a73c10f2c375d830c5e3aed90d8b882b4db0889a3bc91b2470b12a7d2f27294f

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 09:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a73c10f2c375d830c5e3aed90d8b882b4db0889a3bc91b2470b12a7d2f27294f.exe
Size

1.3MB
MD5

c3d30084a9ea776e17f163ed9c5f7c7e
SHA1

780d6e66a436933b953c50ad0edf228614eab801
SHA256

a73c10f2c375d830c5e3aed90d8b882b4db0889a3bc91b2470b12a7d2f27294f
SHA512

a8bb8b93b118a76c9715dfbf2fdc746a0e25e15d970d0daa86df2a90975a70ef742c8a6a516a100b02705c0d66b214467db6815c56bbc9909dda181130e8f14b
SSDEEP

24576:UZPG5P9HJ7HEnp+J/DgeKZ/OPXKonpKeW7sPti0t:U8x9EnO/MeA/OPXrnQQtim

Score

8^/10

persistence upx

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	a73c10f2c375d830c5e3aed90d8b882b4db0889a3bc91b2470b12a7d2f27294f.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4372-132-0x0000000018040000-0x000000001825B000-memory.dmp	upx
behavioral2/memory/4372-133-0x0000000018040000-0x000000001825B000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\5dc2a2e5-3b21-4cfa-b8ea-bfb6368fdbe7.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221209150656.pma	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	a73c10f2c375d830c5e3aed90d8b882b4db0889a3bc91b2470b12a7d2f27294f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	a73c10f2c375d830c5e3aed90d8b882b4db0889a3bc91b2470b12a7d2f27294f.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\IESettingSync	a73c10f2c375d830c5e3aed90d8b882b4db0889a3bc91b2470b12a7d2f27294f.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	a73c10f2c375d830c5e3aed90d8b882b4db0889a3bc91b2470b12a7d2f27294f.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1172	msedge.exe
1172	msedge.exe
1704	msedge.exe
1704	msedge.exe
4240	identity_helper.exe
4240	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe
1704	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1704	msedge.exe
1704	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4372	a73c10f2c375d830c5e3aed90d8b882b4db0889a3bc91b2470b12a7d2f27294f.exe
4372	a73c10f2c375d830c5e3aed90d8b882b4db0889a3bc91b2470b12a7d2f27294f.exe
4372	a73c10f2c375d830c5e3aed90d8b882b4db0889a3bc91b2470b12a7d2f27294f.exe
4372	a73c10f2c375d830c5e3aed90d8b882b4db0889a3bc91b2470b12a7d2f27294f.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 1704	4372	a73c10f2c375d830c5e3aed90d8b882b4db0889a3bc91b2470b12a7d2f27294f.exe	82
PID 4372 wrote to memory of 1704	4372	a73c10f2c375d830c5e3aed90d8b882b4db0889a3bc91b2470b12a7d2f27294f.exe	82
PID 1704 wrote to memory of 3404	1704	msedge.exe	83
PID 1704 wrote to memory of 3404	1704	msedge.exe	83
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 2160	1704	msedge.exe	91
PID 1704 wrote to memory of 1172	1704	msedge.exe	92
PID 1704 wrote to memory of 1172	1704	msedge.exe	92
PID 1704 wrote to memory of 3588	1704	msedge.exe	94
PID 1704 wrote to memory of 3588	1704	msedge.exe	94
PID 1704 wrote to memory of 3588	1704	msedge.exe	94
PID 1704 wrote to memory of 3588	1704	msedge.exe	94
PID 1704 wrote to memory of 3588	1704	msedge.exe	94
PID 1704 wrote to memory of 3588	1704	msedge.exe	94
PID 1704 wrote to memory of 3588	1704	msedge.exe	94
PID 1704 wrote to memory of 3588	1704	msedge.exe	94
PID 1704 wrote to memory of 3588	1704	msedge.exe	94
PID 1704 wrote to memory of 3588	1704	msedge.exe	94
PID 1704 wrote to memory of 3588	1704	msedge.exe	94
PID 1704 wrote to memory of 3588	1704	msedge.exe	94
PID 1704 wrote to memory of 3588	1704	msedge.exe	94
PID 1704 wrote to memory of 3588	1704	msedge.exe	94
PID 1704 wrote to memory of 3588	1704	msedge.exe	94
PID 1704 wrote to memory of 3588	1704	msedge.exe	94
PID 1704 wrote to memory of 3588	1704	msedge.exe	94
PID 1704 wrote to memory of 3588	1704	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\a73c10f2c375d830c5e3aed90d8b882b4db0889a3bc91b2470b12a7d2f27294f.exe
"C:\Users\Admin\AppData\Local\Temp\a73c10f2c375d830c5e3aed90d8b882b4db0889a3bc91b2470b12a7d2f27294f.exe"
1⤵
- Drops file in Drivers directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.027dj.com/
  2⤵
  - Adds Run key to start application
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffedb4946f8,0x7ffedb494708,0x7ffedb494718
    3⤵
    PID:3404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,6468626092657785047,8517565465207423433,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
    3⤵
    PID:2160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,6468626092657785047,8517565465207423433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2904 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,6468626092657785047,8517565465207423433,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3144 /prefetch:8
    3⤵
    PID:3588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6468626092657785047,8517565465207423433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3736 /prefetch:1
    3⤵
    PID:4292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6468626092657785047,8517565465207423433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3768 /prefetch:1
    3⤵
    PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2084,6468626092657785047,8517565465207423433,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5116 /prefetch:8
    3⤵
    PID:3264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6468626092657785047,8517565465207423433,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
    3⤵
    PID:1748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6468626092657785047,8517565465207423433,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:1
    3⤵
    PID:2832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2084,6468626092657785047,8517565465207423433,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5704 /prefetch:8
    3⤵
    PID:1816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6468626092657785047,8517565465207423433,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
    3⤵
    PID:1712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6468626092657785047,8517565465207423433,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
    3⤵
    PID:4664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6468626092657785047,8517565465207423433,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
    3⤵
    PID:3168
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,6468626092657785047,8517565465207423433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6620 /prefetch:8
    3⤵
    PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
    3⤵
    - Drops file in Program Files directory
    PID:1528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0x7ff6dc045460,0x7ff6dc045470,0x7ff6dc045480
      4⤵
      PID:1112
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,6468626092657785047,8517565465207423433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6620 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6468626092657785047,8517565465207423433,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
    3⤵
    PID:2700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2084,6468626092657785047,8517565465207423433,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1284 /prefetch:8
    3⤵
    PID:3572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2084,6468626092657785047,8517565465207423433,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5832 /prefetch:8
    3⤵
    PID:1868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\drivers\etc\hosts

Filesize
734B

MD5
de1cbfe6c3086010af115a1f00909b01

SHA1
c75d4c6e53a497c4dc1df1f50bbef08ac625a3d8

SHA256
f16c19748cefd356850be752ae3f4d30826ee9391e2d5e13cf628aeb7318b9fd

SHA512
d56c78d3718db16a8380296ba5e0bfa68a51635aa21a7dabaa6c6c8cbc2e3456017d1fea71e8cb2fd5c434f5f40d67af76017509e02d331c4f56054a3d57a4b0

Download Submit
memory/4372-132-0x0000000018040000-0x000000001825B000-memory.dmp

Filesize
2.1MB

Download
memory/4372-133-0x0000000018040000-0x000000001825B000-memory.dmp

Filesize
2.1MB

Download