Analysis
-
max time kernel
181s -
max time network
190s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
30-01-2022 21:45
Static task
static1
Behavioral task
behavioral1
Sample
d4be6c9117db9de21138ae26d1d0c3cfb38fd7a19fa07c828731fa2ac756ef8d.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
d4be6c9117db9de21138ae26d1d0c3cfb38fd7a19fa07c828731fa2ac756ef8d.exe
Resource
win10-en-20211208
General
-
Target
d4be6c9117db9de21138ae26d1d0c3cfb38fd7a19fa07c828731fa2ac756ef8d.exe
-
Size
438KB
-
MD5
230d8a7a60a07df28a291b13ddf3351f
-
SHA1
de71fd21781ae1eed0dbba6bf915a65cc4c0f984
-
SHA256
d4be6c9117db9de21138ae26d1d0c3cfb38fd7a19fa07c828731fa2ac756ef8d
-
SHA512
b3305950a8d24b247a16b35d49f53dfbc367332879ddafcb7d95a1c44ec02f7ed66d26acbf9992bf39193094c7bbefcbbe59ae514619491e148bb59cb32ddf01
Malware Config
Signatures
-
suricata: ET MALWARE Possible Deep Panda - Sakula/Mivast RAT CnC Beacon 5
suricata: ET MALWARE Possible Deep Panda - Sakula/Mivast RAT CnC Beacon 5
-
suricata: ET MALWARE Possible Deep Panda User-Agent
suricata: ET MALWARE Possible Deep Panda User-Agent
-
suricata: ET MALWARE Sakula/Mivast C2 Activity
suricata: ET MALWARE Sakula/Mivast C2 Activity
-
Executes dropped EXE 3 IoCs
Processes:
Center259406000.dats.exeMediaCenter.exepid process 896 Center259406000.dat 780 s.exe 1912 MediaCenter.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
d4be6c9117db9de21138ae26d1d0c3cfb38fd7a19fa07c828731fa2ac756ef8d.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\International\Geo\Nation d4be6c9117db9de21138ae26d1d0c3cfb38fd7a19fa07c828731fa2ac756ef8d.exe -
Loads dropped DLL 2 IoCs
Processes:
s.exeMediaCenter.exepid process 780 s.exe 1912 MediaCenter.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
MediaCenter.exedescription pid process target process PID 1912 set thread context of 2448 1912 MediaCenter.exe svchost.exe -
Drops file in Windows directory 3 IoCs
Processes:
MicrosoftEdgeCP.exeMicrosoftEdge.exedescription ioc process File created C:\Windows\rescache\_merged\3720402701\1659841449.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1659841449.pri MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
browser_broker.exeMicrosoftEdgeCP.exeMicrosoftEdge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CRLs MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\MrtCache MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$http://www.typepad.com/ MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$WordPress MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = a7c99e77ff14d801 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = 01000000de78ba84282cac6450fe5712ebc3812306bf6c59bce9a2138d158bc81b8ee2d867309c4d93255f251eb2b646fc833d8b3f67ee92c06b8915e713 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = b92b98449b18d801 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\Certificates MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$MediaWiki MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{AC297A76-7FEE-4F9E-A7BA-0CCAED97B4F2}" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 1ebdc8e246ecd701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = 