Analysis
-
max time kernel
152s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 18:43
Behavioral task
behavioral1
Sample
5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe
Resource
win7-20221111-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe
-
Size
236KB
-
MD5
27a36e1bb00e90d39f7cd5c9d82044e4
-
SHA1
67a2e4376d033ca501dfa173f9e5b7c976bf367d
-
SHA256
5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc
-
SHA512
4421e3dcdcd36024a20e4efa3debc346c492f3d152003d7b62e243a122b8563b2cf6486479462a91efdb15d2404f6773643473c14b91feb14bbe21df65da3874
-
SSDEEP
6144:lgoGzqvDnZEXFh616dztucoavGwHoMihDM6LcA:lgNyDn+W16ScfeW
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3688-132-0x0000000000400000-0x000000000047C000-memory.dmp vmprotect behavioral2/memory/3688-133-0x0000000000400000-0x000000000047C000-memory.dmp vmprotect behavioral2/memory/3688-137-0x0000000000400000-0x000000000047C000-memory.dmp vmprotect -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ads2.exe 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe File opened for modification C:\Windows\SysWOW64\ads3.exe 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe File opened for modification C:\Windows\SysWOW64\ads.exe 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe Token: SeDebugPrivilege 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe Token: SeDebugPrivilege 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe Token: SeDebugPrivilege 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe Token: SeDebugPrivilege 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe Token: SeDebugPrivilege 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3688 wrote to memory of 2184 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 89 PID 3688 wrote to memory of 2184 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 89 PID 3688 wrote to memory of 2184 3688 5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe 89 PID 1508 wrote to memory of 2124 1508 explorer.exe 91 PID 1508 wrote to memory of 2124 1508 explorer.exe 91 PID 2124 wrote to memory of 2640 2124 msedge.exe 93 PID 2124 wrote to memory of 2640 2124 msedge.exe 93 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 2976 2124 msedge.exe 94 PID 2124 wrote to memory of 1688 2124 msedge.exe 95 PID 2124 wrote to memory of 1688 2124 msedge.exe 95 PID 2124 wrote to memory of 4892 2124 msedge.exe 96 PID 2124 wrote to memory of 4892 2124 msedge.exe 96 PID 2124 wrote to memory of 4892 2124 msedge.exe 96 PID 2124 wrote to memory of 4892 2124 msedge.exe 96 PID 2124 wrote to memory of 4892 2124 msedge.exe 96 PID 2124 wrote to memory of 4892 2124 msedge.exe 96 PID 2124 wrote to memory of 4892 2124 msedge.exe 96 PID 2124 wrote to memory of 4892 2124 msedge.exe 96 PID 2124 wrote to memory of 4892 2124 msedge.exe 96 PID 2124 wrote to memory of 4892 2124 msedge.exe 96 PID 2124 wrote to memory of 4892 2124 msedge.exe 96 PID 2124 wrote to memory of 4892 2124 msedge.exe 96 PID 2124 wrote to memory of 4892 2124 msedge.exe 96 PID 2124 wrote to memory of 4892 2124 msedge.exe 96 PID 2124 wrote to memory of 4892 2124 msedge.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe"C:\Users\Admin\AppData\Local\Temp\5d38e3e9a2244d40bc750cf13e725dc135f57a12137d868a322d4931159675dc.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\SysWOW64\Explorer.exeExplorer http://danchoigame.googlecode.com/svn/trunk/cf/AimBot_HeadshotCF.zip2⤵PID:2184
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://danchoigame.googlecode.com/svn/trunk/cf/AimBot_HeadshotCF.zip2⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa4b7046f8,0x7ffa4b704708,0x7ffa4b7047183⤵PID:2640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,3075959654642710943,2869936561518791878,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:23⤵PID:2976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,3075959654642710943,2869936561518791878,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:33⤵PID:1688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,3075959654642710943,2869936561518791878,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:83⤵PID:4892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3075959654642710943,2869936561518791878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:13⤵PID:2504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3075959654642710943,2869936561518791878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:13⤵PID:2476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2112,3075959654642710943,2869936561518791878,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5340 /prefetch:83⤵PID:2084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3075959654642710943,2869936561518791878,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:13⤵PID:1060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3075959654642710943,2869936561518791878,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1740 /prefetch:13⤵PID:1940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2112,3075959654642710943,2869936561518791878,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4972 /prefetch:83⤵PID:988
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1504