d1fb85e63f1d1b46efaf9790fec6157ae1fc169d8b4a05290ebdff0205dcac1e

Resubmissions

16/10/2022, 22:57

221016-2xmyfaaddp 8

16/10/2022, 22:50

221016-2sk82sada9 1

Analysis

max time kernel
117s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
16/10/2022, 22:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SpyHunter by windowsactivation.net.rar
Size

3.0MB
MD5

767feaffce5aa556d4dfe68be2e7bb45
SHA1

43d74e509e15b2961a15d924abf2294b918537a8
SHA256

d1fb85e63f1d1b46efaf9790fec6157ae1fc169d8b4a05290ebdff0205dcac1e
SHA512

fc3ae140c6829d828ab9faed903533c9f857307a5f279ba95b764f4a19f4bb59da1110561e6ac278567b34291a1280141fc12d92fd06886283c0c374777c1a2d
SSDEEP

49152:OY8JwzJ9M6oZ+gv6FjRAeYt7pkaTWRZ4B/e6dJhAiNyH7vlrXCNGozvN5d:OY8GzJ9/k+giFXWpkv0J/kUyHZbwvN

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
912	SpyHunter by windowsactivation.net.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\fb73d4a7-5174-422a-b2bd-331191e58096.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221017005910.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4904	msedge.exe
4904	msedge.exe
560	msedge.exe
560	msedge.exe
5228	identity_helper.exe
5228	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeRestorePrivilege	756	7zG.exe
Token: 35	756	7zG.exe
Token: SeSecurityPrivilege	756	7zG.exe
Token: SeSecurityPrivilege	756	7zG.exe
Token: SeShutdownPrivilege	912	SpyHunter by windowsactivation.net.exe
Token: SeBackupPrivilege	912	SpyHunter by windowsactivation.net.exe
Token: SeRestorePrivilege	912	SpyHunter by windowsactivation.net.exe
Token: SeDebugPrivilege	912	SpyHunter by windowsactivation.net.exe
Token: SeTakeOwnershipPrivilege	912	SpyHunter by windowsactivation.net.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
756	7zG.exe
912	SpyHunter by windowsactivation.net.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe
560	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2232	OpenWith.exe
912	SpyHunter by windowsactivation.net.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 2024	560	msedge.exe	106
PID 560 wrote to memory of 2024	560	msedge.exe	106
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4104	560	msedge.exe	107
PID 560 wrote to memory of 4904	560	msedge.exe	108
PID 560 wrote to memory of 4904	560	msedge.exe	108
PID 560 wrote to memory of 1124	560	msedge.exe	109
PID 560 wrote to memory of 1124	560	msedge.exe	109
PID 560 wrote to memory of 1124	560	msedge.exe	109
PID 560 wrote to memory of 1124	560	msedge.exe	109
PID 560 wrote to memory of 1124	560	msedge.exe	109
PID 560 wrote to memory of 1124	560	msedge.exe	109
PID 560 wrote to memory of 1124	560	msedge.exe	109
PID 560 wrote to memory of 1124	560	msedge.exe	109
PID 560 wrote to memory of 1124	560	msedge.exe	109
PID 560 wrote to memory of 1124	560	msedge.exe	109
PID 560 wrote to memory of 1124	560	msedge.exe	109
PID 560 wrote to memory of 1124	560	msedge.exe	109
PID 560 wrote to memory of 1124	560	msedge.exe	109
PID 560 wrote to memory of 1124	560	msedge.exe	109
PID 560 wrote to memory of 1124	560	msedge.exe	109
PID 560 wrote to memory of 1124	560	msedge.exe	109
PID 560 wrote to memory of 1124	560	msedge.exe	109
PID 560 wrote to memory of 1124	560	msedge.exe	109
PID 560 wrote to memory of 1124	560	msedge.exe	109
PID 560 wrote to memory of 1124	560	msedge.exe	109

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\SpyHunter by windowsactivation.net.rar"
1⤵
- Modifies registry class
PID:3796

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2232

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5084

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\SpyHunter by windowsactivation.net\" -spe -an -ai#7zMap16614:126:7zEvent23114
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:756

C:\Users\Admin\Desktop\SpyHunter by windowsactivation.net\SpyHunter by windowsactivation.net.exe
"C:\Users\Admin\Desktop\SpyHunter by windowsactivation.net\SpyHunter by windowsactivation.net.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://windowsactivation.net/
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa794046f8,0x7ffa79404708,0x7ffa79404718
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,6509830605469896739,12609999398001555819,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,6509830605469896739,12609999398001555819,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,6509830605469896739,12609999398001555819,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6509830605469896739,12609999398001555819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6509830605469896739,12609999398001555819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2116,6509830605469896739,12609999398001555819,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4576 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6509830605469896739,12609999398001555819,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6509830605469896739,12609999398001555819,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2116,6509830605469896739,12609999398001555819,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6509830605469896739,12609999398001555819,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6509830605469896739,12609999398001555819,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,6509830605469896739,12609999398001555819,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff751e35460,0x7ff751e35470,0x7ff751e35480
    3⤵
    PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,6509830605469896739,12609999398001555819,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3440

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\SpyHunter by windowsactivation.net\SpyHunter by windowsactivation.net.exe

Filesize
6.2MB

MD5
7e47be258b69eaadd7341aeaca43959a

SHA1
2159b3bf9360ae6b4028efab6963d49dded0820a

SHA256
9996c01d79ce10f82189ef43f069c7440178f3051ba49e40c9a6f7dbf6b5a268

SHA512
8dddbf4f9b300e30500a05e37054a0f50dd47687bbb7b7ac0d8c0af11b5534ec278e09d761ca1fdec3a059350eee637312c664d7a0821c9eee61437ad0512009

Download Submit
C:\Users\Admin\Desktop\SpyHunter by windowsactivation.net\SpyHunter by windowsactivation.net.exe

Filesize
6.2MB

MD5
7e47be258b69eaadd7341aeaca43959a

SHA1
2159b3bf9360ae6b4028efab6963d49dded0820a

SHA256
9996c01d79ce10f82189ef43f069c7440178f3051ba49e40c9a6f7dbf6b5a268

SHA512
8dddbf4f9b300e30500a05e37054a0f50dd47687bbb7b7ac0d8c0af11b5534ec278e09d761ca1fdec3a059350eee637312c664d7a0821c9eee61437ad0512009

Download Submit