Analysis
-
max time kernel
208s -
max time network
205s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
15/05/2024, 10:59
General
-
Target
edi-texteditor-setup-v3.103.exe
-
Size
54.9MB
-
MD5
1c694f4b347508c2b1b68d1f2c55ea62
-
SHA1
1ed28b59e45dea29ba87dea1a715bdd3d17f3309
-
SHA256
ba6fbfa10028baca880d44b2d490ac0a01af2775909cb18878961b56de32a7c0
-
SHA512
1a1224e1097c368a77e1c4833afc6786d443e0b4c1ae2d9ee325c2168d3a554bc2ee3877442527ad74c4728d40fe038b5d758f9d83cf8bb07081b36ce88b406a
-
SSDEEP
1572864:hhoYOQgOLCnmAQGI106ICd+8la05gEQmQY7PMt6IDWoTUm4:/oYCtnmAQGI10OX5gEQg7PO3R4
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Modifies data under HKEY_USERS 4 IoCs
-
Modifies registry class 57 IoCs
-
Modifies system certificate store 2 TTPs 3 IoCs
-
NTFS ADS 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\edi-texteditor-setup-v3.103.exe"C:\Users\Admin\AppData\Local\Temp\edi-texteditor-setup-v3.103.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-1V9DA.tmp\edi-texteditor-setup-v3.103.tmp"C:\Users\Admin\AppData\Local\Temp\is-1V9DA.tmp\edi-texteditor-setup-v3.103.tmp" /SL5="$A011E,56639786,801792,C:\Users\Admin\AppData\Local\Temp\edi-texteditor-setup-v3.103.exe"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Edi - Text Editor 3\Edi.exe"C:\Program Files (x86)\Edi - Text Editor 3\Edi.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\werfault.exewerfault.exe /hc /shared Global\4590d012674f4386a5db83b0681e82d2 /t 4052 /p 40241⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Edi - Text Editor 3\Edi.exe"C:\Program Files (x86)\Edi - Text Editor 3\Edi.exe"1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512B
MD5d811469f1a24594116cb6f9531d5e4ab
SHA1b1cdb30570c672352bd30dab361c082019105024
SHA256d70734441217cb5a9be79c6e25ef3b7fd49858bb524c54f893ec3b3fde1acef8
SHA512b38d14e50217582a1c39ca8ebd496ce6c10ed25a9a121c834dfad655bf1736ae6f5272a8ccbcf17139b5e2a65c312e9450a1d1eb43f3e19d6ff5cb8f60d237bd
-
Filesize
3.7MB
MD52463fff01c63619b4611926c750bc60b
SHA19c8f8763c4cb2ec2f09e1639dd005b0d4813ead1
SHA256392b6a9e463e193f1b8c48897f49467ddb158eefdf814b8c84402055a7ea2ecf
SHA5126bcefdac56e8de345e57db281623c94ab48436dd96d8929f8943cb9c8097b25f81fd0d1c8012eb4605cea84fae7f9e8da3fd82f3946afc80af579e9c0ca05af6
-
Filesize
4KB
MD5f3fd4fb21260636906461be995fe030a
SHA1a9ccd13eccfa04e2a9378522db4f1802232dc581
SHA2565d796a3ba28c7c5f1bbaa2a3ac4cb639e1cfe2f29011921cce073ae90ef0da1b
SHA51247177645303b4df4ff5829a8f2c2b8b4366acd2f9864440fdc524870dcacf3c0c7d45a1a140889924d1c131c04ea5d16dee017cb3d51390b4e8bce8f96c5d203
-
Filesize
21.6MB
MD51b56b7686af762b549fd40a00996247e
SHA1e3da94c20c955db91163b270fec7d48f52d781c8
SHA256bd725991175b191c7894c6ff886a7f1721107493d79851cf946a1948c001ea95
SHA5126f0663e6c6962a447220187931f41d7be758a75121874dbc1fc54dde9bd4b9f5af2f96e1c10e807b8224f1038e207b0c70c5ce22e2920195bd599797fc086296
-
Filesize
916KB
MD5f9511153084a4347650128ea7ef35b44
