vidar | 4b3bed149062abeddef6fe68cbb439f5ae3d3044a4870a125f83dfd37c34ca6c

Analysis

max time kernel
71s
max time network
129s
platform
windows10_x64
resource
win10
submitted
31-07-2020 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f24873db74e421aea902858fc094c601.exe
Size

589KB
MD5

f24873db74e421aea902858fc094c601
SHA1

fefb3fb2abbb7847badffed0f9fad5a2b922b963
SHA256

4b3bed149062abeddef6fe68cbb439f5ae3d3044a4870a125f83dfd37c34ca6c
SHA512

7a3eebf9d10877bab9ae2995b116342c44f27bd37d59541442ff107e5550a88eddf6176b0a288c12685660cbeff44bd5849e4d163d66e3fa0af062903cb06d41

Score

10^/10

spyware stealer vidar discovery

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 904 created 3884 904 WerFault.exe MicrosoftEdge.exe
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Executes dropped EXE 4 IoCs

Processes:

wotsuper.exewotsuper1.exec36bcad6..exec36bcad6..exe

pid process

2428 wotsuper.exe
2196 wotsuper1.exe
2836 c36bcad6..exe
764 c36bcad6..exe

description	pid	process	target process
PID 904 created 3884	904	WerFault.exe	MicrosoftEdge.exe

pid	process
2428	wotsuper.exe
2196	wotsuper1.exe
2836	c36bcad6..exe
764	c36bcad6..exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f24873db74e421aea902858fc094c601.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\International\Geo\Nation	f24873db74e421aea902858fc094c601.exe

Loads dropped DLL 3 IoCs

Processes:

wotsuper.exec36bcad6..exe

pid process

2428 wotsuper.exe
2428 wotsuper.exe
764 c36bcad6..exe
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
JavaScript code in executable 1 IoCs

Processes:

resource yara_rule

\ProgramData\nss3.dll js
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

17 ip-api.com
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

904 3884 WerFault.exe MicrosoftEdge.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

c36bcad6..exe

description pid process target process

PID 2836 set thread context of 764 2836 c36bcad6..exe c36bcad6..exe

pid	process
2428	wotsuper.exe
2428	wotsuper.exe
764	c36bcad6..exe

resource	yara_rule
\ProgramData\nss3.dll	js

flow	ioc
17	ip-api.com

pid	pid_target	process	target process
904	3884	WerFault.exe	MicrosoftEdge.exe

description	pid	process	target process
PID 2836 set thread context of 764	2836	c36bcad6..exe	c36bcad6..exe

Drops file in Program Files directory 4 IoCs

Processes:

f24873db74e421aea902858fc094c601.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe	f24873db74e421aea902858fc094c601.exe
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe	f24873db74e421aea902858fc094c601.exe
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.exe	f24873db74e421aea902858fc094c601.exe
File created	C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.ini	f24873db74e421aea902858fc094c601.exe

Drops file in Windows directory 2 IoCs

Processes:

f24873db74e421aea902858fc094c601.exeMicrosoftEdge.exe

description	ioc	process
File opened for modification	C:\Windows\wotsuper.reg	f24873db74e421aea902858fc094c601.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exewotsuper.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wotsuper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wotsuper.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1472 taskkill.exe
Modifies Control Panel 1 IoCs
evasion

Processes:

MicrosoftEdge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Colors MicrosoftEdge.exe

pid	process
1472	taskkill.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Colors	MicrosoftEdge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exebrowser_broker.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe

Modifies registry class 113 IoCs

Processes:

MicrosoftEdge.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersi = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{86058CD3-75C0-4A60-8AAC-B62776027C75} = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "{D8E1165E-F469-426D-9285-7E93F0A93810}"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 0100000063ba4bbd9bbbee14cd53fd5de4b65a2c130a57b87f9c14144841f412ec3e7c6c0a821f78a004747cc598eb694d88f72150b660ec72383123c28e8c39d1f64404c77a1871a8ba8d9dcb9610fd4674387f13addf0fe4127bfa2a01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 8a978de4d243d601	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 8a978de4d243d601	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings	MicrosoftEdge.exe

Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

2104 regedit.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2324 PING.EXE

pid	process
2104	regedit.exe

pid	process
2324	PING.EXE

Suspicious behavior: EnumeratesProcesses 29 IoCs

Processes:

WerFault.exewotsuper.exewotsuper1.exe

pid	process
904	WerFault.exe
904	WerFault.exe
904	WerFault.exe
904	WerFault.exe
904	WerFault.exe
904	WerFault.exe
904	WerFault.exe
904	WerFault.exe
904	WerFault.exe
904	WerFault.exe
904	WerFault.exe
904	WerFault.exe
904	WerFault.exe
904	WerFault.exe
904	WerFault.exe
904	WerFault.exe
904	WerFault.exe
2428	wotsuper.exe
2428	wotsuper.exe
2196	wotsuper1.exe
2428	wotsuper.exe
2196	wotsuper1.exe
2428	wotsuper.exe
2428	wotsuper.exe
2428	wotsuper.exe
2428	wotsuper.exe
2428	wotsuper.exe
2196	wotsuper1.exe
2196	wotsuper1.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

