hxxps://email[.]ceofreedom[.]com/c/eJxM0D2PnDAQxvFPY5cIj-0xLlychCjyqiRNutNgj1nnABOWY3e_fbRXpX306F_84mtJYfrZ_eG-X9D-0rn__nKZvj1kCjm7HFFyUOgBre-8lrxQmV-Px8Yh0rJRmdb_tmcMDesRiSMjeZUTGGOsZ5KXYL2LCAoztpZAZ4cjsCaEzidClWQJ0IJuO1CgVad0E8eRTMvWqBRjzFaYNnLNO3OqSxPrIudwOY7tKvSLgEHAcLvdmkyRx1rfngcBw_VC61rXo0Se6eS1kIDhLInrVcCgjAF0Rnk06J2DZ0YPJdX9pLUcD6F7g8p5a1B7D8opOdcPti_3er9H_vr7849--tS-nX8XknvYeav78YGSd3pPwrR01GaqZ0Pv_wIAAP__TcZ0AA

Analysis

max time kernel
14s
max time network
21s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2023, 05:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://email.ceofreedom.com/c/eJxM0D2PnDAQxvFPY5cIj-0xLlychCjyqiRNutNgj1nnABOWY3e_fbRXpX306F_84mtJYfrZ_eG-X9D-0rn__nKZvj1kCjm7HFFyUOgBre-8lrxQmV-Px8Yh0rJRmdb_tmcMDesRiSMjeZUTGGOsZ5KXYL2LCAoztpZAZ4cjsCaEzidClWQJ0IJuO1CgVad0E8eRTMvWqBRjzFaYNnLNO3OqSxPrIudwOY7tKvSLgEHAcLvdmkyRx1rfngcBw_VC61rXo0Se6eS1kIDhLInrVcCgjAF0Rnk06J2DZ0YPJdX9pLUcD6F7g8p5a1B7D8opOdcPti_3er9H_vr7849--tS-nX8XknvYeav78YGSd3pPwrR01GaqZ0Pv_wIAAP__TcZ0AA

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
1604	msedge.exe
1604	msedge.exe
3620	identity_helper.exe
3620	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 3624	1604	msedge.exe	55
PID 1604 wrote to memory of 3624	1604	msedge.exe	55
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 2860	1604	msedge.exe	82
PID 1604 wrote to memory of 4440	1604	msedge.exe	84
PID 1604 wrote to memory of 4440	1604	msedge.exe	84
PID 1604 wrote to memory of 4556	1604	msedge.exe	83
PID 1604 wrote to memory of 4556	1604	msedge.exe	83
PID 1604 wrote to memory of 4556	1604	msedge.exe	83
PID 1604 wrote to memory of 4556	1604	msedge.exe	83
PID 1604 wrote to memory of 4556	1604	msedge.exe	83
PID 1604 wrote to memory of 4556	1604	msedge.exe	83
PID 1604 wrote to memory of 4556	1604	msedge.exe	83
PID 1604 wrote to memory of 4556	1604	msedge.exe	83
PID 1604 wrote to memory of 4556	1604	msedge.exe	83
PID 1604 wrote to memory of 4556	1604	msedge.exe	83
PID 1604 wrote to memory of 4556	1604	msedge.exe	83
PID 1604 wrote to memory of 4556	1604	msedge.exe	83
PID 1604 wrote to memory of 4556	1604	msedge.exe	83
PID 1604 wrote to memory of 4556	1604	msedge.exe	83
PID 1604 wrote to memory of 4556	1604	msedge.exe	83
PID 1604 wrote to memory of 4556	1604	msedge.exe	83
PID 1604 wrote to memory of 4556	1604	msedge.exe	83
PID 1604 wrote to memory of 4556	1604	msedge.exe	83
PID 1604 wrote to memory of 4556	1604	msedge.exe	83
PID 1604 wrote to memory of 4556	1604	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://email.ceofreedom.com/c/eJxM0D2PnDAQxvFPY5cIj-0xLlychCjyqiRNutNgj1nnABOWY3e_fbRXpX306F_84mtJYfrZ_eG-X9D-0rn__nKZvj1kCjm7HFFyUOgBre-8lrxQmV-Px8Yh0rJRmdb_tmcMDesRiSMjeZUTGGOsZ5KXYL2LCAoztpZAZ4cjsCaEzidClWQJ0IJuO1CgVad0E8eRTMvWqBRjzFaYNnLNO3OqSxPrIudwOY7tKvSLgEHAcLvdmkyRx1rfngcBw_VC61rXo0Se6eS1kIDhLInrVcCgjAF0Rnk06J2DZ0YPJdX9pLUcD6F7g8p5a1B7D8opOdcPti_3er9H_vr7849--tS-nX8XknvYeav78YGSd3pPwrR01GaqZ0Pv_wIAAP__TcZ0AA
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa02546f8,0x7fffa0254708,0x7fffa0254718
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,9615639552593567860,8326346891351438607,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,9615639552593567860,8326346891351438607,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2500 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,9615639552593567860,8326346891351438607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9615639552593567860,8326346891351438607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9615639552593567860,8326346891351438607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9615639552593567860,8326346891351438607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,9615639552593567860,8326346891351438607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,9615639552593567860,8326346891351438607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2072,9615639552593567860,8326346891351438607,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9615639552593567860,8326346891351438607,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9615639552593567860,8326346891351438607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:4596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2388

