Analysis

  • max time kernel
    150s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-10-2022 00:47

General

  • Target

    b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe

  • Size

    52KB

  • MD5

    34642e15aac09c299214bacfb3f8d399

  • SHA1

    cde7830a6b399f63dd8a12e44b7759b722519973

  • SHA256

    b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf

  • SHA512

    0e3e8634ae33285820c565ede6d3566dab75580114a3dbf57fc245d06055d961a26bfe5a8f9d16e8478c246b523ca0184b88b6577fcafcdf9b55c50864cf7265

  • SSDEEP

    768:9R7+eNd28dSa/7uyrSMBe1QHgkm60GCEduramZ/OCr27c0ZovjU8:nieNfdS+iyjoQHOtzr27cHU

Score
5/10

Malware Config

Signatures

  • Detected potential entity reuse from brand microsoft.
  • Suspicious use of SetThreadContext ⋅ 1 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry ⋅ 2 TTPs 3 IoCs
  • Modifies registry class ⋅ 1 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary ⋅ 5 IoCs
  • Suspicious use of FindShellTrayWindow ⋅ 2 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe
    "C:\Users\Admin\AppData\Local\Temp\b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe"
    Suspicious use of SetThreadContext
    Suspicious use of WriteProcessMemory
    PID:4924
    • C:\Users\Admin\AppData\Local\Temp\b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe
      C:\Users\Admin\AppData\Local\Temp\b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe
      Suspicious use of WriteProcessMemory
      PID:4760
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        PID:484
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd7f9e46f8,0x7ffd7f9e4708,0x7ffd7f9e4718
          PID:4868
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4927261429825876256,10545064417232986603,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
          PID:3492
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,4927261429825876256,10545064417232986603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
          Suspicious behavior: EnumeratesProcesses
          PID:1904
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,4927261429825876256,10545064417232986603,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
          PID:1832
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4927261429825876256,10545064417232986603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:1
          PID:956
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4927261429825876256,10545064417232986603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
          PID:3732
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2144,4927261429825876256,10545064417232986603,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5136 /prefetch:8
          PID:3940
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2144,4927261429825876256,10545064417232986603,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5564 /prefetch:8
          PID:3688
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4927261429825876256,10545064417232986603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
          PID:3936
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4927261429825876256,10545064417232986603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
          PID:2628
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4927261429825876256,10545064417232986603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:1
          PID:4956
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
        Suspicious use of WriteProcessMemory
        PID:524
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd7f9e46f8,0x7ffd7f9e4708,0x7ffd7f9e4718
          PID:3084
  • C:\Windows\System32\CompPkgSrv.exe
    C:\Windows\System32\CompPkgSrv.exe -Embedding
    PID:3924

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                      Privilege Escalation

                        Replay Monitor

                        00:00 00:00

                        Downloads

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                          MD5

                          af05481b81fdeb6c34b41fa28542b8e1

                          SHA1

                          30982103d4ad165cda1b492f96da553b0d5a8663

                          SHA256

                          61fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2

                          SHA512

                          6671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                          MD5

                          d41d8cd98f00b204e9800998ecf8427e

                          SHA1

                          da39a3ee5e6b4b0d3255bfef95601890afd80709

                          SHA256

                          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                          SHA512

                          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                          MD5

                          af05481b81fdeb6c34b41fa28542b8e1

                          SHA1

                          30982103d4ad165cda1b492f96da553b0d5a8663

                          SHA256

                          61fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2

                          SHA512

                          6671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                          MD5

                          af05481b81fdeb6c34b41fa28542b8e1

                          SHA1

                          30982103d4ad165cda1b492f96da553b0d5a8663

                          SHA256

                          61fabb6e11c5fe6ed58cbe1d1651395b973b7f460ebc78183b02484fad2ef7a2

                          SHA512

                          6671efa37f6ed5c9faa5b0a063bc6741d2dd217a6bfd578da3d3c8a54b16395916fa2173851bcd597b7489da05fe33095aedc655d0a7df773bd96f814b3b900f

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                          MD5

                          71b657795f1d63721f304fcf46915016

                          SHA1

                          d2cabf753a2b8888642a3a26878e7f47784153b2

                          SHA256

                          f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

                          SHA512

                          dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                          MD5

                          71b657795f1d63721f304fcf46915016

                          SHA1

                          d2cabf753a2b8888642a3a26878e7f47784153b2

                          SHA256

                          f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

                          SHA512

                          dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                          MD5

                          71b657795f1d63721f304fcf46915016

                          SHA1

                          d2cabf753a2b8888642a3a26878e7f47784153b2

                          SHA256

                          f6d95ff8ef0a6098a3c31bedf0f623555cf3855bab0142f2350f07eb85832c28

                          SHA512

                          dd1d8e6e56463cba11da14b604c4dcedf13e1914c4afab93121f6535a30120e0d907c0129c6eebfc8a0a70a557d2f6d467a24fe0bac960c79519049e1931ea20

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
                          MD5

                          838a7b32aefb618130392bc7d006aa2e

                          SHA1

                          5159e0f18c9e68f0e75e2239875aa994847b8290

                          SHA256

                          ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

                          SHA512

                          9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

                        • \??\pipe\LOCAL\crashpad_484_RRQKAUXVDHRABZYW
                          MD5

                          d41d8cd98f00b204e9800998ecf8427e

                          SHA1

                          da39a3ee5e6b4b0d3255bfef95601890afd80709

                          SHA256

                          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                          SHA512

                          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                        • memory/484-140-0x0000000000000000-mapping.dmp
                        • memory/524-142-0x0000000000000000-mapping.dmp
                        • memory/956-159-0x0000000000000000-mapping.dmp
                        • memory/1832-157-0x0000000000000000-mapping.dmp
                        • memory/1904-153-0x0000000000000000-mapping.dmp
                        • memory/2628-169-0x0000000000000000-mapping.dmp
                        • memory/3084-143-0x0000000000000000-mapping.dmp
                        • memory/3492-152-0x0000000000000000-mapping.dmp
                        • memory/3688-165-0x0000000000000000-mapping.dmp
                        • memory/3732-161-0x0000000000000000-mapping.dmp
                        • memory/3936-167-0x0000000000000000-mapping.dmp
                        • memory/3940-163-0x0000000000000000-mapping.dmp
                        • memory/4760-134-0x0000000000000000-mapping.dmp
                        • memory/4760-135-0x0000000000400000-0x000000000042A000-memory.dmp
                        • memory/4760-136-0x0000000000400000-0x000000000042A000-memory.dmp
                        • memory/4760-137-0x0000000000400000-0x000000000042A000-memory.dmp
                        • memory/4868-141-0x0000000000000000-mapping.dmp
                        • memory/4924-133-0x0000000000400000-0x000000000043E000-memory.dmp
                        • memory/4924-132-0x0000000000400000-0x000000000043E000-memory.dmp
                        • memory/4924-139-0x0000000000400000-0x000000000043E000-memory.dmp
                        • memory/4956-171-0x0000000000000000-mapping.dmp