hxxps://app[.]wondrhealth[.]com/home/learn/lessons/week/25?type=deeplink

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16-08-2023 05:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://app.wondrhealth.com/home/learn/lessons/week/25?type=deeplink

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1776	msedge.exe
1776	msedge.exe
4476	msedge.exe
4476	msedge.exe
4940	identity_helper.exe
4940	identity_helper.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 464	4476	msedge.exe	82
PID 4476 wrote to memory of 464	4476	msedge.exe	82
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 3884	4476	msedge.exe	84
PID 4476 wrote to memory of 1776	4476	msedge.exe	83
PID 4476 wrote to memory of 1776	4476	msedge.exe	83
PID 4476 wrote to memory of 4620	4476	msedge.exe	85
PID 4476 wrote to memory of 4620	4476	msedge.exe	85
PID 4476 wrote to memory of 4620	4476	msedge.exe	85
PID 4476 wrote to memory of 4620	4476	msedge.exe	85
PID 4476 wrote to memory of 4620	4476	msedge.exe	85
PID 4476 wrote to memory of 4620	4476	msedge.exe	85
PID 4476 wrote to memory of 4620	4476	msedge.exe	85
PID 4476 wrote to memory of 4620	4476	msedge.exe	85
PID 4476 wrote to memory of 4620	4476	msedge.exe	85
PID 4476 wrote to memory of 4620	4476	msedge.exe	85
PID 4476 wrote to memory of 4620	4476	msedge.exe	85
PID 4476 wrote to memory of 4620	4476	msedge.exe	85
PID 4476 wrote to memory of 4620	4476	msedge.exe	85
PID 4476 wrote to memory of 4620	4476	msedge.exe	85
PID 4476 wrote to memory of 4620	4476	msedge.exe	85
PID 4476 wrote to memory of 4620	4476	msedge.exe	85
PID 4476 wrote to memory of 4620	4476	msedge.exe	85
PID 4476 wrote to memory of 4620	4476	msedge.exe	85
PID 4476 wrote to memory of 4620	4476	msedge.exe	85
PID 4476 wrote to memory of 4620	4476	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://app.wondrhealth.com/home/learn/lessons/week/25?type=deeplink
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff42cb46f8,0x7fff42cb4708,0x7fff42cb4718
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2240,7197797229714544482,15301256260174689803,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,7197797229714544482,15301256260174689803,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2240,7197797229714544482,15301256260174689803,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,7197797229714544482,15301256260174689803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,7197797229714544482,15301256260174689803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,7197797229714544482,15301256260174689803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,7197797229714544482,15301256260174689803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,7197797229714544482,15301256260174689803,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,7197797229714544482,15301256260174689803,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,7197797229714544482,15301256260174689803,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,7197797229714544482,15301256260174689803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4380 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,7197797229714544482,15301256260174689803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,7197797229714544482,15301256260174689803,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,7197797229714544482,15301256260174689803,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5900 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b950ebe404eda736e529f1b0a975e8db

SHA1
4d2c020f1aa70e2bcb666a2dd144d1f3588430b8

SHA256
bcc60276d7110e8d002f24d66ebb043c5761e2a4b6ae7854983cef4beacd9bf4

SHA512
6ba228e5b6464c9602db81de8e1189302d0b2aed78a8b06248ccd9f095ede8621fc9d0faed0a7d079b8c7f4d1164b2895c4d0ef99c93cb95bbe210033e40295a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
864B

MD5
240d6905cc2c2bc8afd70b1ed45ebdc0

SHA1
af1670029198d4f7ee971eb275816b6879625217

SHA256
562ac4a0235800851a5fc3b6fb47cf2341d9cb333cac216fafbad955adc58e32

SHA512
3d8c14dc4d1a0583bf896c9a7c35b23616c415f58d8cce749a797577681d31c0f75e891a1c9b6cf474e7b6e18fc6806c597006f8d02f0d2b5a934abfc366355b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
aaa608339082f43f419b598e1fa4e6ef

SHA1
953a484d90a4a458b645373800580bbcfbd03f68

SHA256
b9a25ce906ecc631d11bce88e791328d081c5b3f11f36b8697c958af90ac1f7c

SHA512
dbadf95c48c06175afd51dd396428aad08f01af7bf4a6c0b28e33586f604c154b1c4f989ce89e1a43226a7cffa18f82c3cf81433c5648a8058466fe3c8f2214f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9109cc577417a95d23db57dc4ce794d6

SHA1
55c164681d66d935fbd1439071f1821c2d7bb4e3

SHA256
310361c65c613702543765ca6959100259326d3bd76890cb4579d874de695b09

SHA512
406a1000e1e560cf596140b48b636dc00a7149ea5e2538c3ca0d318cecac61913120edd0453931eab5a030b57e180b5b9b283199581bdb8d15a9e23a1a882926

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
64d380e4d5d230a221ea01105cfb91d9

SHA1
e79e92d490e263e16f3997f514862dc3ab8f46bf

SHA256
36d9c0a453b6ee340d060cbd31c1e44f7f7a46df77e44cee72ae342e252becc3

SHA512
d97780786be156fc21a6a32cde53ad3e675690d5e6f53418f5da2931399e8ceb504a843e8b190d319c434536d8cca13c8d5d6a847a4be2bb10b13165c6788fbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
ca36933e6dea7aa507a272121b34fdbb

SHA1
3b4741ca0308b345de5ecf6c3565b1dbacb0fb86

SHA256
fd14449eb781c58e6e7196a384caf25cba0c59ebdba3b10f8ca0ecfd0c076b5d

SHA512
5a9b186ecf085765caee97a2910008dda926ce412001042e165184083a52fb5fb70f05ca781cd2f7740ecbd938895c77c5aa0f9eb8d812b92f412f336212720e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
5354af68835964462bcc147a7a55dd10

SHA1
9ee7bf4f5b839551197a650da38f95249afcd27f

SHA256
5bdbacefe5b88b6bf530b9955a52967e9559db8943a5be90e89b442724954830

SHA512
4d2750efcb073b161687bdda2a1c10d637828f2eb242c49def41d720e6bbf9ddfc03971f34ca4553778c80f6e43992ed01c16d4ce5668f0e9f92ee9c56a4eb82

Download Submit