hxxps://cars[.]wizzair[.]com/Home[.]do?adplat=CIemail&adcamp=CE-memberid-222303715

Analysis

max time kernel
146s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
28/08/2023, 09:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cars.wizzair.com/Home.do?adplat=CIemail&adcamp=CE-memberid-222303715

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3640	msedge.exe
3640	msedge.exe
2076	msedge.exe
2076	msedge.exe
2972	identity_helper.exe
2972	identity_helper.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 1944	2076	msedge.exe	81
PID 2076 wrote to memory of 1944	2076	msedge.exe	81
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3180	2076	msedge.exe	82
PID 2076 wrote to memory of 3640	2076	msedge.exe	83
PID 2076 wrote to memory of 3640	2076	msedge.exe	83
PID 2076 wrote to memory of 3092	2076	msedge.exe	84
PID 2076 wrote to memory of 3092	2076	msedge.exe	84
PID 2076 wrote to memory of 3092	2076	msedge.exe	84
PID 2076 wrote to memory of 3092	2076	msedge.exe	84
PID 2076 wrote to memory of 3092	2076	msedge.exe	84
PID 2076 wrote to memory of 3092	2076	msedge.exe	84
PID 2076 wrote to memory of 3092	2076	msedge.exe	84
PID 2076 wrote to memory of 3092	2076	msedge.exe	84
PID 2076 wrote to memory of 3092	2076	msedge.exe	84
PID 2076 wrote to memory of 3092	2076	msedge.exe	84
PID 2076 wrote to memory of 3092	2076	msedge.exe	84
PID 2076 wrote to memory of 3092	2076	msedge.exe	84
PID 2076 wrote to memory of 3092	2076	msedge.exe	84
PID 2076 wrote to memory of 3092	2076	msedge.exe	84
PID 2076 wrote to memory of 3092	2076	msedge.exe	84
PID 2076 wrote to memory of 3092	2076	msedge.exe	84
PID 2076 wrote to memory of 3092	2076	msedge.exe	84
PID 2076 wrote to memory of 3092	2076	msedge.exe	84
PID 2076 wrote to memory of 3092	2076	msedge.exe	84
PID 2076 wrote to memory of 3092	2076	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cars.wizzair.com/Home.do?adplat=CIemail&adcamp=CE-memberid-222303715
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb442a46f8,0x7ffb442a4708,0x7ffb442a4718
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,5159984363395105028,12804402620965520731,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,5159984363395105028,12804402620965520731,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,5159984363395105028,12804402620965520731,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5159984363395105028,12804402620965520731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5159984363395105028,12804402620965520731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,5159984363395105028,12804402620965520731,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,5159984363395105028,12804402620965520731,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5159984363395105028,12804402620965520731,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5159984363395105028,12804402620965520731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5159984363395105028,12804402620965520731,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,5159984363395105028,12804402620965520731,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,5159984363395105028,12804402620965520731,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3044 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b5f5369274e3bfbc449588bbb57bd383

SHA1
58bb46d57bd70c1c0bcbad619353cbe185f34c3b

SHA256
4190bd2ec2c0c65a2b8b97782cd3ae1d6cead80242f3595f06ebc6648c3e3464

SHA512
04a3816af6c5a335cde99d97019a3f68ade65eba70e4667c4d7dd78f78910481549f1dad23a46ccf9efa2e25c6e7a7c78c592b6ace951e1aab106ba06a10fcd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\43d1b051-ab3c-457a-8622-69e5cd5cdd6c.tmp

Filesize
6KB

MD5
d3fa876d56a40fd726d2753f507bbe65

SHA1
ff17769eb768bc41bf62304bd8e5af7f2ca47bb9

SHA256
dc28ac0746a61db19ec652d85b7aa18e8af1d925725de185899de882f1ca7b7e

SHA512
d8f85e2d4d94ebc2b694d38795d0afb372e9a744b035c41f70e5e8e622ee8af11b68dde4579026b5d6bfd1299678bfa400a146f1e3de77836470a325d9215194

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
624B

MD5
624a2279c259885abcf2340a97416d34

SHA1
7d05afe1dfb85cec80fa2496eeccdac214ed7a6e

SHA256
ca023f39a29501bb2b971fd6570651e0c5268cd03a5594f7992784ab2d548030

SHA512
f1b934a3b999af5d097e5c8374e9f441f8a9aabb519d41886e43c33c6f611838b11ef3ee9c0afacd3956b53dd21c7ca8cd559bd30ef4e221b6d7ce4f0a8a1a2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
26dc099485b8407569c0d82a8b2ca6b6

SHA1
144aca77f49bc902a7aaf106578a8a6532ba8d2b

SHA256
90f8c1fe1a95445d951d3bc8b04097fbeed6297c5ff5b507aa30b5e9b83df74c

SHA512
9340d80c12b28902cee75edd091bea25f3e3c796c35c7895d50e69c8f0b47fb21638e295f2d995b1472189d2ba96df544e0b5da68abfaa0043a5baa9e6c2192c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
63532445c5580c914db61fdceec954b9

SHA1
530969852d725d4c016e29637dba4d69bf0585f2

SHA256
a9b2237f99c5f7c56e101cdf8b1826c5c41b7732453a4af2051194f7d7784461

SHA512
9d0442f16a3cd2a21e215226b5e9d783f567679866256fa5556fb008bcf2684793e7db98b8cf990c6e8e0933b5d55dc138a8a3db96ad4ff3eedb282eaf48da4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
29213338df67d29d6454ee5d61ad3970

SHA1
8c69ca76a2e639060d5ce835a9600e6ea3764a83

SHA256
d29fc0d97fa74d382d0f557ecea4e42b7d50dbce43915bfc0c114c16e532aa51

SHA512
14db25eba8a863d390b97fce4315402ed7c249598ff6c31d5a191b0f71c274eead42ba0658403e744110de072e6ff1cac3bccee1e48875bde6b1fe39a60d2407

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e3becf9d06fb4ae2124e5f9c4170e4c2

SHA1
c62ef9b90e996030111801b42e7a11101e785f0a

SHA256
90d07fab064a3d23469eed313072ba9eb7e7ca16899d15383dee14fc8a692974

SHA512
6f5aee92fd69cc8cc48f6644b670c2b02504d6a8caff4655bd5d4c75a1f10fd5141347b4bc7d6c41d9d21017370d844d9556c5c288459d108bf6ce81176ae7f2

Download Submit