Analysis

  • max time kernel
    293s
  • max time network
    327s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-de
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-delocale:de-deos:windows10-2004-x64systemwindows
  • submitted
    09-05-2024 11:25

General

  • Target

    VOlCEMOD/resources/app.asar.unpacked/node_modules/get-fonts/binding.dll

  • Size

    125KB

  • MD5

    eeb1d1ea9fc3f870f292161cfa79850d

  • SHA1

    ea4f4324245f9f4d6280ef285151f688221d6023

  • SHA256

    149bc3824ecbf68f7a892a311e77548ea156963b88db0590063b50725c9d883c

  • SHA512

    795269fba2737ca51d61bb0f6e674c8ed45f2590a48d1dbc53adae9a85b5565e372de6e2a888f038660173f6f4fe0ecda293c441415296e79097c261c452f254

  • SSDEEP

    3072:cd5+N3E2MosoJCakr0dHPAMMMtrAfz9MrRAG:yIxMQQakr0xPSfzirqG

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\VOlCEMOD\resources\app.asar.unpacked\node_modules\get-fonts\binding.dll,#1
    1⤵
      PID:4320
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5220 --field-trial-handle=1996,i,4056925377318661815,11359471268444500297,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:2032
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        1⤵
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4424
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffd004d2e98,0x7ffd004d2ea4,0x7ffd004d2eb0
          2⤵
            PID:788
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2104 --field-trial-handle=2108,i,5520269004328559140,4749811539654561387,262144 --variations-seed-version /prefetch:2
            2⤵
              PID:5024
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2336 --field-trial-handle=2108,i,5520269004328559140,4749811539654561387,262144 --variations-seed-version /prefetch:3
              2⤵
                PID:3400
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2872 --field-trial-handle=2108,i,5520269004328559140,4749811539654561387,262144 --variations-seed-version /prefetch:8
                2⤵
                  PID:3024
                • C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4516 --field-trial-handle=2108,i,5520269004328559140,4749811539654561387,262144 --variations-seed-version /prefetch:8
                  2⤵
                    PID:3844
                  • C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4516 --field-trial-handle=2108,i,5520269004328559140,4749811539654561387,262144 --variations-seed-version /prefetch:8
                    2⤵
                      PID:4780
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4652 --field-trial-handle=2108,i,5520269004328559140,4749811539654561387,262144 --variations-seed-version /prefetch:8
                      2⤵
                        PID:4236
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4656 --field-trial-handle=2108,i,5520269004328559140,4749811539654561387,262144 --variations-seed-version /prefetch:8
                        2⤵
                          PID:2380
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=de --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4668 --field-trial-handle=2108,i,5520269004328559140,4749811539654561387,262144 --variations-seed-version /prefetch:8
                          2⤵
                            PID:1428
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4644 --field-trial-handle=2108,i,5520269004328559140,4749811539654561387,262144 --variations-seed-version /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1104
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3816 --field-trial-handle=2108,i,5520269004328559140,4749811539654561387,262144 --variations-seed-version /prefetch:8
                            2⤵
                              PID:1528

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            280B

                            MD5

                            e97768fa8c24328f1d4c0dc28a052cdc

                            SHA1

                            0a91d134b9d667c40495f0469da8f69674fd6d51

                            SHA256

                            3b8c9594ecb23853e7d21afda95c6f28af0c4f1f84326dfee2cdc1bbf77c341a

                            SHA512

                            e1efba70459bbbcf1651d0c4a0aa7b23c0c88264e2785f3250521a2a91afdc7cc6e8512d16543e7c1129141d0f800755f9eafa45c746ce529060a85c8e31f8df

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

                            Filesize

                            2B

                            MD5

                            99914b932bd37a50b983c5e7c90ae93b

                            SHA1

                            bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                            SHA256

                            44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                            SHA512

                            27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

                            Filesize

                            1KB

                            MD5

                            8d9f4525a4f97a8cecd04c8760d59dce

                            SHA1

                            6637aea928ac543e4f72bbafd49d7c622cd7680f

                            SHA256

                            d985dbd87d0b2f52ca23e8444854e632418bd3a887b96e7de4f9e7bd4e031f88

                            SHA512

                            ee662c13537af4acce633087da90a36e96c34d82a2f4c9986453f44fc54e9d9be42dd35d198b538ee9f0f39b8a48457e6969e5c77c08638baba9ce2f88f24595

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

                            Filesize

                            2B

                            MD5

                            d751713988987e9331980363e24189ce

                            SHA1

                            97d170e1550eee4afc0af065b78cda302a97674c

                            SHA256

                            4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                            SHA512

                            b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

                            Filesize

                            40B

                            MD5

                            20d4b8fa017a12a108c87f540836e250

                            SHA1

                            1ac617fac131262b6d3ce1f52f5907e31d5f6f00

                            SHA256

                            6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

                            SHA512

                            507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            efdc2245fa7294a24c09cd6aa3b3561b

                            SHA1

                            2a2fed760c1e076f1bbf78301769586ac6359760

                            SHA256

                            2bbeefe4589d00397a3b3b351efa14a742a1720248e9e357f99585b27da69e52

                            SHA512

                            9fd298e7a33a18de3e01ff0db40219db28861411752082308fe1240d94ea4d8251608c0d6eb6a8c4da6bc91ce0c727551924cba5d149610456742f7ab1c79b5e

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                            Filesize

                            30KB

                            MD5

                            d85ecf6c0fff765de587880112e69524

                            SHA1

                            048085967fe22aee61e154d0d498dbe902289ef0

                            SHA256

                            d65ec71f75d508abd73b513042c04b5bbdd5e6961da9dd1bf8fa9919545689c1

                            SHA512

                            10afe040a390ae4aad2e261387c8d06e2373e27ab8bd1597e84d470e2124348ab90866b3c04389121e5bbf9e5c5e37544cc88eec564d9b3512c459587f06bc80

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                            Filesize

                            22KB

                            MD5

                            e594ca5703c06ce9b4561d5edc2c7005

                            SHA1

                            05616555e13a2e721498f707222524f33698b0cd

                            SHA256

                            8b6d3939ee820e3baa28fdf3305baa708c633206c5b8e9ddf9dc4f230ec18eb4

                            SHA512

                            cd91b02165ee50eb2f405509ea252a990f75c9d7e9d4cc2f01793b84f30f72dc0e692768327ef871a095c861d1ed82fdefc2db78217e9f57620bbff54da6f94f

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                            Filesize

                            43KB

                            MD5

                            27374b3a104e5d62c917d5931c82b58d

                            SHA1

                            25a7a9cbdef2736b0524506fd2cb5a5f6b363047

                            SHA256

                            6161e07b1d316ead7491c7dcef3e0b341b7e82adc00387185fc86f4e96d5a761

                            SHA512

                            4241195d66917e7eab858605e1566c5510329c36456964d2a8e2130355cdc2972fbd06c791909595577161944fed3f71c811c624c01736549a21aa538e58ae09

                          • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

                            Filesize

                            2KB

                            MD5

                            209aaad0681c44b162af9eb383115034

                            SHA1

                            448eaa98d5239ce6899c9bfff56c1b9ccf293b5f

                            SHA256

                            76cd8df104131e55546d212ee282363cf9aeb285520fb6d2764b03d3cda4948d

                            SHA512

                            b150b218728dd251644f14f0276864eba0471bfe5bc4301868787b8a23963baab5f53a8ad0f5b58016d20057adf02bd232e35421c05b5c19c97acefa4719ba11