hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/7ev3n[.]exe

Resubmissions

07-05-2024 16:28

240507-tyx6ssha59 10

07-05-2024 16:24

240507-twmx2sed5t 10

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 16:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/7ev3n.exe

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1864	msedge.exe
1864	msedge.exe
1012	msedge.exe
1012	msedge.exe
4248	identity_helper.exe
4248	identity_helper.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1012 msedge.exe
1012 msedge.exe
1012 msedge.exe
1012 msedge.exe
1012 msedge.exe
1012 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1012 wrote to memory of 1940	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 1940	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 464	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 1864	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 1864	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 2712	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 2712	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 2712	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 2712	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 2712	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 2712	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 2712	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 2712	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 2712	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 2712	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 2712	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 2712	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 2712	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 2712	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 2712	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 2712	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 2712	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 2712	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 2712	1012	msedge.exe	msedge.exe
PID 1012 wrote to memory of 2712	1012	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/7ev3n.exe
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8037d46f8,0x7ff8037d4708,0x7ff8037d4718
2⤵
PID:1940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,1937173616196327016,18429251987622882986,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
2⤵
PID:464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,1937173616196327016,18429251987622882986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,1937173616196327016,18429251987622882986,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
2⤵
PID:2712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1937173616196327016,18429251987622882986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
2⤵
PID:1816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1937173616196327016,18429251987622882986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
2⤵
PID:2968

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,1937173616196327016,18429251987622882986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
2⤵
PID:4136

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,1937173616196327016,18429251987622882986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1937173616196327016,18429251987622882986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
2⤵
PID:4148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1937173616196327016,18429251987622882986,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
2⤵
PID:3884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1937173616196327016,18429251987622882986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
2⤵
PID:4196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1937173616196327016,18429251987622882986,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
2⤵
PID:1048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,1937173616196327016,18429251987622882986,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5544 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3312

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
9dc60aef38e7832217e7fa02d6f0d9f6

SHA1
4f8539dc7d5739b36fe976a932338f459d066db6

SHA256
8a0ee0b6fafabb256571b691c2faf77c7244945faa749c72124d5eb43a197a32

SHA512
18371541811910992c2b84a8eae7e997e8627640bdb60b9e82751389e50931db9b3e206d31f4d9d2dc3ca25ea3a82c0be413ecb0ef3ac227a14e54f406eaa7e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
7ac03b15b68af2d5cb5c8063057cc83e

SHA1
9b2d4db737f57322ff5c4bbddd765b3177f930ab

SHA256
b90d7596301470b389842eecb46bd3a8e614260b0d374d5c35a36afb9c71a700

SHA512
a5e9f40dd9040803046b0218fab6b058d49e5e2a3ada315e161fe9fc80ebb8d6d4442ccc1c98d19e561fc7c61bcf43d662fe2231cacacb447876a2113c2e3732

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
552897243e9fa3dd72aab9a52d3099a7

SHA1
2e771df6e792c4b1d42afcf7c10c488fe4d53597

SHA256
0b9baa9d7f46eefb987a29d537746d85d94ffcada20a69dd9d4465d5b8b5083d

SHA512
ee63bd5359e1f79bad78330bb8011dad1852e9adbc594fbef77afd0927080db167e5547c0acdd9d77503a5c395644481e2e5a2af71b5164e7ce2b6c7ba40ccaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
496B

MD5
c4897aa78d9edac4710b6abd9081210d

SHA1
82fff6d6a6c64af2e1e64a0a56c46cfc2a3470bf

SHA256
1c2dbad9b7fe623f7907fe8875ae1df241de6ea09e8dbb063b885983420fc005

SHA512
207439940f16c3a029f465c4f4b6d290f15deea00c5d46365d2bbe5a27c48371315a7a5e39366638a4d256c843470b6e9acd6fc7c0b85aac10dde6176aba026c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
5cafa0433b2cc24fe9420139c74157dd

SHA1
91c1f881ab32c61c43e50368c6b70cf5e494c13a

SHA256
48d135dc53949c4f8ff54bb5709bfe9f49bfeafba6aadff7c4b0f6fe86d6bbeb

SHA512
c0888d338b0ce60dea4c0912df9c2d3683465b66adb212976866b2dbb941d8f5321a15a6a8878803dd2a97fac8a5562e6a7e745ce4ac39b398d16625a6042dbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
cdfb89a89c0d03fe271634b7d8838051

SHA1
b266aa8f7e8ba786a92c2dfb7553d4386a999feb

SHA256
099ae1ed049f1b51dc3f9f18deb7ce7882fd4c9eb9454e6b12a888f3e1509d9e

SHA512
8881b2fea9e02b5388e1c280a5826004646d9a9b3087285e14b12835c0e4d7c5aee476a512b540555a754255ea611967ff803f84ae3f199506c2d2122a551059

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
537f154f2e445b55842dc34b42501f27

SHA1
dae5abad08829145f7696d69c1e19c57630555fc

SHA256
6d0fc84af1f5e17571ba3b733a104b3e926a35d54de1cae0a854cdb343a04bf9

SHA512
aa6a7f97b66c8b08c9334933e83a2eaa8e459288e715168d90e292ea0f6af94b5a8065609b83cf6882d4efc1dc03bdc9a472afda2c5783611bd2807ad60dad70

Download Submit
\??\pipe\LOCAL\crashpad_1012_TUYWWHXGULZJVSUW
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit