hxxps://axa-kaartlezer[.]com/crelan/gate/64dc118b29156

Analysis

max time kernel
90s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
16/08/2023, 11:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://axa-kaartlezer.com/crelan/gate/64dc118b29156

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1276	msedge.exe
1276	msedge.exe
4120	msedge.exe
4120	msedge.exe
3496	identity_helper.exe
3496	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 1640	4120	msedge.exe	83
PID 4120 wrote to memory of 1640	4120	msedge.exe	83
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 3032	4120	msedge.exe	85
PID 4120 wrote to memory of 1276	4120	msedge.exe	84
PID 4120 wrote to memory of 1276	4120	msedge.exe	84
PID 4120 wrote to memory of 2256	4120	msedge.exe	86
PID 4120 wrote to memory of 2256	4120	msedge.exe	86
PID 4120 wrote to memory of 2256	4120	msedge.exe	86
PID 4120 wrote to memory of 2256	4120	msedge.exe	86
PID 4120 wrote to memory of 2256	4120	msedge.exe	86
PID 4120 wrote to memory of 2256	4120	msedge.exe	86
PID 4120 wrote to memory of 2256	4120	msedge.exe	86
PID 4120 wrote to memory of 2256	4120	msedge.exe	86
PID 4120 wrote to memory of 2256	4120	msedge.exe	86
PID 4120 wrote to memory of 2256	4120	msedge.exe	86
PID 4120 wrote to memory of 2256	4120	msedge.exe	86
PID 4120 wrote to memory of 2256	4120	msedge.exe	86
PID 4120 wrote to memory of 2256	4120	msedge.exe	86
PID 4120 wrote to memory of 2256	4120	msedge.exe	86
PID 4120 wrote to memory of 2256	4120	msedge.exe	86
PID 4120 wrote to memory of 2256	4120	msedge.exe	86
PID 4120 wrote to memory of 2256	4120	msedge.exe	86
PID 4120 wrote to memory of 2256	4120	msedge.exe	86
PID 4120 wrote to memory of 2256	4120	msedge.exe	86
PID 4120 wrote to memory of 2256	4120	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://axa-kaartlezer.com/crelan/gate/64dc118b29156
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff98c9a46f8,0x7ff98c9a4708,0x7ff98c9a4718
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,193523807730612103,6579771473154579994,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,193523807730612103,6579771473154579994,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,193523807730612103,6579771473154579994,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,193523807730612103,6579771473154579994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,193523807730612103,6579771473154579994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,193523807730612103,6579771473154579994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,193523807730612103,6579771473154579994,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,193523807730612103,6579771473154579994,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,193523807730612103,6579771473154579994,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,193523807730612103,6579771473154579994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,193523807730612103,6579771473154579994,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,193523807730612103,6579771473154579994,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:2428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3423d7e71b832850019e032730997f69

SHA1
bbc91ba3960fb8f7f2d5a190e6585010675d9061

SHA256
53770e40359b9738d8898520d7e4a57c28498edddbadf76ec4a599837aa0c649

SHA512
03d5fee4152300d6c5e9f72c059955c944c7e6d207e433e9fdd693639e63ea699a01696d7bbf56d2033fd52ad260c9ae36a2c5c888112d81bf7e04a3f273e65d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
175KB

MD5
2a9c0a1074358185eeb6b70954ebdfe9

SHA1
c944e4dc2d1c703937ba0c9ada25927bb3373983

SHA256
4dadc11ec68efc62c2ec5fdddca582d3f3bc413b85351b5d3d7285cf8d2f0cd4

SHA512
29c9d5895fcbdcb5999a40a5068d378b86c50a2ccda983049dcf5b9a184fb2d1162fa0a7225f1a6ae07b993fa4d251f6aefe5df008c055fe1c2fc859c135b339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
2e11851711efd377529934dd20bf8839

SHA1
8bda8fd673556ccd3d6ab25b2dcd30323520c7fd

SHA256
d33ad0ff46cbcad2bc03a5cac25a3edf9a889b513d6bbe7360575c95d4354ed0

SHA512
2eaa0f687d3ec5a5954e46e6c2bd351cc9fc6b9f7f68fb9b78b3f167d75e8ca179356e613a1157fe7d7e5796c99563706a71908d8004d8faa6ece36c65f75612