MicrosoftEdge.exeWerFault.exewotsuper1.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	3884	MicrosoftEdge.exe
Token: SeDebugPrivilege	3884	MicrosoftEdge.exe
Token: SeDebugPrivilege	3884	MicrosoftEdge.exe
Token: SeDebugPrivilege	3884	MicrosoftEdge.exe
Token: SeDebugPrivilege	904	WerFault.exe
Token: SeDebugPrivilege	2196	wotsuper1.exe
Token: SeDebugPrivilege	1472	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

MicrosoftEdge.exe

pid process

3884 MicrosoftEdge.exe

pid	process
3884	MicrosoftEdge.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

f24873db74e421aea902858fc094c601.exewotsuper1.execmd.exewotsuper.execmd.exec36bcad6..exe

description	pid	process	target process
PID 2928 wrote to memory of 2428	2928	f24873db74e421aea902858fc094c601.exe	wotsuper.exe
PID 2928 wrote to memory of 2428	2928	f24873db74e421aea902858fc094c601.exe	wotsuper.exe
PID 2928 wrote to memory of 2428	2928	f24873db74e421aea902858fc094c601.exe	wotsuper.exe
PID 2928 wrote to memory of 2196	2928	f24873db74e421aea902858fc094c601.exe	wotsuper1.exe
PID 2928 wrote to memory of 2196	2928	f24873db74e421aea902858fc094c601.exe	wotsuper1.exe
PID 2928 wrote to memory of 2196	2928	f24873db74e421aea902858fc094c601.exe	wotsuper1.exe
PID 2928 wrote to memory of 2104	2928	f24873db74e421aea902858fc094c601.exe	regedit.exe
PID 2928 wrote to memory of 2104	2928	f24873db74e421aea902858fc094c601.exe	regedit.exe
PID 2928 wrote to memory of 2104	2928	f24873db74e421aea902858fc094c601.exe	regedit.exe
PID 2196 wrote to memory of 2836	2196	wotsuper1.exe	c36bcad6..exe
PID 2196 wrote to memory of 2836	2196	wotsuper1.exe	c36bcad6..exe
PID 2196 wrote to memory of 2836	2196	wotsuper1.exe	c36bcad6..exe
PID 2196 wrote to memory of 1868	2196	wotsuper1.exe	cmd.exe
PID 2196 wrote to memory of 1868	2196	wotsuper1.exe	cmd.exe
PID 2196 wrote to memory of 1868	2196	wotsuper1.exe	cmd.exe
PID 1868 wrote to memory of 2324	1868	cmd.exe	PING.EXE
PID 1868 wrote to memory of 2324	1868	cmd.exe	PING.EXE
PID 1868 wrote to memory of 2324	1868	cmd.exe	PING.EXE
PID 2428 wrote to memory of 2656	2428	wotsuper.exe	cmd.exe
PID 2428 wrote to memory of 2656	2428	wotsuper.exe	cmd.exe
PID 2428 wrote to memory of 2656	2428	wotsuper.exe	cmd.exe
PID 2656 wrote to memory of 1472	2656	cmd.exe	taskkill.exe
PID 2656 wrote to memory of 1472	2656	cmd.exe	taskkill.exe
PID 2656 wrote to memory of 1472	2656	cmd.exe	taskkill.exe
PID 2836 wrote to memory of 764	2836	c36bcad6..exe	c36bcad6..exe
PID 2836 wrote to memory of 764	2836	c36bcad6..exe	c36bcad6..exe
PID 2836 wrote to memory of 764	2836	c36bcad6..exe	c36bcad6..exe
PID 2836 wrote to memory of 764	2836	c36bcad6..exe	c36bcad6..exe
PID 2836 wrote to memory of 764	2836	c36bcad6..exe	c36bcad6..exe
PID 2836 wrote to memory of 764	2836	c36bcad6..exe	c36bcad6..exe

C:\Users\Admin\AppData\Local\Temp\f24873db74e421aea902858fc094c601.exe
"C:\Users\Admin\AppData\Local\Temp\f24873db74e421aea902858fc094c601.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2928

C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
"C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2428

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im wotsuper.exe /f & erase C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe & exit
3⤵
- Suspicious use of WriteProcessMemory
PID:2656

C:\Windows\SysWOW64\taskkill.exe
taskkill /im wotsuper.exe /f
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1472

C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe
"C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196

C:\Users\Admin\AppData\Local\Temp\c36bcad6..exe
"C:\Users\Admin\AppData\Local\Temp\c36bcad6..exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2836

C:\Users\Admin\AppData\Local\Temp\c36bcad6..exe
"C:\Users\Admin\AppData\Local\Temp\c36bcad6..exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:1868

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
4⤵
- Runs ping.exe
PID:2324

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe" \s C:\Windows\wotsuper.reg
2⤵
- Runs .reg file with regedit
PID:2104

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3884

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3884 -s 3424
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:904

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1804

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
MD5
befcd9935633f7417e28f2660d676365

