Analysis
-
max time kernel
67s -
max time network
69s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28/09/2022, 10:09
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ac2lvn64s7f5lpkdepqds4xz7ina_29.5/imefjhfbkmcmebodilednhmaccmincoa_29.5_win_jh7q2vuithpfj4nzyqie45weie.crx3
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ac2lvn64s7f5lpkdepqds4xz7ina_29.5/imefjhfbkmcmebodilednhmaccmincoa_29.5_win_jh7q2vuithpfj4nzyqie45weie.crx3
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ac2lvn64s7f5lpkdepqds4xz7ina_29.5/imefjhfbkmcmebodilednhmaccmincoa_29.5_win_jh7q2vuithpfj4nzyqie45weie.crx3
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = a041c63f33d3d801 iexplore.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 706a105233d3d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a300000000020000000000106600000001000020000000de92f5f7bc0a2360f5defa674b777f09b0a44aac05b389d8dc8f452c484e8da7000000000e800000000200002000000022857959e77e28c259df8bb78cc521efbc789802a6b87824ff0a13f0cdd89528200000008b76b12c4d144d596dc3a0f1d5c2b66c6125241933479123b032969e34eaf86240000000a9f9166c386a9c4c6d61f907dfff1cb36de041aa3f7bcb980aeddf1af01ed64cb2415c7bb2f02e3c9f549d35daaa656d110128c5eff99e5a0ec46589bd851f79 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{78B7C511-3F26-11ED-991C-C6F54D7498C3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a300000000020000000000106600000001000020000000dfe18715b115f9e2434cf88096921c4dbddc5e77b00f9949d8ab07b6d45a2027000000000e80000000020000200000007cef066462360bf5a87448d2614d020e153905fa429ce1c34c8eb45a429a3df590000000285e93d7173ad75603b1ff917ee34dfd1e92f3c7dbe209fc2313803b031eb51b50f203a8bd7b4ad041d5e356c6626c6607997b172db13345cc78d01bf52d694668fe1a5baca28489ea7d13b86bc25bd91201ac37fe2c4a88a94ba890abf177c298358b3448205059741e54c9665cf25c8c3532e5e8aa3428dfaab784901b379dc51726e122e1ad5d9985cdf70be5b60b40000000917fe881c4ce056633bf3fea7937d9afd72652f1f981827d0ecd4eff218c1c7b6268e3005af981b52311bf12b635877fedc26bccc4d13510fe325b28e0033125 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371131974" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Modifies registry class 13 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\crx3_auto_file\shell\open rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\crx3_auto_file\shell\open\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\crx3_auto_file\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" %1" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\crx3_auto_file\shell\open\CommandId = "IE.File" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\crx3_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\crx3_auto_file\shell\open\command\DelegateExecute = "{17FE9752-0B5A-4665-84CD-569794602F5C}" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\crx3_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\crx3_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.crx3 rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.crx3\ = "crx3_auto_file" rundll32.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 1404 NOTEPAD.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 832 iexplore.exe -
Suspicious use of FindShellTrayWindow 10 IoCs
