Analysis
-
max time kernel
16s -
max time network
22s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23-03-2023 18:05
Static task
static1
General
-
Target
new.exe
-
Size
698KB
-
MD5
0bdface7f8f68b6fbec67efb34331080
-
SHA1
f32d0dbbbd1436ea3864addb1079c77fb393100c
-
SHA256
ce0e6632dab42a4cb798017353dd7f07bfdb127939926eab9d44f2d2eb5bd36b
-
SHA512
b84bbf00829cc0094615859e40d4ee70abe11aa9da77b288f9d24b3d6ae4e3229b77892d370ca01d9c6a5491528d82e5ea568241378b0d03fe05e0e3d63ba266
-
SSDEEP
12288:23irzIwwfIIxbeVgDqXdQQg2uKehZGWAljlZhJkjvRhBT6+oHaPmpqn:mAatuZhJsr83+
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
msedge.exemsedge.exepid process 2952 msedge.exe 2952 msedge.exe 3804 msedge.exe 3804 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
msedge.exepid process 3804 msedge.exe 3804 msedge.exe 3804 msedge.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
msedge.exepid process 3804 msedge.exe 3804 msedge.exe 3804 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
new.exemsedge.exedescription pid process target process PID 2536 wrote to memory of 3804 2536 new.exe msedge.exe PID 2536 wrote to memory of 3804 2536 new.exe msedge.exe PID 3804 wrote to memory of 3500 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 3500 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 1532 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 2952 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 2952 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 464 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 464 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 464 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 464 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 464 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 464 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 464 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 464 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 464 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 464 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 464 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 464 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 464 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 464 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 464 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 464 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 464 3804 msedge.exe msedge.exe PID 3804 wrote to memory of 464 3804 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\new.exe"C:\Users\Admin\AppData\Local\Temp\new.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=new.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.02⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff9edb46f8,0x7fff9edb4708,0x7fff9edb47183⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,13562117891505219397,14426742587129960598,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,13562117891505219397,14426742587129960598,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:23⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,13562117891505219397,14426742587129960598,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:83⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13562117891505219397,14426742587129960598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13562117891505219397,14426742587129960598,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13562117891505219397,14426742587129960598,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:13⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5462f3c1360a4b5e319363930bc4806f6
SHA19ba5e43d833c284b89519423f6b6dab5a859a8d0
SHA256fec64069c72a8d223ed89a816501b3950f5e4f5dd88f289a923c5f961d259f85
SHA5125584ef75dfb8a1907c071a194fa78f56d10d1555948dffb8afcacaaa2645fd9d842a923437d0e94fad1d1919dcef5b25bf065863405c8d2a28216df27c87a417
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5d2642245b1e4572ba7d7cd13a0675bb8
SHA196456510884685146d3fa2e19202fd2035d64833
SHA2563763676934b31fe2e3078256adb25b01fdf899db6616b6b41dff3062b68e20a1
SHA51299e35f5eefc1e654ecfcf0493ccc02475ca679d3527293f35c3adea66879e21575ab037bec77775915ec42ac53e30416c3928bc3c57910ce02f3addd880392e9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
48B
MD571f24a473be8c3887472559f1e66ab15
SHA107f8c2b6dc0567047c23546e0513cfd7e1cf818b
SHA256d8cc321055c6338ac5b6aae10d056ea591a5d5235e4a00cc0f009e37e61e05ac
SHA51250ed5a6c2504d59e6fdc16ebc40b7079d5307d57aac99e0fc22fce77681a8a2ca2ff8e7e5df8e2b815bb900102567dc429533156fb8f46bffd0063ef90a1a7c2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
192B
MD500a01d4d5a8eee197840dcaeeb2eca2d
SHA1485d780526c04b106a22842ff427896f126bc0a2
SHA2569296007efc929ba5ae34d345f5a14626e87a848ff7d3102b34dc4f09e630a4c6
SHA5122156e7370eb8109a6a52e5dc7dc430397c3dc3a8b76ee2a52d208b01ff7515ec9db3b8c66b1722e4f9f191c17cd7de87f43f597a12d648e8480de4406796f148
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.icoFilesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_2Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnkFilesize
2KB
MD59b9c8a737614a0197216a8c1f176c3d9
SHA1b0fad4c0750c7d72aa8e2d4c65504285d2d9bedf
SHA25642a13d00946f85bb26ef74d8c5b82313dad53c7b06e49cf60f4c71908b01e081
SHA51283b49e66a0287dd451c8d8661cb70e60e583cfd39c08aa82a35816d87ca5e909aa3b52f689710f7e954ef248f6b9afee130be0b704338ea93b335805acb8456e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
579B
MD533aa7056786d29f6acbbe829bf0586bb
SHA128a847049f5624d9aa71e47bf56adf904ae12a10
SHA25673533516a7c457133d290ed1a3af8ffe3554b87c9e705924523539a11453fa56
SHA512398c0ba7e87c68d6a448a8c327db7388ab9bf04afbfd8238984c570c87c6c319bbe3cc371d6e29b8333dba0572053fd5049e9842f8507a4ac4067e6d3b0b4e9f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
4KB
MD5388939b6ac94293e1b4d0a3ecbc5d16c
SHA18e15a9541bdbb1b0a0a9beeb7bed370eae3beb4c
SHA256e52b7f8f9135f24bb1dbc98a0e0fb47953ae3b694cc28653ff0c86839205aea1
SHA5122af0d087c57fb3f9ee3bc7561a3ff83d26266e78a9a3c030a06cb9c049ce9e3153151ab20623a6993fdc489bc9439b35f5fb48f2990a640b32b8379be1baa645
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5af8095357ceea2c7b4ca748a86dccf9a
SHA1c0499eda35435505c53c2268dce03fec364aa6d8
SHA256096896876dfcee7dc33cb50a3906e824bd890321004db549e463307e8e2bd089
SHA5122ff1c038e26c374ebe6bd45adc1c80d26f508d701d5b58a2237ca1edd42ba7b9510fed1dbce936813ff94b521173f3bbef7f8c2b01f2c96385717017704c493b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD5130644a5f79b27202a13879460f2c31a
SHA129e213847a017531e849139c7449bce6b39cb2fa
SHA2561306a93179e1eaf354d9daa6043ae8ffb37b76a1d1396e7b8df671485582bcd1
SHA512fbc8606bf988cf0a6dea28c16d4394c9b1e47f6b68256132b5c85caf1ec7b516c0e3d33034db275adf267d5a84af2854f50bd38a9ed5e86eb392144c63252e01
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
9KB
MD5ec58e86899e71f6f808698550d1639a3
SHA13e861adb2705db4b91aa9b91bfb021aa3df64180
SHA2568fd44dc48a9a7e4c90b1960824c2f8b686c8f702f7df7c7b31dd99f325f2a865
SHA512ac9a2bcb45378555171517bff6bb9a7c6fd22fb8fa10fefbe912423b381b26d6b93f9b4e173a390cd55930bc0df40d3ebd78bc67fcc2379880c9cccf447a14e6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
\??\pipe\LOCAL\crashpad_3804_QKFLQUPGKFEHXUJQMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e