hxxp://appbancolombiawebayuda[.]ezzeblog[.]com

Analysis

max time kernel
61s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2023, 00:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://appbancolombiawebayuda.ezzeblog.com

Score

10^/10

phishing

Malware Config

Signatures

Detected phishing page
phishing

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
25	ipinfo.io
26	api.ipify.org
27	ipinfo.io
28	api.ipify.org

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
380	msedge.exe
380	msedge.exe
3240	identity_helper.exe
3240	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 1540	5012	msedge.exe	82
PID 5012 wrote to memory of 1540	5012	msedge.exe	82
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 2560	5012	msedge.exe	84
PID 5012 wrote to memory of 380	5012	msedge.exe	83
PID 5012 wrote to memory of 380	5012	msedge.exe	83
PID 5012 wrote to memory of 4744	5012	msedge.exe	85
PID 5012 wrote to memory of 4744	5012	msedge.exe	85
PID 5012 wrote to memory of 4744	5012	msedge.exe	85
PID 5012 wrote to memory of 4744	5012	msedge.exe	85
PID 5012 wrote to memory of 4744	5012	msedge.exe	85
PID 5012 wrote to memory of 4744	5012	msedge.exe	85
PID 5012 wrote to memory of 4744	5012	msedge.exe	85
PID 5012 wrote to memory of 4744	5012	msedge.exe	85
PID 5012 wrote to memory of 4744	5012	msedge.exe	85
PID 5012 wrote to memory of 4744	5012	msedge.exe	85
PID 5012 wrote to memory of 4744	5012	msedge.exe	85
PID 5012 wrote to memory of 4744	5012	msedge.exe	85
PID 5012 wrote to memory of 4744	5012	msedge.exe	85
PID 5012 wrote to memory of 4744	5012	msedge.exe	85
PID 5012 wrote to memory of 4744	5012	msedge.exe	85
PID 5012 wrote to memory of 4744	5012	msedge.exe	85
PID 5012 wrote to memory of 4744	5012	msedge.exe	85
PID 5012 wrote to memory of 4744	5012	msedge.exe	85
PID 5012 wrote to memory of 4744	5012	msedge.exe	85
PID 5012 wrote to memory of 4744	5012	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://appbancolombiawebayuda.ezzeblog.com
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc950846f8,0x7ffc95084708,0x7ffc95084718
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,17699423855763625942,5182199742660116284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,17699423855763625942,5182199742660116284,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,17699423855763625942,5182199742660116284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17699423855763625942,5182199742660116284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17699423855763625942,5182199742660116284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,17699423855763625942,5182199742660116284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,17699423855763625942,5182199742660116284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17699423855763625942,5182199742660116284,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17699423855763625942,5182199742660116284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17699423855763625942,5182199742660116284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17699423855763625942,5182199742660116284,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:4528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
70e2e6954b953053c0c4f3b6e6ad9330

SHA1
cb61ba67b3bffa1d833bb85cc9547669ec46f62f

SHA256
f6e770a3b88ad3fda592419b6c00553bdadc50d5fb466ef872271389977f2ab4

SHA512
eeacb0e62f68f56285f7605963ca9bb82f542d4e2ccc323266c08c9990cecdebd574e1ab304ae08ea8c6c94c50683180f83562f972e92799ebbcfcd8f503fb5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
cee92fb772f457e161fde5a16bf5a589

SHA1
aee800b663d2e6d7235342db962111e264875771

SHA256
25973ea8e00f37c484c0b2d11142f1c265a574d0f026d31c80c7fac2f4427e2b

SHA512
343462093974d59bfa60deb8281ec0cc8d7f7ad78f9781591a64e1034f50d3837d82e7584158d4e4bedbbe7be39bd0d9575f63998d6a33557578a5abf8cdee81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cc18e32648db0ccae152cf7d454fbab6

SHA1
6a1e2a7f073f320cf9774c71a5ac03fb71d147a6

SHA256
e14ffb1805155335eddea65805e484c05db825dd6d2898fbbc28f517437d58b4

SHA512
e630b6b230d0f2ce873672cc55cb43229922eb1cb10de4d57f52212772094da9dd03670737667e7a4d2786de548584560dc7f1e50796fe2a7f7887971a33ce77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bec8681973dff4b55a71212d3d75da90

SHA1
6aa2dc4639477f92d9f4cde658b0b1514e0c3c3c

SHA256
e4d1c0c29395d6935a043682c2f46ac84fdc7bcee2df947a0e359d6a9283aebe

SHA512
487ff164b1d55b4b37600aaa8186fa9cc0dc5a2e4738b86b878e575e68d01474e2880fec54e6996d00f1ccd4f2e169dd61bb8a9a1dc68a5e5c4c8aadb8890f58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5a478f1e08816969e8214f982850b754

SHA1
1cf5e7192f3c6e31c7e27b6cb34ebf89036eec0c

SHA256
665cf5612c61412c9acc928b1e155c8f11ae83905ce614d9a1a7ad72cc0fd489

SHA512
7e7ff60c157841f6f5bb206ebbce29f6df3a6c0c671805415ad7226654e13da49ad76e39a6d0afe28992348f3b5685ecacbfb44178fd61998c54caebbfd97832

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
20aad3f8399548d0da2f22739bf2d7ac

SHA1
51586abc67415f0e0b81dc48a9bff740a0917fbd

SHA256
91f73fdde0b643ef4d83989f50b230df0d4be679952af94f224575f40678fb5f

SHA512
fbd28a470aaa341b7398d6c747b79d8aa2c2ab139749c9b9735f39ad4881cc8ff4c47ee3e0be0b78b25bd44240c2ad01373a230c1c5f2675d2d8e9dd5a873717

Download Submit