SHA10f2471b97572013e35d4f8ddc05d5539ca93c7dc
SHA256e616892ebf07e31af4748333949e4841ac33083d5a1570216dfa35c6926eb247
SHA5127bc0718a7d3050426f02ddda9e38749d95098a6736e59250c9a7c51b09bdaaf5607c046164eaf3db185fd8fc89714d91f12218c9951123813c2595c0652596a4
-
Filesize
5.2MB
MD58ba5ca9559317fd703981c7b0e227a95
SHA1a5064a243c7e9f12c42d765eafcb250c37020e7a
SHA2562cd6bd7a006fe85eb31e99df5235e539ba2a473c01172ad2a9f4e4b6e4118b90
SHA512dd104a31614289ebf33361896007e1e785a929525c89ae4cf81e99d50c0fd33d673ff4c9f291c9aec7f0f690faf2af17f04168efa8d12e4fedfb4c3f05e2cbbe
-
Filesize
459KB
MD5e50351b1dbd4c27b6bd43ac52a122461
SHA1cdc8a1d7c7ed02009364b48e363b8bf2aeaaa881
SHA25677403f30da6035cd9e6c6ff1b1f797341a3e1927e5f9accc8152fca90d4898a8
SHA5120c99e9a9bdd10485290dd4d461593e9726eec994bb8b392ed30def74de599e295f3b3b3a9c016761558637971bfda852d00a7f3586238c48916ee1b88e5e3741
-
Filesize
905KB
MD577b3dfff4f6e8171e6fa52a02d7bd7b8
SHA1526ae207e2f502263b77d540cf369325aa4ead83
SHA25636b9795169c54d5621a6a773f8e537aa371b226404e09c36fd66da428e68b8fb
SHA512cca0e260b35cbc766d1141dc5cc1d2b486fd5b0657e92e3c696b1e056b1c3e006ffaab9255f5846a16c857e1f9762e9e88c4633182f414bddc7ac1c10a0f8256
-
Filesize
1.5MB
MD5aba7411dbc6d2190e473a36ef27d8252
SHA1ac107730100a97aaa38ea0cbf6fd149ad394cf28
SHA25628db74538576a4034c98dad0f59fb44ea7f7881c58dc1f925413c0d8f75b0490
SHA512373d49c37aa53d94e172000a1470acf18c5b06c7c36e52e9d60da94737b44dd7cea1011b4e635d0e2abe48b110703667659d98ebddc4a20509c0a37a14885a96
-
Filesize
3.7MB
MD56984fed0041cd75a1f3fde0a97fce88c
SHA150cd5e1dbb9814a53927bacb4cf7fa81d6f79627
SHA25645f0daf30cfeea4ef68b05b8bcb1765a5788bad3e2dea1e05f010f2c254e9159
SHA512e3cec8f5f21d8a650e2202324954d83f61cb2e03b6ee2943490a22ad505c9fc1b08ca96940dc2dad65b8568569204ecdd439c818fe8340c51f4750b024849a55
-
Filesize
4.3MB
MD5a787953054570c96328bde0c50eab64c
SHA1c849fdb9078bd8b871f69c53a97cf102d583e6bb
SHA256e466d99170823535fd8298c3ef601eb8b05ca93819a602489a97cbcc03539833
SHA5128eacc4d03ff1bb1e9fdc55be4419e2533f2846ea1801a6b11715f80a099744c80bb33eeeb574d17a235a708533bea4850cc9ac9e0da40519a073f6138e236f7e
-
Filesize
8.5MB
MD5bdc1e343e4aa05a11ff5be319b7921a2
SHA1b206056be70cbcff32284c700649a7a09d64d8e0
SHA25660b3d69ad325d9f4413f8a5fea7527ba46ceac13f5832756f692555032b51b26
SHA512f61035729f175a626b2d5208c31d9bb20b02c9b79cdf7ffc81852f81af35c22714f455bbb5e5690aceffcea6bbfc54a93387228de7d9f5386f7cfbe32fdf5784
-
Filesize
16.5MB
MD5c37ed80bd5e084f6e28fe9a9226e6ac8
SHA173efd47c13772b0d7586c42aa874e884600515af
SHA256dbd23066919308aec993f89054c1d66bdb9e9db11a43dbc236e0e176f88559af
SHA5126fef574a8f6bb5733a8e0ceff17c4bf760479767d69d59b244005174f960ce84e1db3e416eede97febf983c4a8e0455cbcf74277d451460617893629e3ab49f7
-
Filesize
19.7MB
MD551bb73df804ddc5a77efe16f29731d4e
SHA131c04ac824637d067d91e5f8ce9b884b4ef697ad
SHA256801df3c4f6563f0e569ae265a28ad7d94ea728767b6afed63d1fb8b7d4ed6b48
SHA512a184842b6b4fe7e5f4c128606dacd8d47ce01a494d3ce2e06c6869da7689c249eb8077d24bd076f8f3c9ceb911a9ff600c494fb6d06353d3f30d5acb83d09b35