SHA1
c293d06c991fde8c562b898472a318b0afa067e9

SHA256
de6bbc1648a408ff79f5c7e48c25e0095251ecb0fde4ad88fd94adb6d03710b7

SHA512
03d34c622fdcc100832831d24eec3e1f8bc65ed22ab160bf032895fc18aebe0e66d403e380705207b7ed001215d7801f0d95af464f72108333e304a5837b828d

Download Submit
C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
MD5
befcd9935633f7417e28f2660d676365

SHA1
c293d06c991fde8c562b898472a318b0afa067e9

SHA256
de6bbc1648a408ff79f5c7e48c25e0095251ecb0fde4ad88fd94adb6d03710b7

SHA512
03d34c622fdcc100832831d24eec3e1f8bc65ed22ab160bf032895fc18aebe0e66d403e380705207b7ed001215d7801f0d95af464f72108333e304a5837b828d

Download Submit
C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe
MD5
af02993e4d8295307595bff5e81201e4

SHA1
4160f3cd2d679eafa094846fc93f21bea42b3ce6

SHA256
8c598b6302b02cb44597c0788e479db8e2190bc981786036e4019921bf27d5c2

SHA512
05beaaf611d9b528c68a9882a7994d6b91f71a3946fd66ba24812f59390f783054d7e028b11b3851d2e926f5cd15c5f8470b5ba8ec4b43cd4bfa90e0faedadc1

Download Submit
C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe
MD5
af02993e4d8295307595bff5e81201e4

SHA1
4160f3cd2d679eafa094846fc93f21bea42b3ce6

SHA256
8c598b6302b02cb44597c0788e479db8e2190bc981786036e4019921bf27d5c2

SHA512
05beaaf611d9b528c68a9882a7994d6b91f71a3946fd66ba24812f59390f783054d7e028b11b3851d2e926f5cd15c5f8470b5ba8ec4b43cd4bfa90e0faedadc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\c36bcad6..exe
MD5
d9a97096753da9101e89efe264834629

SHA1
bef5989964ecc57613554049b76086d99d4207f0

SHA256
2afb9e882933b951a803e82694e39249e51e0ec987212edc46f261240dad76b6

SHA512
4d29505235883ec980acdd62a5de049f6ae1209102c0658a70a06c0ffa7da59b312f619c9db3739da412a515b04813a09b0737d7bf64df1c8483083b01b413e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\c36bcad6..exe
MD5
d9a97096753da9101e89efe264834629

SHA1
bef5989964ecc57613554049b76086d99d4207f0

SHA256
2afb9e882933b951a803e82694e39249e51e0ec987212edc46f261240dad76b6

SHA512
4d29505235883ec980acdd62a5de049f6ae1209102c0658a70a06c0ffa7da59b312f619c9db3739da412a515b04813a09b0737d7bf64df1c8483083b01b413e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\c36bcad6..exe
MD5
d9a97096753da9101e89efe264834629

SHA1
bef5989964ecc57613554049b76086d99d4207f0

SHA256
2afb9e882933b951a803e82694e39249e51e0ec987212edc46f261240dad76b6

SHA512
4d29505235883ec980acdd62a5de049f6ae1209102c0658a70a06c0ffa7da59b312f619c9db3739da412a515b04813a09b0737d7bf64df1c8483083b01b413e5

Download Submit
\ProgramData\mozglue.dll
MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
\ProgramData\nss3.dll
MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
\Users\Admin\AppData\Local\Temp\D47F.tmp
MD5
50741b3f2d7debf5d2bed63d88404029

SHA1
56210388a627b926162b36967045be06ffb1aad3

SHA256
f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

SHA512
fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

Download Submit
memory/764-113-0x0000000000402C70-mapping.dmp

Download
memory/764-112-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/904-13-0x00000261ECB80000-0x00000261ECB81000-memory.dmp

Filesize
4KB

Download
memory/904-16-0x00000261ECC70000-0x00000261ECC71000-memory.dmp

Filesize
4KB

Download
memory/904-10-0x00000261EBE10000-0x00000261EBE11000-memory.dmp

Filesize
4KB

Download
memory/904-9-0x00000261EBE10000-0x00000261EBE11000-memory.dmp

Filesize
4KB

Download
memory/904-104-0x00000261EA340000-0x00000261EA341000-memory.dmp

Filesize
4KB

Download
memory/1472-108-0x0000000000000000-mapping.dmp

Download
memory/1868-105-0x0000000000000000-mapping.dmp

Download
memory/2104-6-0x0000000000000000-mapping.dmp

Download
memory/2196-7-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/2196-12-0x0000000002200000-0x000000000221E000-memory.dmp

Filesize
120KB

Download
memory/2196-2-0x0000000000000000-mapping.dmp

Download
memory/2324-106-0x0000000000000000-mapping.dmp

Download
memory/2428-0-0x0000000000000000-mapping.dmp

Download
memory/2656-107-0x0000000000000000-mapping.dmp

Download
memory/2836-109-0x00000000036A1000-0x00000000036A2000-memory.dmp

Filesize
4KB

Download
memory/2836-110-0x0000000005120000-0x0000000005121000-memory.dmp

Filesize
4KB

Download
memory/2836-97-0x0000000000000000-mapping.dmp

Download