Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2022 01:28
Static task
static1
Behavioral task
behavioral1
Sample
0d9f1155e01b67f833ed31fc53b291851f72813aebb38eade85e6298dccc2c07.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0d9f1155e01b67f833ed31fc53b291851f72813aebb38eade85e6298dccc2c07.exe
Resource
win10v2004-20220812-en
General
-
Target
0d9f1155e01b67f833ed31fc53b291851f72813aebb38eade85e6298dccc2c07.exe
-
Size
196KB
-
MD5
6896eae467e12451b38c706e7938e53c
-
SHA1
9510cc3adefd066d0e609595f5738b9bb5f087b6
-
SHA256
0d9f1155e01b67f833ed31fc53b291851f72813aebb38eade85e6298dccc2c07
-
SHA512
476077619e0d6fee873ea19b9e7a3e8f47ae1f2fb08d0b1942a2bab7c0dd39b7ecd0b397799756de296ab52464e954dc1e918c0a16211c0e667fa62fb04576c8
-
SSDEEP
3072:ykBJaf+pR25jB+ro+3gurKh6zPmqteqxWVT57KG8SYRdhw:yg925sroag4HU
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\196d8c63-5049-4061-93c1-904381d60212.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221011033038.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3612 msedge.exe 3612 msedge.exe 4304 msedge.exe 4304 msedge.exe 4984 identity_helper.exe 4984 identity_helper.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe 4636 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2072 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2072 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4304 msedge.exe 4304 msedge.exe 4304 msedge.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1380 0d9f1155e01b67f833ed31fc53b291851f72813aebb38eade85e6298dccc2c07.exe 1380 0d9f1155e01b67f833ed31fc53b291851f72813aebb38eade85e6298dccc2c07.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1380 wrote to memory of 4304 1380 0d9f1155e01b67f833ed31fc53b291851f72813aebb38eade85e6298dccc2c07.exe 80 PID 1380 wrote to memory of 4304 1380 0d9f1155e01b67f833ed31fc53b291851f72813aebb38eade85e6298dccc2c07.exe 80 PID 4304 wrote to memory of 4956 4304 msedge.exe 81 PID 4304 wrote to memory of 4956 4304 msedge.exe 81 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 2120 4304 msedge.exe 84 PID 4304 wrote to memory of 3612 4304 msedge.exe 85 PID 4304 wrote to memory of 3612 4304 msedge.exe 85 PID 4304 wrote to memory of 540 4304 msedge.exe 87 PID 4304 wrote to memory of 540 4304 msedge.exe 87 PID 4304 wrote to memory of 540 4304 msedge.exe 87 PID 4304 wrote to memory of 540 4304 msedge.exe 87 PID 4304 wrote to memory of 540 4304 msedge.exe 87 PID 4304 wrote to memory of 540 4304 msedge.exe 87 PID 4304 wrote to memory of 540 4304 msedge.exe 87 PID 4304 wrote to memory of 540 4304 msedge.exe 87 PID 4304 wrote to memory of 540 4304 msedge.exe 87 PID 4304 wrote to memory of 540 4304 msedge.exe 87 PID 4304 wrote to memory of 540 4304 msedge.exe 87 PID 4304 wrote to memory of 540 4304 msedge.exe 87 PID 4304 wrote to memory of 540 4304 msedge.exe 87 PID 4304 wrote to memory of 540 4304 msedge.exe 87 PID 4304 wrote to memory of 540 4304 msedge.exe 87 PID 4304 wrote to memory of 540 4304 msedge.exe 87 PID 4304 wrote to memory of 540 4304 msedge.exe 87 PID 4304 wrote to memory of 540 4304 msedge.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d9f1155e01b67f833ed31fc53b291851f72813aebb38eade85e6298dccc2c07.exe"C:\Users\Admin\AppData\Local\Temp\0d9f1155e01b67f833ed31fc53b291851f72813aebb38eade85e6298dccc2c07.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://dead-sky.forumid.net/2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa082946f8,0x7ffa08294708,0x7ffa082947183⤵PID:4956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,2906886006632609248,16791899293622693080,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:23⤵PID:2120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,2906886006632609248,16791899293622693080,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:3612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,2906886006632609248,16791899293622693080,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:83⤵PID:540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2906886006632609248,16791899293622693080,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:13⤵PID:3464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2906886006632609248,16791899293622693080,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:13⤵PID:2664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2136,2906886006632609248,16791899293622693080,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4892 /prefetch:83⤵PID:2380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2906886006632609248,16791899293622693080,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:13⤵PID:4896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2136,2906886006632609248,16791899293622693080,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5720 /prefetch:83⤵PID:3708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2906886006632609248,16791899293622693080,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:13⤵PID:4532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2906886006632609248,16791899293622693080,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:13⤵PID:520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,2906886006632609248,16791899293622693080,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6116 /prefetch:83⤵PID:2744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings3⤵
- Drops file in Program Files directory
PID:1460 -
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff633b75460,0x7ff633b75470,0x7ff633b754804⤵PID:2448
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,2906886006632609248,16791899293622693080,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6116 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:4984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,2906886006632609248,16791899293622693080,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3456 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:4636
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2fc 0x4b41⤵
- Suspicious use of AdjustPrivilegeToken
PID:2072
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3916