01000000b47fe6daa6ef7a284a2a53fd59d339a3bcc8a7ec9924a825f35cb8a6a3cf831b8722ad20f925bdc46529b1e584fa7fa5b3f202db07c7b702cd146d83f8c7a1e673dbca6c911c6b659fe3dac66febc0bb65c1c665da7afe12339a1801ff58b12bcec861035a752791277b1f1b9144fa48105523e593df79c20a0cdb72a522e12fd40a7c6047ce0af2ee0f737ef9a65f91d8cd58213b9521047b8b3e26eac55b931dc233f721c86e200dc1546557b28ed7934b37f3a63bff642937482d31e1d0ff530e873cba03267dc9af9b5caf06ce0c29ee953bcd73862b0f3072f66c1684569d0f2805fd1fc21bc4fbd17b7444ef0d71d63c2533dcd18f2a96bfb34504547bf4e51b30e7bc4abe0ec4ca5ced0a087288223dbbe11541f81d894c965a4b0ca912b151a5667b3ddff129270062fab7ebadf429cdf0c031505b29a6d3768b235bbb9105a00afa80c96d4c2b7f08b2bf32eb6b34227f7c5c6830969b808e638fbfeaa6934e10da05c8eb4b008caad30a8635a71400b6e85d6938f0823897751ac26711aabaf2bbee5b4d48d0c144febcba1ac821fe75a62f57271006faa911f3c43789f12d9c59 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\ MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$blogger MicrosoftEdge.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
MicrosoftEdgeCP.exepid process 3812 MicrosoftEdgeCP.exe 3812 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exedescription pid process Token: SeDebugPrivilege 2316 MicrosoftEdge.exe Token: SeDebugPrivilege 2316 MicrosoftEdge.exe Token: SeDebugPrivilege 2316 MicrosoftEdge.exe Token: SeDebugPrivilege 2316 MicrosoftEdge.exe Token: SeDebugPrivilege 1820 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1820 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1820 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1820 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1504 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1504 MicrosoftEdgeCP.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
d4be6c9117db9de21138ae26d1d0c3cfb38fd7a19fa07c828731fa2ac756ef8d.exeMicrosoftEdge.exeMicrosoftEdgeCP.exepid process 1324 d4be6c9117db9de21138ae26d1d0c3cfb38fd7a19fa07c828731fa2ac756ef8d.exe 1324 d4be6c9117db9de21138ae26d1d0c3cfb38fd7a19fa07c828731fa2ac756ef8d.exe 2316 MicrosoftEdge.exe 3812 MicrosoftEdgeCP.exe 3812 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
d4be6c9117db9de21138ae26d1d0c3cfb38fd7a19fa07c828731fa2ac756ef8d.exeCenter259406000.dats.execmd.execmd.execmd.execmd.exeMediaCenter.exeMicrosoftEdgeCP.exedescription pid process target process PID 1324 wrote to memory of 896 1324 d4be6c9117db9de21138ae26d1d0c3cfb38fd7a19fa07c828731fa2ac756ef8d.exe Center259406000.dat PID 1324 wrote to memory of 896 1324 d4be6c9117db9de21138ae26d1d0c3cfb38fd7a19fa07c828731fa2ac756ef8d.exe Center259406000.dat PID 1324 wrote to memory of 896 1324 d4be6c9117db9de21138ae26d1d0c3cfb38fd7a19fa07c828731fa2ac756ef8d.exe Center259406000.dat PID 896 wrote to memory of 780 896 Center259406000.dat s.exe PID 896 wrote to memory of 780 896 Center259406000.dat s.exe PID 896 wrote to memory of 780 896 Center259406000.dat s.exe PID 896 wrote to memory of 1804 896 Center259406000.dat cmd.exe PID 896 wrote to memory of 1804 896 Center259406000.dat cmd.exe PID 896 wrote to memory of 1804 896 Center259406000.dat cmd.exe PID 780 wrote to memory of 3880 780 s.exe cmd.exe PID 780 wrote to memory of 3880 780 s.exe cmd.exe PID 780 wrote to memory of 3880 780 s.exe cmd.exe PID 780 wrote to memory of 3992 780 s.exe cmd.exe PID 780 wrote to memory of 3992 780 s.exe cmd.exe PID 780 wrote to memory of 3992 780 s.exe cmd.exe