ae6287c078c5c6426a12723e67951ce1820a0eb1af1c176a1d3fecc7a699614a

Analysis

max time kernel
162s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 12:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae6287c078c5c6426a12723e67951ce1820a0eb1af1c176a1d3fecc7a699614a.dll
Size

666KB
MD5

a500d3575e09c282cc97b9d60d5270c6
SHA1

9926800d8436264b7d78b45f41ed071f3469aaa8
SHA256

ae6287c078c5c6426a12723e67951ce1820a0eb1af1c176a1d3fecc7a699614a
SHA512

6cdafad189a8e5cfe5fe05c62b28120d0c69296570b0d3317e9196324255cf045b1d18614ef89e8f34891987584159796499b30b1dee69252ddad097d2e92f99
SSDEEP

12288:UBPgEfxixsIbWME80+YAKK54ygTGI0JwT8TOG6V4W8KorWeIqZxS2sBxcHQgEyqW:UBAbWME80vAxHgTuyTuOGiF8rqePW2lz

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4344 set thread context of 4044	4344	rundll32.exe	80

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\871813d2-2d70-4960-bfe8-8cc31ea0921a.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221125202023.pma	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4344	rundll32.exe
4344	rundll32.exe
1184	msedge.exe
1184	msedge.exe
4924	msedge.exe
4924	msedge.exe
1504	identity_helper.exe
1504	identity_helper.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4924	msedge.exe
4924	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 4344	904	rundll32.exe	79
PID 904 wrote to memory of 4344	904	rundll32.exe	79
PID 904 wrote to memory of 4344	904	rundll32.exe	79
PID 4344 wrote to memory of 4044	4344	rundll32.exe	80
PID 4344 wrote to memory of 4044	4344	rundll32.exe	80
PID 4344 wrote to memory of 4044	4344	rundll32.exe	80
PID 4344 wrote to memory of 4044	4344	rundll32.exe	80
PID 4344 wrote to memory of 4044	4344	rundll32.exe	80
PID 4044 wrote to memory of 4924	4044	svchost.exe	81
PID 4044 wrote to memory of 4924	4044	svchost.exe	81
PID 4924 wrote to memory of 4908	4924	msedge.exe	82
PID 4924 wrote to memory of 4908	4924	msedge.exe	82
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 112	4924	msedge.exe	86
PID 4924 wrote to memory of 1184	4924	msedge.exe	87
PID 4924 wrote to memory of 1184	4924	msedge.exe	87
PID 4924 wrote to memory of 3568	4924	msedge.exe	88
PID 4924 wrote to memory of 3568	4924	msedge.exe	88
PID 4924 wrote to memory of 3568	4924	msedge.exe	88
PID 4924 wrote to memory of 3568	4924	msedge.exe	88
PID 4924 wrote to memory of 3568	4924	msedge.exe	88
PID 4924 wrote to memory of 3568	4924	msedge.exe	88
PID 4924 wrote to memory of 3568	4924	msedge.exe	88
PID 4924 wrote to memory of 3568	4924	msedge.exe	88
PID 4924 wrote to memory of 3568	4924	msedge.exe	88
PID 4924 wrote to memory of 3568	4924	msedge.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae6287c078c5c6426a12723e67951ce1820a0eb1af1c176a1d3fecc7a699614a.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ae6287c078c5c6426a12723e67951ce1820a0eb1af1c176a1d3fecc7a699614a.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.java.com/pt_BR/
      4⤵
      Adds Run key to start application
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ffdcff546f8,0x7ffdcff54708,0x7ffdcff54718
        5⤵
        
        PID:4908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,5982460084997016021,4760238521445156293,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
        5⤵
        
        PID:112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,5982460084997016021,4760238521445156293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1184
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,5982460084997016021,4760238521445156293,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 /prefetch:8
        5⤵
        
        PID:3568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5982460084997016021,4760238521445156293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
        5⤵
        