-
Filesize
2.2MB
MD591550104d6c8b03293d297f9c764348e
SHA19c585a7657582ef8b1b5c77d16197fc75d91c6b7
SHA256dd01d882d16bb5393c8758b095735137d945e014f230658c425d649939c4a96e
SHA5120d22f5e7c5a030c828d28caf5dabd1298a3beef54bbe5d1b9432a5291f1dd3aa9fbe9d2077ec2b59bcb899758ed320c21b81bbcb981d379f5648db4e3a85f1b7
-
Filesize
6.7MB
MD5e1159d4465488d800498b9474a4c31bc
SHA1f34165f0b9b1c5c99fa52cdd9cd8b9b29df23feb
SHA2565f09cdb53bf401ca56ab75c84abde4a48e66c8bb696962c3aa5679725be8ed4f
SHA5123f5ab0018b4c45ee4dc714b42d5e5b961e3457df9b8a0c8779cb2c2c7118229f7b968cecc060d0e940496556581e55218b4ae6e7bc8f112751245ea19cb9f95f
-
Filesize
7.8MB
MD58a10dc9d04b64c91e82c7584d537a122
SHA114d11ce888e6d85d3bbb8a08745404ae518175f6
SHA256e494c1a13c59e27ba1aebcac17ded157ccadeefa4cf059afc82474f0e97fd03b
SHA512faf7bb6b5946579b62cf1dc37db1069819b4312b99e5dd1b109b303a726be5ddd403483d63859685e62b1c023e98ced430c64d80d9f8c3356b33228054e67b24
-
Filesize
3.6MB
MD56f5e0c60e26ce28b1e1d1da62c1c6ccc
SHA1a9a3c12ebacb4f709e440f453a6def375fb8fa70
SHA2565bf66e7a715d1ecbdf6aa9bad19e016788c3664bc65561c054261e58d239025f
SHA512ee440889ea15990ff92ba5fc75b38945c1daeb43760b400d8c037860b1b92b202831dce000d9be69cf045696ee2986ace9551c024c657ed6f5d23f49b4850b9f
-
Filesize
2.1MB
MD50246a8105abf32b526f2d80453f290f8
SHA17aa65babe4f951ba37f0c3c84751df326082996e
SHA256b0d8baada8544431772c2eba62df86416c14e29f23535bbf97e68af7fae93ae8
SHA512c6e06ff7db4ffdcfefdc03220c9d8cd6231eca3d8c12954fe1339cc0129498ecf66abc4eedf0018c284868d475e63208d05ebfe004e0b41ee5e5390f16abd2e5
-
Filesize
2.9MB
MD5ada4ccca1908d4261cd4373646721d05
SHA161af22df614c447985b1fe153c7ebdf21e6b65b0
SHA256f734786e12fc20565d36cd2b8d9a04fdde695aae214411e38470189cc4d101a8
SHA512543b8ea3dd4a51d59baac691e6b340a873725657e62d67b22310948c3902eec0ffbc7007473e4f7a727b226f10877bd86e1129df594108ecf91f4dfc97170f36
-
Filesize
4.8MB
MD5b229fd4bd7b30d7dfea33c5d38b7a1f4
SHA19ad4acf0e67f47d295ef31f9df89592bf70b5096
SHA2560ef94b99068866ea61e8f3d7e70e38663086504a5b72a1d1758229285f35967b
SHA51249f0f5d699009ff903bc00dc17f91c1b531cf3f232b36d3f95174d42725e3b8c168a1929852a5f76fb833a33d2ce1da93569fd2b85ca6b8ef4a7bb111231fdeb
-
Filesize
745KB
MD51453febcf8a83f152b341a6eb16d19cc
SHA1e816029bf78256d881d0d4116dccf675e93b82b0
SHA2569caf9dd4863e11d88452ec728ce23f2ac10037e934e7b489684acba691940f85
SHA5129aeeeaaf3cb02aa546db216094f41ce3320cbf4c7aa3d6457270ad70ce9fe768d22f01626d3cd08322ec950909a1cbf9bbb86c3860ee057d161ddc1a0db28018
-
Filesize
115KB
MD5b7d6a42b4f3b86e53665251e2f60abd2
SHA17861ada4bed3ea56a9b81e947ed9ed5a2803f1c6
SHA2567d22c67708e448f174969cd09c13ca7edbf683511bd457812352973667a84656
SHA512944a3686e45c4b08a66c896c61bfa3ba9de152dc8aeaa63ddf7ccce2af71ccbf8b2d893ddc6298de9a7db929c591505d70816d86be75fc42f4751fb4961ba337
-
Filesize
76KB
MD52461fadfab026620a3ab7ff6de7bf049
SHA1d9cd3ece8f779d9821d5d4fd6476cc0b2d6428cb
SHA256d05ecb91cc2887dbfd98bafe8438134b60df9d4a8fe7aae2c267c57c2295a9f4
