Analysis
-
max time kernel
271s -
max time network
277s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-12-2024 17:41
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://creditoscontinental.com/
Resource
win10v2004-20241007-en
General
-
Target
https://creditoscontinental.com/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4228 msedge.exe 4228 msedge.exe 3512 msedge.exe 3512 msedge.exe 1084 identity_helper.exe 1084 identity_helper.exe 532 msedge.exe 532 msedge.exe 532 msedge.exe 532 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe 3512 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3512 wrote to memory of 4968 3512 msedge.exe 82 PID 3512 wrote to memory of 4968 3512 msedge.exe 82 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 5052 3512 msedge.exe 83 PID 3512 wrote to memory of 4228 3512 msedge.exe 84 PID 3512 wrote to memory of 4228 3512 msedge.exe 84 PID 3512 wrote to memory of 3600 3512 msedge.exe 85 PID 3512 wrote to memory of 3600 3512 msedge.exe 85 PID 3512 wrote to memory of 3600 3512 msedge.exe 85 PID 3512 wrote to memory of 3600 3512 msedge.exe 85 PID 3512 wrote to memory of 3600 3512 msedge.exe 85 PID 3512 wrote to memory of 3600 3512 msedge.exe 85 PID 3512 wrote to memory of 3600 3512 msedge.exe 85 PID 3512 wrote to memory of 3600 3512 msedge.exe 85 PID 3512 wrote to memory of 3600 3512 msedge.exe 85 PID 3512 wrote to memory of 3600 3512 msedge.exe 85 PID 3512 wrote to memory of 3600 3512 msedge.exe 85 PID 3512 wrote to memory of 3600 3512 msedge.exe 85 PID 3512 wrote to memory of 3600 3512 msedge.exe 85 PID 3512 wrote to memory of 3600 3512 msedge.exe 85 PID 3512 wrote to memory of 3600 3512 msedge.exe 85 PID 3512 wrote to memory of 3600 3512 msedge.exe 85 PID 3512 wrote to memory of 3600 3512 msedge.exe 85 PID 3512 wrote to memory of 3600 3512 msedge.exe 85 PID 3512 wrote to memory of 3600 3512 msedge.exe 85 PID 3512 wrote to memory of 3600 3512 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://creditoscontinental.com/1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb48b546f8,0x7ffb48b54708,0x7ffb48b547182⤵PID:4968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,7030844454086232911,8809279572862675102,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:5052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,7030844454086232911,8809279572862675102,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,7030844454086232911,8809279572862675102,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:82⤵PID:3600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7030844454086232911,8809279572862675102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:1600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7030844454086232911,8809279572862675102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:12⤵PID:4368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,7030844454086232911,8809279572862675102,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 /prefetch:82⤵PID:3324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,7030844454086232911,8809279572862675102,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7030844454086232911,8809279572862675102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:12⤵PID:3268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7030844454086232911,8809279572862675102,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:12⤵PID:3332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7030844454086232911,8809279572862675102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:12⤵PID:1228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7030844454086232911,8809279572862675102,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:12⤵PID:1120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,7030844454086232911,8809279572862675102,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2456 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:532
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3140
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3720
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5b8880802fc2bb880a7a869faa01315b0
SHA151d1a3fa2c272f094515675d82150bfce08ee8d3
SHA256467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812
SHA512e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2
-
Filesize
152B
MD5ba6ef346187b40694d493da98d5da979
SHA1643c15bec043f8673943885199bb06cd1652ee37
SHA256d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73
SHA5122e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c
-
Filesize
191B
MD5c31f6ddfe45f956dfc3ebe03c2b3c995
SHA160ac7721c4376900c64d3c1760647406a65347c2
SHA2560308e7bfa27be644a5b4bedbaaac21b0b64f5ce91c8cdc9cf8c8a1f876bc4e11
SHA512b2a4da0e3a1d356132553d1abc16b259c155bf2731a8e165f4c3da722c5f28a63cb53764a7e0a46912465f7da8ae49e4b9628e31e97fbccd577ae1e76d81194c
-
Filesize
5KB
MD551e9ed576abcd53289cade235b82ddd1
SHA1c01a47a6545180633d40fe01e86ce610f7a290ef
SHA2569837163761cc36793542c6b373bb91be660e75a90f83e181685b4d8c288a78b9
SHA51265bf1905b891baa1f36aa3eb24f117f298672f7ca7a6849bf7f68a7c8811f410f18b270d1b510c6327da374026daecabced2512962ffa56f5dae3423d21c4e53
-
Filesize
6KB
MD531aff6ffd9dd56a8c3f05a3376662976
SHA1f1be6dd4990ab7a77301c27b92e57762370799d5
SHA256974a416fe3ff1268d56d4f110bd64df358e50b9054cfefa28a394062e86c9a54
SHA512bf04b56f8ee7c1044da5b9a140ac550c4d1da1aeae6f1ec673bfa323297aeecd0df919fcf5919bba2cb0a0129e517969d7fa3af2dda1072fb20b31366acebd99
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD55dfd928ce1ffe0233339fe1008d05b2e
SHA1f249ea411df4e417b22e31c33f549a331b022817
SHA2562abf4bbc2d84456261c676b9d865a6f5d434cdb1f081257f372086a727218ceb
SHA512392040a2b5b86b77201c9195950a690c4019676d598d674fd8f57f6cd70da6d32c8177832cd179d6b2e69cb39058f798ff4ba871d25094cae81de39aa50942d0