        PID:2712
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5982460084997016021,4760238521445156293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
        5⤵
        
        PID:372
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2136,5982460084997016021,4760238521445156293,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4264 /prefetch:8
        5⤵
        
        PID:5020
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5982460084997016021,4760238521445156293,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
        5⤵
        
        PID:1864
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5982460084997016021,4760238521445156293,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
        5⤵
        
        PID:4156
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2136,5982460084997016021,4760238521445156293,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5508 /prefetch:8
        5⤵
        
        PID:2240
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5982460084997016021,4760238521445156293,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
        5⤵
        
        PID:4984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,5982460084997016021,4760238521445156293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6016 /prefetch:8
        5⤵
        
        PID:4644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
        5⤵
        Drops file in Program Files directory
        
        PID:2768
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6b5425460,0x7ff6b5425470,0x7ff6b5425480
        6⤵
        
        PID:3960
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,5982460084997016021,4760238521445156293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6016 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1504
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5982460084997016021,4760238521445156293,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:1
        5⤵
        
        PID:4172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2136,5982460084997016021,4760238521445156293,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4848 /prefetch:8
        5⤵
        
        PID:3812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,5982460084997016021,4760238521445156293,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1884 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3480

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\image.gif

Filesize
1022B

MD5
e8f7fdb9e108ee44039f52e157b43a10

SHA1
51e6bebebe0ac865c065eb9a6c3fd41f6c3c3c70

SHA256
d5a320d22071d9907e6c456b83b422978db1bc7474274ee4afd5bcbf6f5fd0c2

SHA512
aed5b60b7e777655d4c88b56c77fefe7dede00b4ca5f17dbfbbbb60897133f520391dc6fefd9e5a65fdfb6c00b12aa806d4ba60a442f5bbb280ca31cafc8879e

Download Submit
memory/112-144-0x0000000000000000-mapping.dmp

Download
memory/372-152-0x0000000000000000-mapping.dmp

Download
memory/1184-145-0x0000000000000000-mapping.dmp

Download
memory/1504-165-0x0000000000000000-mapping.dmp

Download
memory/1864-156-0x0000000000000000-mapping.dmp

Download
memory/2240-160-0x0000000000000000-mapping.dmp

Download
memory/2592-170-0x0000000000000000-mapping.dmp

Download
memory/2712-150-0x0000000000000000-mapping.dmp

Download
memory/2768-163-0x0000000000000000-mapping.dmp

Download
memory/3568-148-0x0000000000000000-mapping.dmp

Download
memory/3812-169-0x0000000000000000-mapping.dmp

Download
memory/3960-164-0x0000000000000000-mapping.dmp

Download
memory/4044-139-0x0000000008C60000-0x0000000008CBF000-memory.dmp

Filesize
380KB

Download
memory/4044-133-0x0000000000000000-mapping.dmp

Download
memory/4044-142-0x0000000008C60000-0x0000000008CBF000-memory.dmp

Filesize
380KB

Download
memory/4044-134-0x0000000008C60000-0x0000000008CBF000-memory.dmp

Filesize
380KB

Download
memory/4044-137-0x0000000008C60000-0x0000000008CBF000-memory.dmp

Filesize
380KB

Download
memory/4044-136-0x0000000008C60000-0x0000000008CBF000-memory.dmp

Filesize
380KB

Download
memory/4156-158-0x0000000000000000-mapping.dmp

Download
memory/4172-167-0x0000000000000000-mapping.dmp

Download
memory/4344-132-0x0000000000000000-mapping.dmp

Download
memory/4344-135-0x0000000005F30000-0x0000000006039000-memory.dmp

Filesize
1.0MB

Download
memory/4908-141-0x0000000000000000-mapping.dmp

Download
memory/4924-140-0x0000000000000000-mapping.dmp

Download
memory/4984-162-0x0000000000000000-mapping.dmp

Download
memory/5020-154-0x0000000000000000-mapping.dmp

Download