SHA51248280beffa6199740d9cd4c6183771f9ca16e2e18e8d050ec655b92d7207899b2daf90bed8be0804621cf7c48e9bfb60bce971c5ef4ddde2a7b597abf34e2b34
-
Filesize
1KB
MD5862e293637da75c63e70036d62db58e7
SHA1642700f9c59a4b9c2dee0bd8bb9ba49e2875eb6b
SHA25673ce07bd2f5ca42ba02cdf0c3315ebc546fa1b44ef35fa84704d0f5f8c6d654a
SHA512a6f4efbf781a836c9831990d8a7d097be410fc9edf3f45129fe1002db32448bf709491fef37b61e5742a7276e02cff78b95d42ab5868c23e802eed9bdf233b3d
-
Filesize
1000B
MD58c57e93378d153851f611a01c9d02565
SHA15426ed444b9b6cc3ae5dfdd8643b57be654b3fa3
SHA2566b4594265da64d4239a441163d6d2f1f0da8a258e5887640b9fcc1df15bd67da
SHA512821bf6757c07425a9f50205d69fb729a2df644767df04adb676c5c8c55fe435d7f6b795668b1b698135f190f989a11c0219615f5ee37197765f2cb8cbe17cf50
-
Filesize
313B
MD512e695090da00010e035e58402d99f74
SHA174d1fff34a4ae4656a0d2173d86c6bfc5e56a5fd
SHA2560519d90545e3900b3e649ee544dbc1b3f63980a3b529151493bf6f364de17fcd
SHA512237836ddc646c359f34dc9a77ce09f276c8d04740f699c485c630f481d08602c1976063336c2010842043caf0264a352eb2f7f9794cf3a73d4799f38f8fa5be3
-
Filesize
1KB
MD5861388dd73a3557500745ceca6ef2ffb
SHA1f7f3fd657ae7c9acb9b01c9856c8d049bd3cb919
SHA2567fb22c368a0eae224610002426c65fa2693826259b555e91bd67f6105dd9699f
SHA512f8e6b89073e87436679c2b5afd82c497e37f788a6c1344ddce40dc22b80d473d1692ac44d47c1965851356abc7785518d46f2387b7810478135a8caeec867963
-
Filesize
3.0MB
MD508a7d9358e6512a0bbd2219176b811c3
SHA13f8cedc082f4cce604ff5cc65bd94e10c0ae172a
SHA2568a70d1f6abe5d6fbe6c74cc8828638cc5a6008155be33913d3220e54634767d9
SHA512ad9827020ff8a19042bf5c061e0a1129f85c32fec41126e365c4df766572d0e1afdd09217fcec4fcf193777a9bbec93fb3e43d4e2d5a0fb2dad54db5ef882931
-
Filesize
132KB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
392KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
584KB
-
Filesize
19.7MB
-
Filesize
928KB
-
Filesize
2.2MB
-
Filesize
4.8MB
-
Filesize
128KB
-
Filesize
920KB
-
Filesize
144KB
-
Filesize
3.7MB
-
Filesize
824KB
-
Filesize
8.5MB
-
Filesize
4.3MB
-
Filesize
2.1MB
-
Filesize
3.0MB
-
Filesize
7.8MB
-
Filesize
7.7MB
-
Filesize
6.7MB
-
Filesize
1.5MB
-
Filesize
472KB
-
Filesize
16.6MB
-
Filesize
752KB
-
Filesize
5.6MB
-
Filesize
21.6MB
-
Filesize
48KB
-
Filesize
168KB
-
Filesize
88KB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
5.2MB
-
Filesize
3.3MB
-
Filesize
4KB
-
Filesize
8.1MB
-
Filesize
7.7MB
-
Filesize
3.6MB
-
Filesize
408KB
-
Filesize
5.2MB
-
Filesize
6.1MB
-
Filesize
1.2MB
-
Filesize
680KB
-
Filesize
1.1MB
-
Filesize
1.2MB
-
Filesize
2.5MB
-
Filesize
88KB
-
Filesize
304KB
-
Filesize
240KB
-
Filesize
132KB
-
Filesize
440KB
-
Filesize
1.6MB
-
Filesize
1.3MB
-
Filesize
3.0MB
-
Filesize
4.8MB
-
Filesize
1.7MB
-
Filesize
136KB
-
Filesize
392KB
-
Filesize
3.8MB
-
Filesize
32KB
-
Filesize
40KB
-
Filesize
664KB
-
Filesize
4KB
-
Filesize
104KB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
836KB
-
Filesize
836KB
-
Filesize
836KB
-
Filesize
728KB