Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2023 14:24
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cavallaritelecom.com.br/wp-admin/gt/espera.php
Resource
win10v2004-20231127-en
General
-
Target
https://cavallaritelecom.com.br/wp-admin/gt/espera.php
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 3784 msedge.exe 3784 msedge.exe 3848 msedge.exe 3848 msedge.exe 3552 identity_helper.exe 3552 identity_helper.exe 3928 msedge.exe 3928 msedge.exe 3928 msedge.exe 3928 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3848 wrote to memory of 4472 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 4472 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 1112 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 3784 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 3784 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 4568 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 4568 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 4568 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 4568 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 4568 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 4568 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 4568 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 4568 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 4568 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 4568 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 4568 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 4568 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 4568 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 4568 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 4568 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 4568 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 4568 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 4568 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 4568 3848 msedge.exe msedge.exe PID 3848 wrote to memory of 4568 3848 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cavallaritelecom.com.br/wp-admin/gt/espera.php1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa2c2a46f8,0x7ffa2c2a4708,0x7ffa2c2a47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,15143798242983562047,1165895150629202986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,15143798242983562047,1165895150629202986,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,15143798242983562047,1165895150629202986,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,15143798242983562047,1165895150629202986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,15143798242983562047,1165895150629202986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,15143798242983562047,1165895150629202986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,15143798242983562047,1165895150629202986,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,15143798242983562047,1165895150629202986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,15143798242983562047,1165895150629202986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,15143798242983562047,1165895150629202986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,15143798242983562047,1165895150629202986,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,15143798242983562047,1165895150629202986,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5700 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5ef2ab50a3d368243b8203ac219278a5d
SHA12d154d63c4371354ff607656a4d94bc3734658a9
SHA2562e2faf2873e0b8d58788da8603acdd772642a396fff661c4e32f8a581362cbdf
SHA5124533997bf4070f99306337b8ff553691d4cf1d1b53401628524ad4dc9d29bd0536a3f2df4ecdd0a8afa81b7f917f40524c9a1898b566ee499a358abc5c84b27a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
191B
MD5996cfeccc9f4479cd59cfec5bee70eda
SHA12f4d6705f2b5ec2bf6e6cd15bc4dc4abb951049d
SHA2561695500e37f61e0849a3693e3aa3d0aa348c68c3bc861dda9e62c7c84baa89be
SHA51229d418b9064d3274e0f03726b75f88406a7d01123a03adf594bca534d845de3ef693f773060dc366f8aaaa178c1d5172e9a3072d4e3679dbb8fd68619a576961
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5967e517ac3ee4adb2689fdc3eef1acc9
SHA1131bee9ed94ee68cdc5544164f25b3e170118ad3
SHA2568dc8f215775a16b43e8dd6617ecedf406ec90a7b765b4ccb9dc4b0366d2e960d
SHA512bbf85388d230fdaff47f679550ce5b727410aee2a640d47ca31605be265a90b51f2ad6fab0560ba037cbcb96221b471529e13a9a61da93802803d575d8b73ac4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5884c8bae41b9a837807cf52db248a704
SHA14fa75c4ff96af3eac046fc795b606f6ee5137dda
SHA2564faf61fcedf6830f4c403cf02154d9c40e21a9508160a75ad80b43cbd97c6c37
SHA512067b9ea5732610e85d464d87f1de6c0a232cac5bfbfa3216622422fd1fbb7e9d86fc4ce3f58b4681be22d256ed5a10a9e3779b2062af999d58c867f19eb94acd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD5bf38e67347aea6d520cda5fde321a1e5
SHA10e7a8def4c923201d76b41dfa9918bb1052827ea
SHA2560f0744f36e30e64949c41835aa5666f25c1ab4f3636d9247b8350fd8ad4f8025
SHA512f62478dd4e38c6bef2bfc24f46caa03840613711e2b6fda2aad707df5cbd33b25af4fc3954521e203b981c4a10e5c8fd2520cabc16cdad858eed819b45a6f366
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
10KB
MD57402622b5d67251bc42c4d6c230e3d8d
SHA1e868a9b6fe65fc8eaff414b9fbb1e78fc1dd847c
SHA256054b61092e7e020bf3014cabd0168ce7da5d4d634862b6cbf7af332cd4c5eca2
SHA5128057085b41fc4b06203bba802b3c8a60de6c1f86a64094ae5f129431a93fa9f0e34768e007ab8c5760d5bd44fefb46ec7a4892b7963fd826ec3d47846bf34217
-
\??\pipe\LOCAL\crashpad_3848_JTXOZKKGAVNLWDXJMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e