pid Process 832 iexplore.exe 832 iexplore.exe 832 iexplore.exe 832 iexplore.exe 832 iexplore.exe 832 iexplore.exe 832 iexplore.exe 832 iexplore.exe 832 iexplore.exe 832 iexplore.exe -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 832 iexplore.exe 832 iexplore.exe 1740 IEXPLORE.EXE 1740 IEXPLORE.EXE 832 iexplore.exe 832 iexplore.exe 1740 IEXPLORE.EXE 1740 IEXPLORE.EXE 832 iexplore.exe 832 iexplore.exe 1740 IEXPLORE.EXE 1740 IEXPLORE.EXE 832 iexplore.exe 832 iexplore.exe 1740 IEXPLORE.EXE 1740 IEXPLORE.EXE 832 iexplore.exe 832 iexplore.exe 1740 IEXPLORE.EXE 1740 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 832 wrote to memory of 1740 832 iexplore.exe 28 PID 832 wrote to memory of 1740 832 iexplore.exe 28 PID 832 wrote to memory of 1740 832 iexplore.exe 28 PID 832 wrote to memory of 1740 832 iexplore.exe 28 PID 832 wrote to memory of 1296 832 iexplore.exe 30 PID 832 wrote to memory of 1296 832 iexplore.exe 30 PID 832 wrote to memory of 1296 832 iexplore.exe 30 PID 1296 wrote to memory of 836 1296 rundll32.exe 31 PID 1296 wrote to memory of 836 1296 rundll32.exe 31 PID 1296 wrote to memory of 836 1296 rundll32.exe 31 PID 832 wrote to memory of 1596 832 iexplore.exe 33 PID 832 wrote to memory of 1596 832 iexplore.exe 33 PID 832 wrote to memory of 1596 832 iexplore.exe 33 PID 832 wrote to memory of 1320 832 iexplore.exe 34 PID 832 wrote to memory of 1320 832 iexplore.exe 34 PID 832 wrote to memory of 1320 832 iexplore.exe 34 PID 832 wrote to memory of 1712 832 iexplore.exe 35 PID 832 wrote to memory of 1712 832 iexplore.exe 35 PID 832 wrote to memory of 1712 832 iexplore.exe 35 PID 832 wrote to memory of 1404 832 iexplore.exe 36 PID 832 wrote to memory of 1404 832 iexplore.exe 36 PID 832 wrote to memory of 1404 832 iexplore.exe 36
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ac2lvn64s7f5lpkdepqds4xz7ina_29.5/imefjhfbkmcmebodilednhmaccmincoa_29.5_win_jh7q2vuithpfj4nzyqie45weie.crx31⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:832 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1740
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Downloads\imefjhfbkmcmebodilednhmaccmincoa_29.5_win_jh7q2vuithpfj4nzyqie45weie.crx32⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\imefjhfbkmcmebodilednhmaccmincoa_29.5_win_jh7q2vuithpfj4nzyqie45weie.crx33⤵PID:836
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\imefjhfbkmcmebodilednhmaccmincoa_29.5_win_jh7q2vuithpfj4nzyqie45weie.crx32⤵PID:1596
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\imefjhfbkmcmebodilednhmaccmincoa_29.5_win_jh7q2vuithpfj4nzyqie45weie.crx32⤵PID:1320
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\imefjhfbkmcmebodilednhmaccmincoa_29.5_win_jh7q2vuithpfj4nzyqie45weie (1).crx32⤵PID:1712
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\imefjhfbkmcmebodilednhmaccmincoa_29.5_win_jh7q2vuithpfj4nzyqie45weie (1).crx32⤵
- Opens file in notepad (likely ransom note)
PID:1404
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
607B
MD52fd33e9c8db20c51bb63224fb8a96875
SHA1110bbebdf82fe647fe5bd3dcada989db5159d91a
SHA25605f7bdf36e07ed4df7a82da19f9fb53afcc6fd22fa2d43687ed490816e83f120
SHA512707400e4e555e3891e9f8864a09e453d536de99f96da9867b7d5fc90cf3ea6eb09838a91bb3273553c2686acd7a8b30c2719f1c804690ae78810d304580b2ff5
-
C:\Users\Admin\Downloads\imefjhfbkmcmebodilednhmaccmincoa_29.5_win_jh7q2vuithpfj4nzyqie45weie (1).crx3
Filesize2.4MB
MD5fc698d259830c3afb1196cf31af77793
SHA1d825c924bdaed55bbd5149488b5520dc6772a460
SHA256d63a8455583691741392f5ddca600bb71affa34c25af5c1bbe4fb197d353344a
SHA512d27907e4adc3066704ac447b9742887ce7d2b2cdad69772971fd1246a4e3b8b63f6b45010ac300eb5ea0c6018e926bbd03e35328b674664ddf9ec37494d0b56f
-
C:\Users\Admin\Downloads\imefjhfbkmcmebodilednhmaccmincoa_29.5_win_jh7q2vuithpfj4nzyqie45weie.crx3.8y7pvv2.partial
Filesize2.4MB
MD5fc698d259830c3afb1196cf31af77793
SHA1d825c924bdaed55bbd5149488b5520dc6772a460
SHA256d63a8455583691741392f5ddca600bb71affa34c25af5c1bbe4fb197d353344a
SHA512d27907e4adc3066704ac447b9742887ce7d2b2cdad69772971fd1246a4e3b8b63f6b45010ac300eb5ea0c6018e926bbd03e35328b674664ddf9ec37494d0b56f