PID 780 wrote to memory of 340 780 s.exe cmd.exe PID 780 wrote to memory of 340 780 s.exe cmd.exe PID 780 wrote to memory of 340 780 s.exe cmd.exe PID 3880 wrote to memory of 1408 3880 cmd.exe reg.exe PID 3880 wrote to memory of 1408 3880 cmd.exe reg.exe PID 3880 wrote to memory of 1408 3880 cmd.exe reg.exe PID 1804 wrote to memory of 1052 1804 cmd.exe PING.EXE PID 1804 wrote to memory of 1052 1804 cmd.exe PING.EXE PID 1804 wrote to memory of 1052 1804 cmd.exe PING.EXE PID 340 wrote to memory of 4092 340 cmd.exe PING.EXE PID 340 wrote to memory of 4092 340 cmd.exe PING.EXE PID 340 wrote to memory of 4092 340 cmd.exe PING.EXE PID 3992 wrote to memory of 1912 3992 cmd.exe MediaCenter.exe PID 3992 wrote to memory of 1912 3992 cmd.exe MediaCenter.exe PID 3992 wrote to memory of 1912 3992 cmd.exe MediaCenter.exe PID 1912 wrote to memory of 2448 1912 MediaCenter.exe svchost.exe PID 1912 wrote to memory of 2448 1912 MediaCenter.exe svchost.exe PID 1912 wrote to memory of 2448 1912 MediaCenter.exe svchost.exe PID 1912 wrote to memory of 2448 1912 MediaCenter.exe svchost.exe PID 3812 wrote to memory of 1820 3812 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3812 wrote to memory of 1820 3812 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3812 wrote to memory of 1820 3812 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3812 wrote to memory of 1820 3812 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3812 wrote to memory of 1820 3812 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe PID 3812 wrote to memory of 1820 3812 MicrosoftEdgeCP.exe MicrosoftEdgeCP.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4be6c9117db9de21138ae26d1d0c3cfb38fd7a19fa07c828731fa2ac756ef8d.exe"C:\Users\Admin\AppData\Local\Temp\d4be6c9117db9de21138ae26d1d0c3cfb38fd7a19fa07c828731fa2ac756ef8d.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\Center259406000.dat"C:\Users\Admin\AppData\Local\Temp\Center259406000.dat"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Users\Admin\AppData\Local\Temp\s.exe"C:\Users\Admin\AppData\Local\Temp\s.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\s.exe" & del "C:\Users\Admin\AppData\Local\Temp\msi.dll" & del "C:\Users\Admin\AppData\Local\Temp\setup.msi"4⤵
- Suspicious use of WriteProcessMemory
PID:340 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.15⤵
- Runs ping.exe
PID:4092 -
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"6⤵PID:2448
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"5⤵
- Adds Run key to start application
- Modifies registry key
PID:1408 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\Center259406000.dat"3⤵
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
PID:1052
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2316
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:2848
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3812
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1820
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1504
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
a0de79c3b449175aa97725e16c7e74b4
SHA11c57f8cb0fb4eb944634ae1e784bbf51c181a97a
SHA2562102dd512f557bcd74d243c0354b9f58ced6036fc6a9be2620377890eec2348c
