hxxp://mailto[:]nl@blackcolor[.]info/?subject=Campaign-Uid%3Awg275fbv57dc1%20%2F%20Subscriber-Uid%3Atq234sygxr063%20-%20Unsubscribe%20request&body=Please%20unsubscribe%20me%21

Resubmissions

21-11-2024 07:21

241121-h66mcszldt 3

21-11-2024 07:21

241121-h61fcayhqb 3

Analysis

max time kernel
0s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 07:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://mailto:[email protected]/?subject=Campaign-Uid%3Awg275fbv57dc1%20%2F%20Subscriber-Uid%3Atq234sygxr063%20-%20Unsubscribe%20request&body=Please%20unsubscribe%20me%21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 516 wrote to memory of 5064	516	msedge.exe	84
PID 516 wrote to memory of 5064	516	msedge.exe	84
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 4748	516	msedge.exe	85
PID 516 wrote to memory of 1384	516	msedge.exe	86
PID 516 wrote to memory of 1384	516	msedge.exe	86
PID 516 wrote to memory of 4884	516	msedge.exe	87
PID 516 wrote to memory of 4884	516	msedge.exe	87
PID 516 wrote to memory of 4884	516	msedge.exe	87
PID 516 wrote to memory of 4884	516	msedge.exe	87
PID 516 wrote to memory of 4884	516	msedge.exe	87
PID 516 wrote to memory of 4884	516	msedge.exe	87
PID 516 wrote to memory of 4884	516	msedge.exe	87
PID 516 wrote to memory of 4884	516	msedge.exe	87
PID 516 wrote to memory of 4884	516	msedge.exe	87
PID 516 wrote to memory of 4884	516	msedge.exe	87
PID 516 wrote to memory of 4884	516	msedge.exe	87
PID 516 wrote to memory of 4884	516	msedge.exe	87
PID 516 wrote to memory of 4884	516	msedge.exe	87
PID 516 wrote to memory of 4884	516	msedge.exe	87
PID 516 wrote to memory of 4884	516	msedge.exe	87
PID 516 wrote to memory of 4884	516	msedge.exe	87
PID 516 wrote to memory of 4884	516	msedge.exe	87
PID 516 wrote to memory of 4884	516	msedge.exe	87
PID 516 wrote to memory of 4884	516	msedge.exe	87
PID 516 wrote to memory of 4884	516	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://mailto:[email protected]/?subject=Campaign-Uid%3Awg275fbv57dc1%20%2F%20Subscriber-Uid%3Atq234sygxr063%20-%20Unsubscribe%20request&body=Please%20unsubscribe%20me%21
1⤵
- Suspicious use of WriteProcessMemory
PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc634746f8,0x7ffc63474708,0x7ffc63474718
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,14715244928429396014,10845629045912424622,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,14715244928429396014,10845629045912424622,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,14715244928429396014,10845629045912424622,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14715244928429396014,10845629045912424622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14715244928429396014,10845629045912424622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14715244928429396014,10845629045912424622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14715244928429396014,10845629045912424622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,14715244928429396014,10845629045912424622,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,14715244928429396014,10845629045912424622,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14715244928429396014,10845629045912424622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14715244928429396014,10845629045912424622,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14715244928429396014,10845629045912424622,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14715244928429396014,10845629045912424622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14715244928429396014,10845629045912424622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1796 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14715244928429396014,10845629045912424622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,14715244928429396014,10845629045912424622,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5292 /prefetch:2
  2⤵
  PID:4836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a6dbfa7c3203421d6144dff3a536b666

SHA1
19c5445dc9fd2a6b2bd09333cd4dfa6bffcff76a

SHA256
71f206be621a2f63c9b93938ac4db8fbeb65f07a2442cdea7c91f3183b56e506

SHA512
871265132340a127dbba5943b17125b7cbec71da9e554cc2e013547d374bc538805b7002e73cdd7d17f617e06c18bc70200a27b92383cfb145b91abcbb4e9984

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e61e35ebfbac41fdf35cc04c9aec037c

SHA1
f1173dac4047507bc3bbb3bc8e480faaf23b67ed

SHA256
c3a9450f2893e76ea4cc5600666be8d201c75e4f73821a8223285175eda0d376

SHA512
272e363f4e419e4e2cd4e8659f99ab357df9181233c1952fc2d128d51190b70d248f2cd498341d0398e9f23742edff3091a34a16a5b84705395057ce8d9d6177

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e8cd42f050984fa8bb73535e4f768309

SHA1
74ab705e81aad033bdc6ac1382905989dff93fb5

SHA256
bb485ff4e52519c614ebe69285072be7fdd910d609406e12d741bc2462228e46

SHA512
7333b2f9abb6a6744a5684914df9c3cb1239198c215329c92f49298f41ce001e3469c29a26fec6e2826af1461031ab7a562717abb408e299a003003238407a51

Download Submit