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2cc 0x4a8
1⤵
PID:2024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b950ebe404eda736e529f1b0a975e8db

SHA1
4d2c020f1aa70e2bcb666a2dd144d1f3588430b8

SHA256
bcc60276d7110e8d002f24d66ebb043c5761e2a4b6ae7854983cef4beacd9bf4

SHA512
6ba228e5b6464c9602db81de8e1189302d0b2aed78a8b06248ccd9f095ede8621fc9d0faed0a7d079b8c7f4d1164b2895c4d0ef99c93cb95bbe210033e40295a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bea2dca1e5f961a682c9e77ab4fad9ec

SHA1
54ee7a399813cb614b5570587ebadd78f73bd33d

SHA256
2c963b81304c6d97fa45e2cd6db411247f7302ad344babc21ac53df12303c07d

SHA512
6a2e570974fb26ac51889a4fe84a37ac5b1f5757657b47f7ce8a3197e7104e93a63a7d9ea410b7c9d24832e2a608a3b345899aedf69d66c5e27215603d958c9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
456a7b8d02ff31a5b10859de8c9c2080

SHA1
06df0b0e0adcc0fd85614d3be21d9a5257005829

SHA256
d76ebb32a3d1d5c732d4de63dcebb6cc33e6b635302e4c36ad5711b73a464af7

SHA512
21ca195b84a33d2168e649098e20b0192f04eee77fbf18ebba94b00cc0f28ead4cd075af8bdda7c251cd303e2f5f7df4617ad161b90e2f85c1d7ecd1ccb48679

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
ca36933e6dea7aa507a272121b34fdbb

SHA1
3b4741ca0308b345de5ecf6c3565b1dbacb0fb86

SHA256
fd14449eb781c58e6e7196a384caf25cba0c59ebdba3b10f8ca0ecfd0c076b5d

SHA512
5a9b186ecf085765caee97a2910008dda926ce412001042e165184083a52fb5fb70f05ca781cd2f7740ecbd938895c77c5aa0f9eb8d812b92f412f336212720e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
82b8ba415b298c5111a0797ef2240cc0

SHA1
a3a902794364afab7e71f7b4e712a3503e1883c9

SHA256
b502cb735dd86d15a37be1b409a12a617e70713b498b9c2f335c47543e04aaf9

SHA512
74799272d3203fea2eaa940855e56702fc67723beeff719acb3dc717e4db4d33045fc8dc19a2be392dc1bc7cf671b9b7ee78efe1e2bb6cd5b2eee377060dd2a3

Download Submit