12d14cc1f1d29e131b94659bd8830ce0afe855973f36648929f6bdc7dab4b87f

Analysis

max time kernel
136s
max time network
142s
platform
windows10_x64
resource
win10v200430
submitted
30-06-2020 06:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

รูปภาพที่ต้องลบ.exe
Size

24.4MB
MD5

60e8c8216af0a6c159364a3cfebc1f1b
SHA1

ffd81aa28975dfd4f8e09aa55863c569f6c37037
SHA256

12d14cc1f1d29e131b94659bd8830ce0afe855973f36648929f6bdc7dab4b87f
SHA512

8852553899c83a5d922ca78048b8a37f0a014501796044f1c826b68599365cde0f9046351bffe1f09d07707b2f5049c12dd0dc5a949da076160d7ef44562f403

Score

10^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4040 2044 WerFault.exe MicrosoftEdge.exe
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 4040 created 2044 4040 WerFault.exe MicrosoftEdge.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

pid	pid_target	process	target process
4040	2044	WerFault.exe	MicrosoftEdge.exe

description	pid	process	target process
PID 4040 created 2044	4040	WerFault.exe	MicrosoftEdge.exe

Loads dropped DLL 37 IoCs

Processes:

รูปภาพที่ต้องลบ.exe

pid	process
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe
1576	รูปภาพที่ต้องลบ.exe

Checks whether UAC is enabled 1 IoCs

Processes:

MicrosoftEdge.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MicrosoftEdge.exe
Drops file in Windows directory 1 IoCs

Processes:

MicrosoftEdge.exe

description ioc process

File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

18 checkip.amazonaws.com
19 checkip.amazonaws.com
Modifies control panel 1 IoCs
evasion

Processes:

MicrosoftEdge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Control Panel\Colors MicrosoftEdge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MicrosoftEdge.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

flow	ioc
18	checkip.amazonaws.com
19	checkip.amazonaws.com

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Control Panel\Colors	MicrosoftEdge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

MicrosoftEdge.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	2044	MicrosoftEdge.exe
Token: SeDebugPrivilege	2044	MicrosoftEdge.exe
Token: SeDebugPrivilege	2044	MicrosoftEdge.exe
Token: SeDebugPrivilege	2044	MicrosoftEdge.exe
Token: SeDebugPrivilege	4040	WerFault.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exebrowser_broker.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies registry class 113 IoCs

Processes:

MicrosoftEdge.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000156c639485eef0ef2fe33afb1e91755c6de3abd889d8c5c82a35f1bc466bf37afce48f79ce23417b51634947c1e4b69f9be6d695357eee0de025	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 02666555f01ed601	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{93A6428B-9B92-4389-AC48-3DF959583336} = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000efe5d6b4f76882a865ba62e5202f89bd67916fc598369f06f4e297daaa0987716c11eea7488768387a80ce3dad814bd638b9256de65f6335ea8740e801bb445a081d221460035563f02daebff619c44e9e11c6f09bf55d34f4e5116936413e0f25aae040cbfb1532586450b7781682155b3b0209b218e83ead9c1378bcbc97d68f58af8516914f0c81c3e65c40986a9703d617cbbae8ec0dfc4c7707634df188b6c7d364d0e3dc6992ebef193ebfd8f098817c098785d5af4e9503550812f020e897a7b50b135253667d4e5cb6aac07312de1cc68c0fe133481784f4a52c7db23669e8deec3fbeb2fb17ba50dd7b357cba8bd2b7d2a6331e4d724162dcbb98a22fdbd0213689f672215b812814517693d32aaed8e06ae4b41a46c32a53e03935798e4df4d70f0270eee764924b4c0ee5265a9a0c917b86147c3378a20fb99a684022a26a7bf3283c825cfe71918ba50690baf3d0bef9b11c77d9aa29c767fe23813702b4815345a9145bb032c330bf06feecb1fe97043b249fd714078e0ac9aebc6d43a323514b2da28272a6fd5aded4418f15a1f4bcbc848cbd46a70b90e2f6842e806ded6f	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 02666555f01ed601	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

รูปภาพที่ต้องลบ.exe

description	pid	process	target process
PID 992 wrote to memory of 1576	992	รูปภาพที่ต้องลบ.exe	รูปภาพที่ต้องลบ.exe
PID 992 wrote to memory of 1576	992	รูปภาพที่ต้องลบ.exe	รูปภาพที่ต้องลบ.exe
PID 992 wrote to memory of 1576	992	รูปภาพที่ต้องลบ.exe	รูปภาพที่ต้องลบ.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

MicrosoftEdge.exe

pid process

2044 MicrosoftEdge.exe

pid	process
2044	MicrosoftEdge.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

WerFault.exe

pid	process
4040	WerFault.exe
4040	WerFault.exe
4040	WerFault.exe
4040	WerFault.exe
4040	WerFault.exe
4040	WerFault.exe
4040	WerFault.exe
4040	WerFault.exe
4040	WerFault.exe
4040	WerFault.exe
4040	WerFault.exe
4040	WerFault.exe
4040	WerFault.exe
4040	WerFault.exe
4040	WerFault.exe
4040	WerFault.exe
4040	WerFault.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\รูปภาพที่ต้องลบ.exe
"C:\Users\Admin\AppData\Local\Temp\รูปภาพที่ต้องลบ.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:992

