Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
12-07-2022 03:04
Static task
static1
Behavioral task
behavioral1
Sample
jhdsgvc74.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
jhdsgvc74.exe
Resource
win10v2004-20220414-en
General
-
Target
jhdsgvc74.exe
-
Size
654KB
-
MD5
693ef59145aa6b9e329f91538855ef64
-
SHA1
e3067d7c7227af026c0abfbdf7b417c4e294f380
-
SHA256
3a810cbad7296f83122c4a16b935a723d8019419069a55c939d93c246abed2ac
-
SHA512
3f0ad7a869823d63d1867f4bf2322e88a909324bab80e7e6d8906237db0aea669326030f16a337980681cfd94c86a955ccb2747ff41be0bf75da112a53693a6b
Malware Config
Signatures
-
Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
jhdsgvc74.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\ykcol.bmp" jhdsgvc74.exe -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\ee11c0ec-d055-4a60-916e-de9443999d06.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220712052411.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1804 vssadmin.exe -
Modifies Control Panel 2 IoCs
Processes:
jhdsgvc74.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\Desktop\WallpaperStyle = "0" jhdsgvc74.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\Desktop\TileWallpaper = "0" jhdsgvc74.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exepid process 4024 msedge.exe 4024 msedge.exe 4000 msedge.exe 4000 msedge.exe 448 identity_helper.exe 448 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
msedge.exepid process 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1732 vssvc.exe Token: SeRestorePrivilege 1732 vssvc.exe Token: SeAuditPrivilege 1732 vssvc.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
msedge.exepid process 4000 msedge.exe 4000 msedge.exe 4000 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
jhdsgvc74.exemsedge.exedescription pid process target process PID 396 wrote to memory of 4000 396 jhdsgvc74.exe msedge.exe PID 396 wrote to memory of 4000 396 jhdsgvc74.exe msedge.exe PID 396 wrote to memory of 176 396 jhdsgvc74.exe cmd.exe PID 396 wrote to memory of 176 396 jhdsgvc74.exe cmd.exe PID 396 wrote to memory of 176 396 jhdsgvc74.exe cmd.exe PID 4000 wrote to memory of 3756 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3756 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 3688 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4024 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4024 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4832 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4832 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4832 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4832 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4832 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4832 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4832 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4832 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4832 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4832 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4832 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4832 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4832 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4832 4000 msedge.exe msedge.exe PID 4000 wrote to memory of 4832 4000 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jhdsgvc74.exe"C:\Users\Admin\AppData\Local\Temp\jhdsgvc74.exe"1⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\ykcol.htm2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff89bca46f8,0x7ff89bca4708,0x7ff89bca47183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,11195458827175732410,10463426305003299095,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,11195458827175732410,10463426305003299095,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,11195458827175732410,10463426305003299095,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11195458827175732410,10463426305003299095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11195458827175732410,10463426305003299095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2144,11195458827175732410,10463426305003299095,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4804 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2144,11195458827175732410,10463426305003299095,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5772 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11195458827175732410,10463426305003299095,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11195458827175732410,10463426305003299095,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,11195458827175732410,10463426305003299095,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3504 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff79bcd5460,0x7ff79bcd5470,0x7ff79bcd54804⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,11195458827175732410,10463426305003299095,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3504 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\jhdsgvc74.exe"2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssadmin.exeC:\Windows\system32\vssadmin.exe Delete Shadows /Quiet /All1⤵
- Interacts with shadow copies
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\ykcol.htmFilesize
8KB
MD569b374fafa5d5517389affaed5f711a8
SHA1db3580c69e0af4584d5c0a16b7afb2e4a5ac5c37
SHA2568f4314e59f44f4fe1f69dbd4e2b5e0eb4be30b1a1fcef20e5706248df4e805fb
SHA512effe2568c52f32caf2c2e70039a13e77c2009b2b762be1f7df35d95af52170366f92180138ea48724b4f6f160e0ac60579b8113561e7c3533bcffaba21df2016
-
\??\pipe\LOCAL\crashpad_4000_LSVQPQDSMMIRRSEFMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/176-133-0x0000000000000000-mapping.dmp
-
memory/396-131-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/396-130-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/448-156-0x0000000000000000-mapping.dmp
-
memory/3496-153-0x0000000000000000-mapping.dmp
-
memory/3688-136-0x0000000000000000-mapping.dmp
-
memory/3756-134-0x0000000000000000-mapping.dmp
-
memory/4000-132-0x0000000000000000-mapping.dmp
-
memory/4024-137-0x0000000000000000-mapping.dmp
-
memory/4128-147-0x0000000000000000-mapping.dmp
-
memory/4500-155-0x0000000000000000-mapping.dmp
-
memory/4744-142-0x0000000000000000-mapping.dmp
-
memory/4760-151-0x0000000000000000-mapping.dmp
-
memory/4832-140-0x0000000000000000-mapping.dmp
-
memory/4920-149-0x0000000000000000-mapping.dmp
-
memory/4964-144-0x0000000000000000-mapping.dmp
-
memory/5068-154-0x0000000000000000-mapping.dmp