SHA512d1a72cd238becabd9d0ab99cedddf22fbcdb6f410573995cd9f9c79efb68527d269e5f1331eee7905ee68af87be1dc1bd5b96769ac5b7ea30561cc84478a6e01
-
MD5
a0de79c3b449175aa97725e16c7e74b4
SHA11c57f8cb0fb4eb944634ae1e784bbf51c181a97a
SHA2562102dd512f557bcd74d243c0354b9f58ced6036fc6a9be2620377890eec2348c
SHA512d1a72cd238becabd9d0ab99cedddf22fbcdb6f410573995cd9f9c79efb68527d269e5f1331eee7905ee68af87be1dc1bd5b96769ac5b7ea30561cc84478a6e01
-
MD5
d00b3169f45e74bb22a1cd684341b14a
SHA12d8e43f9f8ef6cdf0cafb170a65cb27d37fb166d
SHA25683f40e70ea3ba0e614d08f1070dafe75092660003b8a1f8b563d4f5b012f4bae
SHA512329438b4e6d13f9a420152e5c4ed410ae474d47cad858f218bfc8130a73d8d684d89c032cf87f74b9dc3e027bcb9fbe74fe2d4f15f4a59942c4da59b7099997e
-
MD5
d00b3169f45e74bb22a1cd684341b14a
SHA12d8e43f9f8ef6cdf0cafb170a65cb27d37fb166d
SHA25683f40e70ea3ba0e614d08f1070dafe75092660003b8a1f8b563d4f5b012f4bae
SHA512329438b4e6d13f9a420152e5c4ed410ae474d47cad858f218bfc8130a73d8d684d89c032cf87f74b9dc3e027bcb9fbe74fe2d4f15f4a59942c4da59b7099997e
-
MD5
ca9e06c0679586d2ff3ff7e3416c8b87
SHA123d450989ce21cb94c0f9e552edd5eeb50b20fb3
SHA256f414bcb7159a22279f893a257b52e387e4b14250dd9d0ecd871d9fa686cd26cd
SHA51298a2c588a1b408f78e286540752121ac34e81963d559a8e00faa44b9a65ca2cb7265c0598aea57947d799604717cc2004fc6261e8e377a6ba6416421b44dda6e
-
MD5
2c531fe9c05c5644f09fdbcbf993a737
SHA13c1185e2411549cc976cecc350f357a77de249eb
SHA256680903d29590607a1ac4b77bb4cc900b382949800a1f49ebfa04b2492319118f
SHA512859fa0f8efe37c196fe7bb43627c16129657dcf5ff96d23cd72c7770f564525c9b0c95ae68f0e7dad99ccf6bc97dbd5cdc4b3fb38c5fd3129a6308e3b01d7094
-
MD5
ca9e06c0679586d2ff3ff7e3416c8b87
SHA123d450989ce21cb94c0f9e552edd5eeb50b20fb3
SHA256f414bcb7159a22279f893a257b52e387e4b14250dd9d0ecd871d9fa686cd26cd
SHA51298a2c588a1b408f78e286540752121ac34e81963d559a8e00faa44b9a65ca2cb7265c0598aea57947d799604717cc2004fc6261e8e377a6ba6416421b44dda6e
-
MD5
d00b3169f45e74bb22a1cd684341b14a
SHA12d8e43f9f8ef6cdf0cafb170a65cb27d37fb166d
SHA25683f40e70ea3ba0e614d08f1070dafe75092660003b8a1f8b563d4f5b012f4bae
SHA512329438b4e6d13f9a420152e5c4ed410ae474d47cad858f218bfc8130a73d8d684d89c032cf87f74b9dc3e027bcb9fbe74fe2d4f15f4a59942c4da59b7099997e
-
MD5
d00b3169f45e74bb22a1cd684341b14a
SHA12d8e43f9f8ef6cdf0cafb170a65cb27d37fb166d
SHA25683f40e70ea3ba0e614d08f1070dafe75092660003b8a1f8b563d4f5b012f4bae
SHA512329438b4e6d13f9a420152e5c4ed410ae474d47cad858f218bfc8130a73d8d684d89c032cf87f74b9dc3e027bcb9fbe74fe2d4f15f4a59942c4da59b7099997e
-
MD5
2c531fe9c05c5644f09fdbcbf993a737
SHA13c1185e2411549cc976cecc350f357a77de249eb
SHA256680903d29590607a1ac4b77bb4cc900b382949800a1f49ebfa04b2492319118f
SHA512859fa0f8efe37c196fe7bb43627c16129657dcf5ff96d23cd72c7770f564525c9b0c95ae68f0e7dad99ccf6bc97dbd5cdc4b3fb38c5fd3129a6308e3b01d7094
-
MD5
ca9e06c0679586d2ff3ff7e3416c8b87
SHA123d450989ce21cb94c0f9e552edd5eeb50b20fb3
SHA256f414bcb7159a22279f893a257b52e387e4b14250dd9d0ecd871d9fa686cd26cd
SHA51298a2c588a1b408f78e286540752121ac34e81963d559a8e00faa44b9a65ca2cb7265c0598aea57947d799604717cc2004fc6261e8e377a6ba6416421b44dda6e
-
MD5
ca9e06c0679586d2ff3ff7e3416c8b87
SHA123d450989ce21cb94c0f9e552edd5eeb50b20fb3
SHA256f414bcb7159a22279f893a257b52e387e4b14250dd9d0ecd871d9fa686cd26cd
SHA51298a2c588a1b408f78e286540752121ac34e81963d559a8e00faa44b9a65ca2cb7265c0598aea57947d799604717cc2004fc6261e8e377a6ba6416421b44dda6e