hxxps://f[.]fcert[.]co/fsend2/delta_f/varios/off/?id=aXZBTzloVTlqUkRkQVpzMnlHMDBFQT09&redirige=personal&proceso=geo&tipo=Ver_correo_explorador&url2=hxxps://f[.]fcert[.]co/fsend2/w/m/a/?chk=TVRJMk16SXdNak13T0RJeU9EZz1hNTBmNmRoNWFmTVRBd01qZzVPRE0wTmc9PQ==

Resubmissions

25/08/2023, 23:16

230825-29f1nahb4y 1

25/08/2023, 22:54

230825-2v13aafc63 1

Analysis

max time kernel
147s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2023, 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://f.fcert.co/fsend2/delta_f/varios/off/?id=aXZBTzloVTlqUkRkQVpzMnlHMDBFQT09&redirige=personal&proceso=geo&tipo=Ver_correo_explorador&url2=https://f.fcert.co/fsend2/w/m/a/?chk=TVRJMk16SXdNak13T0RJeU9EZz1hNTBmNmRoNWFmTVRBd01qZzVPRE0wTmc9PQ==

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2668	msedge.exe
2668	msedge.exe
2436	msedge.exe
2436	msedge.exe
4248	identity_helper.exe
4248	identity_helper.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 4344	2668	msedge.exe	37
PID 2668 wrote to memory of 4344	2668	msedge.exe	37
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 3180	2668	msedge.exe	83
PID 2668 wrote to memory of 2436	2668	msedge.exe	82
PID 2668 wrote to memory of 2436	2668	msedge.exe	82
PID 2668 wrote to memory of 4424	2668	msedge.exe	84
PID 2668 wrote to memory of 4424	2668	msedge.exe	84
PID 2668 wrote to memory of 4424	2668	msedge.exe	84
PID 2668 wrote to memory of 4424	2668	msedge.exe	84
PID 2668 wrote to memory of 4424	2668	msedge.exe	84
PID 2668 wrote to memory of 4424	2668	msedge.exe	84
PID 2668 wrote to memory of 4424	2668	msedge.exe	84
PID 2668 wrote to memory of 4424	2668	msedge.exe	84
PID 2668 wrote to memory of 4424	2668	msedge.exe	84
PID 2668 wrote to memory of 4424	2668	msedge.exe	84
PID 2668 wrote to memory of 4424	2668	msedge.exe	84
PID 2668 wrote to memory of 4424	2668	msedge.exe	84
PID 2668 wrote to memory of 4424	2668	msedge.exe	84
PID 2668 wrote to memory of 4424	2668	msedge.exe	84
PID 2668 wrote to memory of 4424	2668	msedge.exe	84
PID 2668 wrote to memory of 4424	2668	msedge.exe	84
PID 2668 wrote to memory of 4424	2668	msedge.exe	84
PID 2668 wrote to memory of 4424	2668	msedge.exe	84
PID 2668 wrote to memory of 4424	2668	msedge.exe	84
PID 2668 wrote to memory of 4424	2668	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb1b7a46f8,0x7ffb1b7a4708,0x7ffb1b7a4718
1⤵
PID:4344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://f.fcert.co/fsend2/delta_f/varios/off/?id=aXZBTzloVTlqUkRkQVpzMnlHMDBFQT09&redirige=personal&proceso=geo&tipo=Ver_correo_explorador&url2=https://f.fcert.co/fsend2/w/m/a/?chk=TVRJMk16SXdNak13T0RJeU9EZz1hNTBmNmRoNWFmTVRBd01qZzVPRE0wTmc9PQ==
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,10415592152803246116,15573923307565470096,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,10415592152803246116,15573923307565470096,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,10415592152803246116,15573923307565470096,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10415592152803246116,15573923307565470096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10415592152803246116,15573923307565470096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,10415592152803246116,15573923307565470096,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,10415592152803246116,15573923307565470096,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10415592152803246116,15573923307565470096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10415592152803246116,15573923307565470096,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2544 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10415592152803246116,15573923307565470096,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10415592152803246116,15573923307565470096,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,10415592152803246116,15573923307565470096,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4760 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b950ebe404eda736e529f1b0a975e8db

SHA1
4d2c020f1aa70e2bcb666a2dd144d1f3588430b8

SHA256
bcc60276d7110e8d002f24d66ebb043c5761e2a4b6ae7854983cef4beacd9bf4

SHA512
6ba228e5b6464c9602db81de8e1189302d0b2aed78a8b06248ccd9f095ede8621fc9d0faed0a7d079b8c7f4d1164b2895c4d0ef99c93cb95bbe210033e40295a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
178B

MD5
ce16bfd13505da84885d0daa2c1279c6

SHA1
810bc492c8d619651ab453e80ff88c319ad5b580

SHA256
0f831529a4cc395b83c9d8779e76dc4853f264e34f09ced0fe5f116863d6f13b

SHA512
82a342dae14243eb81c0b80553c185c8d85cded2e71696f36a2701ff27b0b5ff36b3dffe8a5dca21ea7095e0a64e85bd3df522100f7888b98750e466ebdbb7f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
186f0fe13245907039adaf0700a2c28b

SHA1
8afd07c3dd426edea33b4a3730fce7d54288b39f

SHA256
76501abcf96a8e5628d467d70aa4e5084096a874b025114fcb1d2b8c5af6f7b1

SHA512
0052d0fdd3e3fbf0c654c99b17ac367d60003ca163f4272a54c427360a0fa5232c4fedb05e85456b7f98371e6d3fd9b4cea218e3e7da9e8aec4ae62c252ed00f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
06347a6b7df4ec60725af803d7c64c08

SHA1
9127ec177210824bee88429745a23b2599f0db5b

SHA256
f63bef23b3b50ef9058362f42cd89fb61679ef23532fa465d15bc7e01de12a98

SHA512
a779f2b9d134c1ea4bc8c8c13d03630a07636537ab9281387f8aac04f643ab14e558580acaadb77f5fbdcc4547cd80dd8e798fe91a1084715282461f97bd5d9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
ca36933e6dea7aa507a272121b34fdbb

SHA1
3b4741ca0308b345de5ecf6c3565b1dbacb0fb86

SHA256
fd14449eb781c58e6e7196a384caf25cba0c59ebdba3b10f8ca0ecfd0c076b5d

SHA512
5a9b186ecf085765caee97a2910008dda926ce412001042e165184083a52fb5fb70f05ca781cd2f7740ecbd938895c77c5aa0f9eb8d812b92f412f336212720e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ae50d9d4ab0542475db783cbce6af013

SHA1
d334460935a6718fa3668b97d9f0845e2dd504fa

SHA256
df1b65b88a9d45237a1967ce48e757ec4fd4e2a4eeab9240fd0c2c8a94716d4c

SHA512
ea0da9d55739b324662851de4845dd7062c8b0d00f40920a46e150d6a6e3607db5ecd5f3bf9b3408c1392442e1db1a401f370404356a047b361d9ce16c6e3dfc

Download Submit