hxxp://www[.]digicert[.]com

Resubmissions

20/08/2023, 20:33

230820-zbveaahb37 3

20/08/2023, 20:28

230820-y9gemsha98 1

Analysis

max time kernel
94s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20230703-es
resource tags

arch:x64arch:x86image:win10v2004-20230703-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
20/08/2023, 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.digicert.com

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1320	216	WerFault.exe	105

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2420	msedge.exe
2420	msedge.exe
4800	msedge.exe
4800	msedge.exe
3428	identity_helper.exe
3428	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 4116	4800	msedge.exe	78
PID 4800 wrote to memory of 4116	4800	msedge.exe	78
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 1700	4800	msedge.exe	84
PID 4800 wrote to memory of 2420	4800	msedge.exe	83
PID 4800 wrote to memory of 2420	4800	msedge.exe	83
PID 4800 wrote to memory of 1772	4800	msedge.exe	85
PID 4800 wrote to memory of 1772	4800	msedge.exe	85
PID 4800 wrote to memory of 1772	4800	msedge.exe	85
PID 4800 wrote to memory of 1772	4800	msedge.exe	85
PID 4800 wrote to memory of 1772	4800	msedge.exe	85
PID 4800 wrote to memory of 1772	4800	msedge.exe	85
PID 4800 wrote to memory of 1772	4800	msedge.exe	85
PID 4800 wrote to memory of 1772	4800	msedge.exe	85
PID 4800 wrote to memory of 1772	4800	msedge.exe	85
PID 4800 wrote to memory of 1772	4800	msedge.exe	85
PID 4800 wrote to memory of 1772	4800	msedge.exe	85
PID 4800 wrote to memory of 1772	4800	msedge.exe	85
PID 4800 wrote to memory of 1772	4800	msedge.exe	85
PID 4800 wrote to memory of 1772	4800	msedge.exe	85
PID 4800 wrote to memory of 1772	4800	msedge.exe	85
PID 4800 wrote to memory of 1772	4800	msedge.exe	85
PID 4800 wrote to memory of 1772	4800	msedge.exe	85
PID 4800 wrote to memory of 1772	4800	msedge.exe	85
PID 4800 wrote to memory of 1772	4800	msedge.exe	85
PID 4800 wrote to memory of 1772	4800	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.digicert.com
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff98c7d46f8,0x7ff98c7d4708,0x7ff98c7d4718
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,239695894125385772,13274190279277273433,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,239695894125385772,13274190279277273433,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,239695894125385772,13274190279277273433,131072 --lang=es --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,239695894125385772,13274190279277273433,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,239695894125385772,13274190279277273433,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,239695894125385772,13274190279277273433,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,239695894125385772,13274190279277273433,131072 --lang=es --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,239695894125385772,13274190279277273433,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,239695894125385772,13274190279277273433,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,239695894125385772,13274190279277273433,131072 --lang=es --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,239695894125385772,13274190279277273433,131072 --lang=es --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:1464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4360

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 404 -p 216 -ip 216
1⤵
PID:4580

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 216 -s 2664
1⤵
- Program crash
PID:1320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fc99b0086d7714fd471ed4acc862ccc0

SHA1
39a3c43c97f778d67413a023d66e8e930d0e2314

SHA256
45ef01f81605bfd96126d5520c5aa0304c7fa7d5fdb3e4d5b2dd2bf84e2afd96

SHA512
c308fa3eda9235d67a506a5f058fefb9a769ec01d7b0d4f5a2397892cc4f8155301c55c1fac23bebacdd087ab3f47f1eacc9ff88eff4115a7d67aa7b1d6581a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3bc8ea5c663ac05ef3c72cc665a8c70a

SHA1
0893ee1be226fe745850682a63a0cca73c5389d5

SHA256
1c14087b6a535aeeda7998a87b377cbda16061da86cee263e1b7071ce0d7313d

SHA512
8c14019a62f9b39e5455c8f037943c89f30cae177af62ae4e84c9e3dfa9040e97bd5d966fcd86cd1885ff07040082ef80bf091741c34164031ba8af2f1562341

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
641848a1dbb4e5b3cfe7d0f78bbee048

SHA1
3274c2bdfed126c58d38a03d860d84339f836daa

SHA256
2404c4b323ca8af35b36439a6136cb1f3e36be1fb7752e945abe0d82a5b5a027

SHA512
be3ab8e57caba45d8c1d505aa2493c0c04251cde17d6a15249000f4093154b26537e74b5352333c1f7ce205c388ed47e5de62529f15e31cae65d2da9ee0127d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
56c595cafbe98e717d771391f04ab8ef

SHA1
36cd5c450944d5afbbe53451f7d8fc449f828ae4

SHA256
edf71c7c21994c03ff3edc7237b03d433d3f6444b0083b083b4a61eed824b730

SHA512
025f2ea13a8f3ce161777a739d278715eacc73e400f3472e900fbed752b571ac42c74a59b210930d87f88c1a93cc2277d30aacebbe142a3c32a6783eed4a1cbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
dbbf13d89587b0548895faae0ec86e83

SHA1
c445edafaad57694906a31bad423763a6cc32301

SHA256
9b48d43a60846957eac547824838f826599c7c199394d0170a7cf2569ae0c189

SHA512
5013a9a0f064b3c2da66be7838ba8108e8f7da8011ebdb185812aa9f956dee59d0028d4f2dff21621eda085be9c36e8c73e99c6e6914c29b4e9ff610451e7f69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
c0258546ae3870e3f9de4113d8415f61

SHA1
6476d73712ad3eb99a342c6628e18df7e58367f6

SHA256
ccfb2609d9c53563c59d00d62522b237169ee110b97cba253aa16121546d8ca6

SHA512
56cf1ca4ee86fe105390f8fa1b7531a7a3c21b29ea156d076b815dedbfe705286d09911c4c6073e48ae622aab4db9f18a453915a22f0be5ab13aaf052474f0b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
4KB

MD5
300562b772f405f6cede723311689fc0

SHA1
6b413fba58c19fdac6f61d43d3711685af02495d

SHA256
da3d3c71cb055e2f15b34dc749e00b962a7ac00de2e43338582c2338851439a7

SHA512
6106a7bb353236b9c624720d9c2223de531f1e9cf23c4ed01fae534dac73fe8ea9fcffd51394be510167e00f7ddca75cdfbea5b43eaab6d18d3c01878ac174d5

Download Submit