Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
13-07-2022 14:49
Static task
static1
Behavioral task
behavioral1
Sample
df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe
Resource
win10v2004-20220414-en
General
-
Target
df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe
-
Size
623KB
-
MD5
c24a08bfeb09c9842b8e6578d7b0b721
-
SHA1
937a77b8ad27217b346922cb5513458542e3d390
-
SHA256
df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567
-
SHA512
42717c37604b41fff2bae91a22037f0e2b1d3514a8305d672595930f331a6a998d1a88741585413977ee81cd59ab155faf19ae654d229dc0256e30d71b222799
Malware Config
Signatures
-
Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exedescription ioc process File opened for modification \??\c:\Users\Admin\Pictures\MergeJoin.tiff df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exemsedge.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\opt321 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe" df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\asasin.bmp" df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\6f769eb0-24a0-4871-bb0e-8f87ea17cb01.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220713145154.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies Control Panel 2 IoCs
Processes:
df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\Desktop\TileWallpaper = "0" df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\Desktop\WallpaperStyle = "0" df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exepid process 1612 msedge.exe 1612 msedge.exe 628 msedge.exe 628 msedge.exe 1764 identity_helper.exe 1764 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
msedge.exepid process 628 msedge.exe 628 msedge.exe 628 msedge.exe 628 msedge.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exedescription pid process Token: SeDebugPrivilege 3456 df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe Token: SeTakeOwnershipPrivilege 3456 df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe Token: SeBackupPrivilege 3456 df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe Token: SeRestorePrivilege 3456 df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
msedge.exepid process 628 msedge.exe 628 msedge.exe 628 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exemsedge.exedescription pid process target process PID 3456 wrote to memory of 628 3456 df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe msedge.exe PID 3456 wrote to memory of 628 3456 df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe msedge.exe PID 3456 wrote to memory of 4456 3456 df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe cmd.exe PID 3456 wrote to memory of 4456 3456 df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe cmd.exe PID 3456 wrote to memory of 4456 3456 df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe cmd.exe PID 628 wrote to memory of 5000 628 msedge.exe msedge.exe PID 628 wrote to memory of 5000 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 4748 628 msedge.exe msedge.exe PID 628 wrote to memory of 1612 628 msedge.exe msedge.exe PID 628 wrote to memory of 1612 628 msedge.exe msedge.exe PID 628 wrote to memory of 1724 628 msedge.exe msedge.exe PID 628 wrote to memory of 1724 628 msedge.exe msedge.exe PID 628 wrote to memory of 1724 628 msedge.exe msedge.exe PID 628 wrote to memory of 1724 628 msedge.exe msedge.exe PID 628 wrote to memory of 1724 628 msedge.exe msedge.exe PID 628 wrote to memory of 1724 628 msedge.exe msedge.exe PID 628 wrote to memory of 1724 628 msedge.exe msedge.exe PID 628 wrote to memory of 1724 628 msedge.exe msedge.exe PID 628 wrote to memory of 1724 628 msedge.exe msedge.exe PID 628 wrote to memory of 1724 628 msedge.exe msedge.exe PID 628 wrote to memory of 1724 628 msedge.exe msedge.exe PID 628 wrote to memory of 1724 628 msedge.exe msedge.exe PID 628 wrote to memory of 1724 628 msedge.exe msedge.exe PID 628 wrote to memory of 1724 628 msedge.exe msedge.exe PID 628 wrote to memory of 1724 628 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe"C:\Users\Admin\AppData\Local\Temp\df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\asasin.htm2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff87a4446f8,0x7ff87a444708,0x7ff87a4447183⤵PID:5000
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,6757219008230053318,7012215600062379034,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:23⤵PID:4748
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,6757219008230053318,7012215600062379034,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:1612 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,6757219008230053318,7012215600062379034,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:83⤵PID:1724
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6757219008230053318,7012215600062379034,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:13⤵PID:4600
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6757219008230053318,7012215600062379034,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:13⤵PID:4656
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2172,6757219008230053318,7012215600062379034,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5324 /prefetch:83⤵PID:1556
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2172,6757219008230053318,7012215600062379034,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5404 /prefetch:83⤵PID:1792
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6757219008230053318,7012215600062379034,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:13⤵PID:876
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,6757219008230053318,7012215600062379034,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:13⤵PID:1404
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,6757219008230053318,7012215600062379034,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:83⤵PID:4280
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
PID:4188 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6848a5460,0x7ff6848a5470,0x7ff6848a54804⤵PID:4792
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,6757219008230053318,7012215600062379034,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:1764 -
C:\Windows\SysWOW64\cmd.execmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\df255af635a2dde04c031db95862f11e1bf44fe5cfc10d3b20bd4678ed818567.exe"2⤵PID:4456
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2492
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD50065ee5c34b40e4fc2c91f8ca9388d46
SHA19522d1c1e91c8808698a8e3018e3233c47494042
SHA256f4c35e9b0aa9573e1d23595da435306aff64fada6f9b96068e80f7a25a2b2ecd
SHA51276ad0e473675064df9ed2e5b9b6858abe8ec7617a5110794a63e07a163330deaa8eccbb56833b94ddf01ae87d04a077e5e60a57f79f0c3075c58e2c9fb12d128
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e