc3b

SHA256
3715e890fefb926443f8249bed9a02ab875076227646a2d7e734925a37d92678

SHA512
f4abc55a40de4ff464c64a3abd22e7339e97dcea02d773559729903a9835def06a266ac53932f4e88231842270fb27a1bcb83779d0ccb69d6d5ccc67e7602de5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5544c64f2a8f49dabc19eb84267b1c9b

SHA1
c5b78d63a8bab1c7b985f7ea2f268d0d7809071e

SHA256
a1fcfee2974a77e76a7431a2069db301861ab42dd41769cead8697f41f5a497f

SHA512
38c80d7c810441fc87beff38929473088cf426b0a25a30820d8a060f493350d99bb8521b314afe00578ea54648fce2aa4e55880a83a4f1048c56307991726565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
6ba8dc82b61bd7aeab09b00d2492006c

SHA1
c45d399f053f4d3de38ee12e7c8012a0047f878b

SHA256
4cd0f18845aa5793c6e25d26b174882881198c2d95acde7d4b0e3d7495cc503a

SHA512
810a31b5d7ee3dd6acc042d3e86d4a08b6cffad49555defd925b1dc7f32b4b9215192d1d5a55de8bd94fee4d04e685d981c1dc155515671835607bbaff7ffb90

Download Submit