C:\Users\Admin\AppData\Local\Temp\รูปภาพที่ต้องลบ.exe
"C:\Users\Admin\AppData\Local\Temp\รูปภาพที่ต้องลบ.exe"
2⤵
- Loads dropped DLL
PID:1576

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Checks whether UAC is enabled
- Drops file in Windows directory
- Modifies control panel
- Suspicious use of AdjustPrivilegeToken
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2044

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2044 -s 3448
2⤵
- Program crash
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Enumerates system info in registry
PID:4040

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:548

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI9922\Crypto\Cipher\_Salsa20.cp38-win32.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\Crypto\Cipher\_raw_aes.cp38-win32.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\Crypto\Cipher\_raw_cbc.cp38-win32.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\Crypto\Cipher\_raw_cfb.cp38-win32.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\Crypto\Cipher\_raw_ctr.cp38-win32.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\Crypto\Cipher\_raw_ecb.cp38-win32.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\Crypto\Cipher\_raw_ocb.cp38-win32.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\Crypto\Cipher\_raw_ofb.cp38-win32.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\Crypto\Hash\_BLAKE2s.cp38-win32.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\Crypto\Hash\_MD5.cp38-win32.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\Crypto\Hash\_SHA1.cp38-win32.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\Crypto\Hash\_SHA256.cp38-win32.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\Crypto\Hash\_ghash_portable.cp38-win32.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\Crypto\Protocol\_scrypt.cp38-win32.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\Crypto\Util\_cpuid_c.cp38-win32.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\Crypto\Util\_strxor.cp38-win32.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\VCRUNTIME140.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\_bz2.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\_cffi_backend.cp38-win32.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\_ctypes.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\_hashlib.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\_lzma.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\_queue.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\_socket.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\_ssl.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\base_library.zip

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\certifi\cacert.pem

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\cryptography\hazmat\bindings\_constant_time.cp38-win32.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\cryptography\hazmat\bindings\_openssl.cp38-win32.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\libcrypto-1_1.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\libffi-7.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\libssl-1_1.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\pyexpat.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\python38.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\pythoncom38.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\pywintypes38.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\select.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\unicodedata.pyd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9922\win32api.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\Crypto\Cipher\_Salsa20.cp38-win32.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\Crypto\Cipher\_raw_aes.cp38-win32.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\Crypto\Cipher\_raw_cbc.cp38-win32.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\Crypto\Cipher\_raw_cfb.cp38-win32.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\Crypto\Cipher\_raw_ctr.cp38-win32.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\Crypto\Cipher\_raw_ecb.cp38-win32.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\Crypto\Cipher\_raw_ocb.cp38-win32.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\Crypto\Cipher\_raw_ofb.cp38-win32.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\Crypto\Hash\_BLAKE2s.cp38-win32.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\Crypto\Hash\_MD5.cp38-win32.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\Crypto\Hash\_SHA1.cp38-win32.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\Crypto\Hash\_SHA256.cp38-win32.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\Crypto\Hash\_ghash_portable.cp38-win32.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\Crypto\Protocol\_scrypt.cp38-win32.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\Crypto\Util\_cpuid_c.cp38-win32.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\Crypto\Util\_strxor.cp38-win32.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\VCRUNTIME140.dll

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\_bz2.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\_cffi_backend.cp38-win32.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\_ctypes.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\_hashlib.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\_lzma.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\_queue.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\_socket.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\_ssl.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\cryptography\hazmat\bindings\_constant_time.cp38-win32.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\cryptography\hazmat\bindings\_openssl.cp38-win32.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\libcrypto-1_1.dll

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\libffi-7.dll

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\libssl-1_1.dll

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\pyexpat.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\python38.dll

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\pythoncom38.dll

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\pywintypes38.dll

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\select.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\unicodedata.pyd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9922\win32api.pyd

Download Submit
memory/1576-0-0x0000000000000000-mapping.dmp

Download
memory/4040-77-0x000001EF4E780000-0x000001EF4E781000-memory.dmp

Filesize
4KB

Download
memory/4040-78-0x000001EF4E780000-0x000001EF4E781000-memory.dmp

Filesize
4KB

Download
memory/4040-80-0x000001EF4F6A0000-0x000001EF4F6A1000-memory.dmp

Filesize
4KB

Download
memory/4040-83-0x000001EF4F6A0000-0x000001EF4F6A1000-memory.dmp

Filesize
4KB

Download
memory/4040-84-0x000001EF4F820000-0x000001EF4F821000-memory.dmp

Filesize
4KB

Download
memory/4040-85-0x000001EF4F5E0000-0x000001EF4F5E1000-memory.dmp

Filesize
4KB

Download
memory/4040-89-0x000001EF4F590000-0x000001EF4F591000-memory.dmp

Filesize
4KB

Download