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
964B

MD5
5992f95f58fbd5b9fcce55da19219c84

SHA1
9bbb9b19a65ab9139cd3e9d5e5cfed167ea4eee2

SHA256
12df042d9c40b3c86344a5536edca0558856390225588a48a2e64c78803d681b

SHA512
ccbce8fd1a8fb5a920fa817c5317d6c03024fcd154b8ab38dc9c1044027bc40ca8e1c4258c2d2469f0af028e7ddf915bf2260db695ca6fff6e0a36fa40c42621

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c9eaafbfc7987b86783a2c886d1891d3

SHA1
4fbe5f90b7da76420260c6f1675edf18dc4cf409

SHA256
b4fc93ada2450bddd014f21080b847be0ffe409e6cf73739a9a5d22e2de203ed

SHA512
879d5e0e94786d09fe792ea8086ca1a3ee0b65dd228c5cce35907a7fa91e0404e66accb9efde566e5465a7f53a817af5556385512fa34595c73e84e5f67fd8fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f0b666328023ebc919fbbc1073ab0b35

SHA1
5d212fc24aa13c06bfe3c92ad3f595d17689660d

SHA256
56a742851499281e79fdbdd7e1908742e7493cc1fc9d4ca5ef08e5968e7a0a04

SHA512
5c5430d92b3bef9d05e5d20ca5334356a44e9165405e19445c910bee475fc5fd82050eb965c0889c8952d652c9e03e09eae62d84b843be6f140385c95ba58735

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a3fb060e41f2096797ac9706064275f2

SHA1
b3f450c2f5b66822ce5ac5c0dd75ddd8d7b826da

SHA256
eb62db8958ab70f8704e5ee51d3c1ab19f546b59ab189a6dfde98e0cd59cfd43

SHA512
b9f43f77bd74f6cccaf5295cdf167ebaaa88340753df6f6668426ec51eac6a9dd99bd33d4f3b48f86be6b3bb83cf51c7a52a5b9bfa1da9c04788c7543a833f6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
0e78f9a3ece93ae9434c64ea2bff51dc

SHA1
a0e4c75fe32417fe2df705987df5817326e1b3b9

SHA256
5c8ce4455f2a3e5f36f30e7100f85bdd5e44336a8312278769f89f68b8d60e68

SHA512
9d1686f0b38e3326ad036c8b218b61428204910f586dccf8b62ecbed09190f7664a719a89a6fbc0ecb429aecf5dd0ec06de44be3a1510369e427bde0626fd51d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
1d30523c0fc9f11c124df5ac5ee8a710

SHA1
e7f53a56080ccc3e53d17d75721b4d5e13c41f04

SHA256
65d5d25fa4ee8e8bc1c35b1e21c563eeceeb8c48c38a16ae3b5971b48a96e12e

SHA512
a60212d68acc75869e73269d531d5d02457206e063ab50bbdd947b9283a0459851b7133b99987286ce2160588fa21a399d26f11ac033f4e59510da2d21574d08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5804fc.TMP

Filesize
370B

MD5
b8757316d8faf78fec77b78581dc1a3d

SHA1
66d5687f4660818a1d1cb8af48609d00e176fa05

SHA256
240e95d8cd0d6853c9ea1a005722130ea008cd1fa28d07dfd66e02b78ccde329

SHA512
7bf000286e2cabdf23fe892c36b699b7473ceef4c9a3fedeeb5383e48b4020aac360e033b2f7ae66324d93106806b344f3d3f5589022f7fc9e30b2fdf7e51fd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
57d51272e73c3237a796325d2f3856c6

SHA1
5a3b0dac9b42bbc60685162a1b5c97de0d2d2528

SHA256
4abb623963d94648a8f6eacadbe8c872815ff1e68ede5d0d42191df1e85e9c1a

SHA512
748854d0fa433f57100351769340f528a2ab7329edf8dd82bd0c004d03930db564226f3a5f4aa9f63fc50efe8f7c1684528d19d9041a0ca284a5a3b1fef397f5

Download Submit