Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20/05/2022, 10:18
Static task
static1
Behavioral task
behavioral1
Sample
moavjcbg.dll
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
moavjcbg.dll
Resource
win10v2004-20220414-en
0 signatures
0 seconds
General
-
Target
moavjcbg.dll
-
Size
87KB
-
MD5
fee171fbd4ec2ef64bd04567a80df805
-
SHA1
2db3c49ec6151c1a3c98a7b92006629741b403b5
-
SHA256
9146be1fc85a94880644670cbf63545efb6db43516d79f42a8792342f684a5ca
-
SHA512
c66a675706a5c06202366ad6ef2a64bb82d033037447bd212ef479694d26ce040874a65a48f6f9af04af87a5bf1c45696fc2806e5095dac91d3d3b189401712c
Score
8/10
Malware Config
Signatures
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\EditAssert.crw => C:\Users\Admin\Pictures\EditAssert.crw.xtceymt rundll32.exe File renamed C:\Users\Admin\Pictures\FindExport.raw => C:\Users\Admin\Pictures\FindExport.raw.xtceymt rundll32.exe File renamed C:\Users\Admin\Pictures\ReadReceive.raw => C:\Users\Admin\Pictures\ReadReceive.raw.xtceymt rundll32.exe File renamed C:\Users\Admin\Pictures\CheckpointFormat.tif => C:\Users\Admin\Pictures\CheckpointFormat.tif.xtceymt rundll32.exe File opened for modification C:\Users\Admin\Pictures\CopyCompare.tiff rundll32.exe File renamed C:\Users\Admin\Pictures\CopyCompare.tiff => C:\Users\Admin\Pictures\CopyCompare.tiff.xtceymt rundll32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process PID 1284 set thread context of 0 1284 rundll32.exe PID 1284 set thread context of 0 1284 rundll32.exe PID 1284 set thread context of 0 1284 rundll32.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\9ba6acae-c8f7-4c0f-a74b-ddd7fb4831f5.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220520121904.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 5088 1284 WerFault.exe 78 -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\WasEverActivated = "1" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\WasEverActivated = "1" Process not Found -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1284 rundll32.exe 1284 rundll32.exe 5112 msedge.exe 5112 msedge.exe 4828 msedge.exe 4828 msedge.exe 2112 identity_helper.exe 2112 identity_helper.exe 4280 msedge.exe 4280 msedge.exe 4280 msedge.exe 4280 msedge.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 1284 rundll32.exe 1284 rundll32.exe 1284 rundll32.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 4828 msedge.exe 4828 msedge.exe 4828 msedge.exe 4828 msedge.exe 4828 msedge.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4828 msedge.exe 4828 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1284 wrote to memory of 1688 1284 rundll32.exe 79 PID 1284 wrote to memory of 1688 1284 rundll32.exe 79 PID 1688 wrote to memory of 4828 1688 cmd.exe 85 PID 1688 wrote to memory of 4828 1688 cmd.exe 85 PID 4828 wrote to memory of 5068 4828 msedge.exe 87 PID 4828 wrote to memory of 5068 4828 msedge.exe 87 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 3100 4828 msedge.exe 90 PID 4828 wrote to memory of 5112 4828 msedge.exe 91 PID 4828 wrote to memory of 5112 4828 msedge.exe 91 PID 4828 wrote to memory of 1008 4828 msedge.exe 92 PID 4828 wrote to memory of 1008 4828 msedge.exe 92 PID 4828 wrote to memory of 1008 4828 msedge.exe 92 PID 4828 wrote to memory of 1008 4828 msedge.exe 92 PID 4828 wrote to memory of 1008 4828 msedge.exe 92 PID 4828 wrote to memory of 1008 4828 msedge.exe 92 PID 4828 wrote to memory of 1008 4828 msedge.exe 92 PID 4828 wrote to memory of 1008 4828 msedge.exe 92 PID 4828 wrote to memory of 1008 4828 msedge.exe 92 PID 4828 wrote to memory of 1008 4828 msedge.exe 92 PID 4828 wrote to memory of 1008 4828 msedge.exe 92 PID 4828 wrote to memory of 1008 4828 msedge.exe 92 PID 4828 wrote to memory of 1008 4828 msedge.exe 92 PID 4828 wrote to memory of 1008 4828 msedge.exe 92 PID 4828 wrote to memory of 1008 4828 msedge.exe 92 PID 4828 wrote to memory of 1008 4828 msedge.exe 92
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\moavjcbg.dll,#11⤵
- Modifies extensions of user files
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\system32\cmd.execmd /c "start microsoft-edge:http://a6e4d038f0xtceymt.rowarea.info/xtceymt^&1^&38844568^&79^&403^&22190412⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:http://a6e4d038f0xtceymt.rowarea.info/xtceymt&1&38844568&79&403&22190413⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d6d446f8,0x7ff8d6d44708,0x7ff8d6d447184⤵PID:5068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,17841834508265077954,10864939263870387170,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:24⤵PID:3100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,17841834508265077954,10864939263870387170,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:5112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,17841834508265077954,10864939263870387170,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:84⤵PID:1008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17841834508265077954,10864939263870387170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:14⤵PID:3132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17841834508265077954,10864939263870387170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:14⤵PID:3512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17841834508265077954,10864939263870387170,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:14⤵PID:3632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2140,17841834508265077954,10864939263870387170,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5052 /prefetch:84⤵PID:3664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2140,17841834508265077954,10864939263870387170,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5112 /prefetch:84⤵PID:3444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17841834508265077954,10864939263870387170,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:14⤵PID:4168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17841834508265077954,10864939263870387170,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:14⤵PID:2028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,17841834508265077954,10864939263870387170,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:84⤵PID:3388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings4⤵
- Drops file in Program Files directory
PID:1688 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff70c285460,0x7ff70c285470,0x7ff70c2854805⤵PID:5020
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,17841834508265077954,10864939263870387170,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
PID:2112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2140,17841834508265077954,10864939263870387170,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3420 /prefetch:84⤵PID:2608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2140,17841834508265077954,10864939263870387170,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3812 /prefetch:84⤵PID:1456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2140,17841834508265077954,10864939263870387170,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3328 /prefetch:84⤵PID:4260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2140,17841834508265077954,10864939263870387170,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1904 /prefetch:84⤵PID:3360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2140,17841834508265077954,10864939263870387170,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4884 /prefetch:84⤵PID:4396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,17841834508265077954,10864939263870387170,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6452 /prefetch:24⤵
- Suspicious behavior: EnumeratesProcesses
PID:4280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2140,17841834508265077954,10864939263870387170,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6452 /prefetch:84⤵PID:928
-
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1284 -s 10842⤵
- Program crash
PID:5088
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 452 -p 1284 -ip 12841⤵PID:5084
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5096
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵PID:3124