Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
12-07-2022 03:04
Static task
static1
Behavioral task
behavioral1
Sample
3a810cbad7296f83122c4a16b935a723d8019419069a55c939d93c246abed2ac.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3a810cbad7296f83122c4a16b935a723d8019419069a55c939d93c246abed2ac.exe
Resource
win10v2004-20220414-en
General
-
Target
3a810cbad7296f83122c4a16b935a723d8019419069a55c939d93c246abed2ac.exe
-
Size
654KB
-
MD5
693ef59145aa6b9e329f91538855ef64
-
SHA1
e3067d7c7227af026c0abfbdf7b417c4e294f380
-
SHA256
3a810cbad7296f83122c4a16b935a723d8019419069a55c939d93c246abed2ac
-
SHA512
3f0ad7a869823d63d1867f4bf2322e88a909324bab80e7e6d8906237db0aea669326030f16a337980681cfd94c86a955ccb2747ff41be0bf75da112a53693a6b
Malware Config
Signatures
-
Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
3a810cbad7296f83122c4a16b935a723d8019419069a55c939d93c246abed2ac.exedescription ioc process File opened for modification \??\c:\Users\Admin\Pictures\StartUnlock.tiff 3a810cbad7296f83122c4a16b935a723d8019419069a55c939d93c246abed2ac.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
3a810cbad7296f83122c4a16b935a723d8019419069a55c939d93c246abed2ac.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\ykcol.bmp" 3a810cbad7296f83122c4a16b935a723d8019419069a55c939d93c246abed2ac.exe -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\2da52126-7022-41be-a8ea-f1073bc35fa1.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220712052344.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 684 vssadmin.exe -
Modifies Control Panel 2 IoCs
Processes:
3a810cbad7296f83122c4a16b935a723d8019419069a55c939d93c246abed2ac.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\Desktop\WallpaperStyle = "0" 3a810cbad7296f83122c4a16b935a723d8019419069a55c939d93c246abed2ac.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\Desktop\TileWallpaper = "0" 3a810cbad7296f83122c4a16b935a723d8019419069a55c939d93c246abed2ac.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exepid process 2296 msedge.exe 2296 msedge.exe 5004 msedge.exe 5004 msedge.exe 560 identity_helper.exe 560 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
msedge.exepid process 5004 msedge.exe 5004 msedge.exe 5004 msedge.exe 5004 msedge.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 4896 vssvc.exe Token: SeRestorePrivilege 4896 vssvc.exe Token: SeAuditPrivilege 4896 vssvc.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
msedge.exepid process 5004 msedge.exe 5004 msedge.exe 5004 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3a810cbad7296f83122c4a16b935a723d8019419069a55c939d93c246abed2ac.exemsedge.exedescription pid process target process PID 4104 wrote to memory of 5004 4104 3a810cbad7296f83122c4a16b935a723d8019419069a55c939d93c246abed2ac.exe msedge.exe PID 4104 wrote to memory of 5004 4104 3a810cbad7296f83122c4a16b935a723d8019419069a55c939d93c246abed2ac.exe msedge.exe PID 4104 wrote to memory of 2060 4104 3a810cbad7296f83122c4a16b935a723d8019419069a55c939d93c246abed2ac.exe cmd.exe PID 4104 wrote to memory of 2060 4104 3a810cbad7296f83122c4a16b935a723d8019419069a55c939d93c246abed2ac.exe cmd.exe PID 4104 wrote to memory of 2060 4104 3a810cbad7296f83122c4a16b935a723d8019419069a55c939d93c246abed2ac.exe cmd.exe PID 5004 wrote to memory of 2716 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 2716 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 596 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 2296 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 2296 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 448 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 448 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 448 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 448 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 448 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 448 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 448 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 448 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 448 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 448 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 448 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 448 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 448 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 448 5004 msedge.exe msedge.exe PID 5004 wrote to memory of 448 5004 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a810cbad7296f83122c4a16b935a723d8019419069a55c939d93c246abed2ac.exe"C:\Users\Admin\AppData\Local\Temp\3a810cbad7296f83122c4a16b935a723d8019419069a55c939d93c246abed2ac.exe"1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\ykcol.htm2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ffdd51446f8,0x7ffdd5144708,0x7ffdd51447183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11680936958105967085,15422814452988432006,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,11680936958105967085,15422814452988432006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,11680936958105967085,15422814452988432006,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11680936958105967085,15422814452988432006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11680936958105967085,15422814452988432006,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2096,11680936958105967085,15422814452988432006,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4768 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2096,11680936958105967085,15422814452988432006,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5448 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11680936958105967085,15422814452988432006,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11680936958105967085,15422814452988432006,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,11680936958105967085,15422814452988432006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff7f5125460,0x7ff7f5125470,0x7ff7f51254804⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,11680936958105967085,15422814452988432006,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5912 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\3a810cbad7296f83122c4a16b935a723d8019419069a55c939d93c246abed2ac.exe"2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /Quiet /All1⤵
- Interacts with shadow copies
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\ykcol.htmFilesize
8KB
MD569b374fafa5d5517389affaed5f711a8
SHA1db3580c69e0af4584d5c0a16b7afb2e4a5ac5c37
SHA2568f4314e59f44f4fe1f69dbd4e2b5e0eb4be30b1a1fcef20e5706248df4e805fb
SHA512effe2568c52f32caf2c2e70039a13e77c2009b2b762be1f7df35d95af52170366f92180138ea48724b4f6f160e0ac60579b8113561e7c3533bcffaba21df2016
-
\??\pipe\LOCAL\crashpad_5004_ISQAESFBZDPFFDKUMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/448-140-0x0000000000000000-mapping.dmp
-
memory/560-156-0x0000000000000000-mapping.dmp
-
memory/596-136-0x0000000000000000-mapping.dmp
-
memory/936-154-0x0000000000000000-mapping.dmp
-
memory/1084-142-0x0000000000000000-mapping.dmp
-
memory/1440-149-0x0000000000000000-mapping.dmp
-
memory/1580-144-0x0000000000000000-mapping.dmp
-
memory/2060-133-0x0000000000000000-mapping.dmp
-
memory/2296-137-0x0000000000000000-mapping.dmp
-
memory/2716-134-0x0000000000000000-mapping.dmp
-
memory/3124-153-0x0000000000000000-mapping.dmp
-
memory/3484-155-0x0000000000000000-mapping.dmp
-
memory/3504-147-0x0000000000000000-mapping.dmp
-
memory/4104-131-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4104-130-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/4216-151-0x0000000000000000-mapping.dmp
-
memory/5004-132-0x0000000000000000-mapping.dmp