Analysis
-
max time kernel
161s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11-09-2022 12:47
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20220812-en
General
-
Target
Setup.exe
-
Size
370.9MB
-
MD5
caceb6578e7a4d3011ea97c9d1a693c0
-
SHA1
9d161e2ec7ecad49fed29e43fd8b04afad11e11d
-
SHA256
f09c16eea97b9e4733ad58653a92b7f4a1ce00556a91ca83d2013153f6ff0e59
-
SHA512
5200fb2d9a7654145977e1fbba6a9a77ba026e50523614111a0bfdd0a1eb63043546ee90ec38774aaeeeefdb8fd71e5c9be24d8463fc9bd540b3c15eca49fcdd
-
SSDEEP
98304:PSZWVxMgSBX6E1BwA26/JQtm111+kZNyLwd/nM2Stzv//PK3cS6i7zsnBW:qW2Hz726xQUakZNy8VMDVv/cr68ABW
Malware Config
Extracted
vidar
53.3
1281
http://185.53.46.199:80
http://77.75.230.119:80
http://5.252.23.43:80
-
profile_id
1281
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
Setup.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Setup.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Setup.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Setup.exe -
Processes:
resource yara_rule behavioral2/memory/4356-132-0x0000000000420000-0x000000000108E000-memory.dmp themida behavioral2/memory/4356-133-0x0000000000420000-0x000000000108E000-memory.dmp themida behavioral2/memory/4356-138-0x0000000000420000-0x000000000108E000-memory.dmp themida behavioral2/memory/4356-139-0x0000000000420000-0x000000000108E000-memory.dmp themida behavioral2/memory/4356-140-0x0000000000420000-0x000000000108E000-memory.dmp themida behavioral2/memory/4356-141-0x0000000000420000-0x000000000108E000-memory.dmp themida behavioral2/memory/4356-143-0x0000000000420000-0x000000000108E000-memory.dmp themida behavioral2/memory/4356-144-0x0000000000420000-0x000000000108E000-memory.dmp themida behavioral2/memory/4356-145-0x0000000000420000-0x000000000108E000-memory.dmp themida -
Processes:
Setup.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Setup.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Setup.exepid process 4356 Setup.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
Setup.exemsedge.exemsedge.exepid process 4356 Setup.exe 4356 Setup.exe 4356 Setup.exe 4356 Setup.exe 4084 msedge.exe 4084 msedge.exe 1004 msedge.exe 1004 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
msedge.exepid process 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
Processes:
msedge.exepid process 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe -
Suspicious use of SendNotifyMessage 16 IoCs
Processes:
msedge.exepid process 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1004 wrote to memory of 4412 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 4412 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 2428 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 4084 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 4084 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 1988 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 1988 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 1988 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 1988 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 1988 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 1988 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 1988 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 1988 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 1988 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 1988 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 1988 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 1988 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 1988 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 1988 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 1988 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 1988 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 1988 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 1988 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 1988 1004 msedge.exe msedge.exe PID 1004 wrote to memory of 1988 1004 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8ccd946f8,0x7ff8ccd94708,0x7ff8ccd947182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,11974686358881645736,13296271563072822087,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2284 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,11974686358881645736,13296271563072822087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,11974686358881645736,13296271563072822087,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,11974686358881645736,13296271563072822087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3756 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,11974686358881645736,13296271563072822087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4320 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,11974686358881645736,13296271563072822087,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4352 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2176,11974686358881645736,13296271563072822087,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5328 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2176,11974686358881645736,13296271563072822087,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5844 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,11974686358881645736,13296271563072822087,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:12⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\pipe\LOCAL\crashpad_1004_ZMOOSSFCNHXVILGHMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1256-157-0x0000000000000000-mapping.dmp
-
memory/1260-163-0x0000000000000000-mapping.dmp
-
memory/1988-153-0x0000000000000000-mapping.dmp
-
memory/2428-149-0x0000000000000000-mapping.dmp
-
memory/3428-159-0x0000000000000000-mapping.dmp
-
memory/3720-155-0x0000000000000000-mapping.dmp
-
memory/4084-150-0x0000000000000000-mapping.dmp
-
memory/4356-142-0x0000000077080000-0x0000000077223000-memory.dmpFilesize
1.6MB
-
memory/4356-132-0x0000000000420000-0x000000000108E000-memory.dmpFilesize
12.4MB
-
memory/4356-146-0x0000000077080000-0x0000000077223000-memory.dmpFilesize
1.6MB
-
memory/4356-133-0x0000000000420000-0x000000000108E000-memory.dmpFilesize
12.4MB
-
memory/4356-144-0x0000000000420000-0x000000000108E000-memory.dmpFilesize
12.4MB
-
memory/4356-143-0x0000000000420000-0x000000000108E000-memory.dmpFilesize
12.4MB
-
memory/4356-141-0x0000000000420000-0x000000000108E000-memory.dmpFilesize
12.4MB
-
memory/4356-145-0x0000000000420000-0x000000000108E000-memory.dmpFilesize
12.4MB
-
memory/4356-140-0x0000000000420000-0x000000000108E000-memory.dmpFilesize
12.4MB
-
memory/4356-139-0x0000000000420000-0x000000000108E000-memory.dmpFilesize
12.4MB
-
memory/4356-138-0x0000000000420000-0x000000000108E000-memory.dmpFilesize
12.4MB
-
memory/4412-147-0x0000000000000000-mapping.dmp
-
memory/4728-165-0x0000000000000000-mapping.dmp
-
memory/5076-161-0x0000000000000000-mapping.dmp